Solved

Internet Sharing/Internet Firewall Service causing Major CPU usage

Posted on 2003-11-28
10
988 Views
Last Modified: 2006-11-17
I have 2 computer running XP Pro hooked up with a plain hub and network cables.
one of them has dial up internet which I share with my other computer.

about a month ago I noticed that the computer with the internet connection was REALLY slow, turns out SVCHost was using upwards of 90% of the CPU usage, after much frustration I discovered that by turning off the internet sharing/internet firewall service the SVChost stops eating up all the CPU usage...

So now my computer is running fine but I no longer got internet sharing, I tried redoing the whole setup to do a home network but SVCHost will use 90% of the cpu usage whenever internet sharing/internet firewall service is enabled.

I'm thinking that the files may be corrupted and some how causing this problem, can anyone let me know what files I need to replace for this service?
What lse I should check with this issue?
Or anyone else come across this issue??
I really need to get the internet sharing back up and going between the 2 computers.
0
Comment
Question by:blckknight
  • 5
  • 4
10 Comments
 
LVL 3

Expert Comment

by:MadAd1
ID: 9839436
Try uninstalling QoS from the network control panel
0
 
LVL 3

Expert Comment

by:MadAd1
ID: 9839445
For confirmation, thats the QoS Packet scheduler found if you right click my network places/properties, then right click local area network/properties and it should be in front of you on the general tab
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9839846
0
 

Author Comment

by:blckknight
ID: 9840407
Sunray, Thanks but I have norton completly up to date and run ad-aware every few days to clean out any spyware.

as far as I'm aware my system is clean.

 MadAd1 Thank you, I will try that and see what comes of it.
0
 

Author Comment

by:blckknight
ID: 9883926
I removed QoS and reactivated internet sharing/internet firewall service...

and it still causes my SVChost to use 90% of the CPU usages..

I wan SFC scan and it didn't detect anything wrong, anyone have any ideas what else I could do??
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 3

Expert Comment

by:MadAd1
ID: 9885931
ok well providing you have checked that its not the svchosts.exe virus (note the S on the end of svchost, with the s is the virus, without s is normal) then we had better see whats causing the problem.

1. Open your Task manager (CTL-ALT-DEL) and go to the menu bar, view>select columns and put a check (tick) in the box marked memory usage then ok the box.

2. Look down the list for the svchost that is a problem, and note its mem usage

3. open a dos console (start>run> type cmd) then type tasklist (return).  Cross reference the mem usage you already found in the task manager with the list in the console and obtain the PID for the offending svchost.

4. now type (at your dos prompt) tasklist /svc and look down the list for the PID - to the right youll see one or several names that runs under that svchost wrapper - note all those down and report back - one of those threads is the culprit.



0
 

Author Comment

by:blckknight
ID: 9886263
Ok here are the threads that are running under the problematic SVChost

AudioSrv
Browser
CryptSvc
Dhcp
dmserver
ERSvc
EventSystem
FastUserSwitchingCompatibility
helpsvc
lanmanserver
lanmanworkstation
Messenger
Netman
Nla
RasAuto
RasMan
Schedule
seclogon
SENS
SharedAccess
ShellHWDetection
srservice
TapiSrv
TermService
Themes
TrkWks
uploadmgr
W32Time
winmgmt
wuauserv
WZCSVC

Thats with the Internet connection/internet firewall service running..
when I stop the service I noticed that the
"SharedAccess" thread is not there anymore and my CPU usage is at a normal level.

Whats the next step?
0
 
LVL 3

Accepted Solution

by:
MadAd1 earned 250 total points
ID: 9887351
Step? I dunno, im making it up as I go along ;)

Look in your system event log (start>programs>accessories>administrative tools>event viewer>system for problems, probably relating to programs in that list.

I notice you still have stuff like messenger running, thats a popular one to cause problems, kill it since theres no downside and it only gets used by spammers, also kill the other services you dont need (http://www.theeldergeek.com/services_guide.htm refer here, but do be conservative, theres noting worse than doing 20 fixes and finding one has broken something you use).  As a trial, disable fast user switching (assuming you dont use it) and (assuming you do have your lan as static ips) disable dhcp - 2 problematic ones.

I had a look on the web, It seems lots of people get svchost using 100% however ive seen just about every service mentioned or blamed and there must be a pattern, but i cant see it other than they are all wrapped.  There is mention of a memory leak, and compounding matters, svchost does like to keep trying to restart services that have failed - put them together and you have a resource drain.

Just to make sure your ICF is all ok, you can try updating it with the ANP (if you havent already) http://support.microsoft.com/?id=817778

Make sure you dont have 2 hosts files running - along with norton that can really make a mess of things (windows\system32\drivers\etc\hosts )... lmhosts is allowed btw.  Some people have problems running norton itself, claims its causing problesm, but then so do some with mcaffe too.

Finally for now, give your registry a cleanup - jv power tools has a very useful version and its safe but hes got popular and now charges for the latest ed. but you can get an old download from a s/w site, its the same.
0
 

Author Comment

by:blckknight
ID: 9901312
For some reason i didn't get a Email informing me of this reply..haha

so didn't know there was a reply..

ok i'm gonan check a few of these also..but yeah lke you I came across alot of the 100% SVC all over the net..

I'm busy this week..when I got some free time I'll see what I can come across with what else you suggested.

Figures the only comp problem I can't seem to fix is at home.
0
 

Author Comment

by:blckknight
ID: 10020370
In the long run..I couldn't solve the problem...
I ended up getting a new video card and the drivers wouldn't instal properly so I decided to give up and I just formatted my C drive and reinstalled windows, everything is back to normal now.

Thanks for your help MadAd1 I'll give you the points for your help.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now