Internet Sharing/Internet Firewall Service causing Major CPU usage

Posted on 2003-11-28
Last Modified: 2006-11-17
I have 2 computer running XP Pro hooked up with a plain hub and network cables.
one of them has dial up internet which I share with my other computer.

about a month ago I noticed that the computer with the internet connection was REALLY slow, turns out SVCHost was using upwards of 90% of the CPU usage, after much frustration I discovered that by turning off the internet sharing/internet firewall service the SVChost stops eating up all the CPU usage...

So now my computer is running fine but I no longer got internet sharing, I tried redoing the whole setup to do a home network but SVCHost will use 90% of the cpu usage whenever internet sharing/internet firewall service is enabled.

I'm thinking that the files may be corrupted and some how causing this problem, can anyone let me know what files I need to replace for this service?
What lse I should check with this issue?
Or anyone else come across this issue??
I really need to get the internet sharing back up and going between the 2 computers.
Question by:blckknight
  • 5
  • 4

Expert Comment

ID: 9839436
Try uninstalling QoS from the network control panel

Expert Comment

ID: 9839445
For confirmation, thats the QoS Packet scheduler found if you right click my network places/properties, then right click local area network/properties and it should be in front of you on the general tab
LVL 49

Expert Comment

ID: 9839846

Author Comment

ID: 9840407
Sunray, Thanks but I have norton completly up to date and run ad-aware every few days to clean out any spyware.

as far as I'm aware my system is clean.

 MadAd1 Thank you, I will try that and see what comes of it.

Author Comment

ID: 9883926
I removed QoS and reactivated internet sharing/internet firewall service...

and it still causes my SVChost to use 90% of the CPU usages..

I wan SFC scan and it didn't detect anything wrong, anyone have any ideas what else I could do??
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.


Expert Comment

ID: 9885931
ok well providing you have checked that its not the svchosts.exe virus (note the S on the end of svchost, with the s is the virus, without s is normal) then we had better see whats causing the problem.

1. Open your Task manager (CTL-ALT-DEL) and go to the menu bar, view>select columns and put a check (tick) in the box marked memory usage then ok the box.

2. Look down the list for the svchost that is a problem, and note its mem usage

3. open a dos console (start>run> type cmd) then type tasklist (return).  Cross reference the mem usage you already found in the task manager with the list in the console and obtain the PID for the offending svchost.

4. now type (at your dos prompt) tasklist /svc and look down the list for the PID - to the right youll see one or several names that runs under that svchost wrapper - note all those down and report back - one of those threads is the culprit.


Author Comment

ID: 9886263
Ok here are the threads that are running under the problematic SVChost


Thats with the Internet connection/internet firewall service running..
when I stop the service I noticed that the
"SharedAccess" thread is not there anymore and my CPU usage is at a normal level.

Whats the next step?

Accepted Solution

MadAd1 earned 250 total points
ID: 9887351
Step? I dunno, im making it up as I go along ;)

Look in your system event log (start>programs>accessories>administrative tools>event viewer>system for problems, probably relating to programs in that list.

I notice you still have stuff like messenger running, thats a popular one to cause problems, kill it since theres no downside and it only gets used by spammers, also kill the other services you dont need ( refer here, but do be conservative, theres noting worse than doing 20 fixes and finding one has broken something you use).  As a trial, disable fast user switching (assuming you dont use it) and (assuming you do have your lan as static ips) disable dhcp - 2 problematic ones.

I had a look on the web, It seems lots of people get svchost using 100% however ive seen just about every service mentioned or blamed and there must be a pattern, but i cant see it other than they are all wrapped.  There is mention of a memory leak, and compounding matters, svchost does like to keep trying to restart services that have failed - put them together and you have a resource drain.

Just to make sure your ICF is all ok, you can try updating it with the ANP (if you havent already)

Make sure you dont have 2 hosts files running - along with norton that can really make a mess of things (windows\system32\drivers\etc\hosts )... lmhosts is allowed btw.  Some people have problems running norton itself, claims its causing problesm, but then so do some with mcaffe too.

Finally for now, give your registry a cleanup - jv power tools has a very useful version and its safe but hes got popular and now charges for the latest ed. but you can get an old download from a s/w site, its the same.

Author Comment

ID: 9901312
For some reason i didn't get a Email informing me of this reply..haha

so didn't know there was a reply..

ok i'm gonan check a few of these also..but yeah lke you I came across alot of the 100% SVC all over the net..

I'm busy this week..when I got some free time I'll see what I can come across with what else you suggested.

Figures the only comp problem I can't seem to fix is at home.

Author Comment

ID: 10020370
In the long run..I couldn't solve the problem...
I ended up getting a new video card and the drivers wouldn't instal properly so I decided to give up and I just formatted my C drive and reinstalled windows, everything is back to normal now.

Thanks for your help MadAd1 I'll give you the points for your help.

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Windows 10 -- Home to Pro upgrade ? 4 91
How Do I Set Up XP Mode in Windows 7? 8 73
What is this Task? 4 84
MS-Access 2002 error (Win XP on Win7Pro) 19 35
Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
Issue: Unstable cursor in Windows XP and Windows runs extremely slow in that any click will bring up the Hour glass (sometimes for several seconds before giving you what you want) . Troubleshooting Process and the FINAL FIX: This issue see…
I designed this idea while studying technology in the classroom.  This is a semester long project.  Students are asked to take photographs on a specific topic which they find meaningful, it can be a place or situation such as travel or homelessness.…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now