• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 493
  • Last Modified:

High CPU when downloading?

Only recently, my computer has started to have a high a CPU usage whenever I am downloading stuff, be it from IE or from copying files across my network. By having high CPU usage, the music I am playing while downloading from winamp or windows media player would skip, keyboard input would lag and skip too. All this only happens when I am downloading, I am still able to play games, or run several program at the same time without lagging.  When I download though my "Explorer.exe" is at 99%...

I have downloaded Proccess Explorer and the thread that is utilizing all the cpu is "Shlwapi.dll".  I have looked it up and it isn't showing as spyware...I see 3 or 4 of them...but only one of them is spiking my CPU when I download or copy things across my network.  I have looked for hours and hour on the internet and have tried many things.  One is deleting my pagefile cause it seems the Kernel is using all of the CPU.  This did not work...I have tried disabling certain registry keys I have found that have helped others with similair spiking issues.  I just haven't found anyone that has my exact probelm that has been solved.  Could this be my hardware going out or a simple fix I can do?

Please help!

- Ody
0
Odyssey122
Asked:
Odyssey122
  • 11
  • 10
  • 6
  • +4
2 Solutions
 
willcompCommented:
Although a process or service is not associated with malware per se, that doesn't mean that malware is not using a legitimate process or service for nefarious purposes.

I recommend that you do a good adware/spyware scan with Spybot S&D, AdAware SE, and/or other good removal programs of your choosing.  Also, a virus scan is in order if not already done.

Hijack This will also aid in identifying malware and allow it to be stopped in many cases.

What about firewall software?  Have you tried disabling firewall to see if that makes a difference?
0
 
CallandorCommented:
Are you running WinXP?  Perhaps your IE was corrupted and needs to be repaired: http://support.microsoft.com/?kbid=318378  It's not a hardware problem, given that it only occurs on downloads.
0
 
Odyssey122Author Commented:
willcomp - I have done all that and more...my xp firewall is disabled and I have no other firewalls...I have also tried many other nic cards to rule out driver issues...this has done nothing for me...I have norton corporate edtion on my computer with updated definitions as well..

Callandor - I am running Windows XP.  I have thought about that, but I have also mentioned in my post that it also happens when just copying files across my network.  Not using IE of course, using Explorer.  Now I know IE and Explorer are closely related, but I don't see how this would occur when it was working perfectly before.  So updating it I don't see the point in that.

I have also ruled out my router to see if I was getting packet loss or latency from it.  I have hooked up two computer to a 10mbps hub and tried copying files between the two computers.  It also does it then, ruling out my router as the problem.  I have also traded out network cables to rule out a bad network cable.  It's driving me bonkers and leading me to believe it's I/O problems with possibly my hard drive or my motherboard.

Ugghh...can anyone verify this for me before I reinstall to see if it's software, before I go out and buy a new hard drive and motherboard?
0
Get your Conversational Ransomware Defense e‑book

This e-book gives you an insight into the ransomware threat and reviews the fundamentals of top-notch ransomware preparedness and recovery. To help you protect yourself and your organization. The initial infection may be inevitable, so the best protection is to be fully prepared.

 
willcompCommented:
By "done all that and more," assume you have checked for adware/spyware with Spybot et al and ahve used Hijack This.  Norton is poor at best in identifying and removing adware/spyware.

Have you checked winsock LSPs for a problem?
0
 
Odyssey122Author Commented:
yes you assumed correclty...i have used ewido, spybot, hijackthis, adaware, cwshredder, housecall and panda antivirus several times...

winsock LSP's?  what's that?
0
 
willcompCommented:
Layered Service Providers in Windows Sockets.  You can check by running Spybot in advanced mode and selecting tools.  A rouge or corrupt LSP in winsock can cause problems.

Since all traffic is controlled by TCP/IP utilizing winsock, it's worth a shot resetting winsock.  There's a little utility that will do it for you (winsockfix).  Will have to reconfigure TCP/IP settings for network unless you are using DHCP.

http://www.tacktech.com/display.cfm?ttid=257
0
 
Odyssey122Author Commented:
hmmm, never thought of that...can I ask a stupid question though...wouldn't of switching out 3 different brand network cards bypass this as being a possible culprit?
0
 
willcompCommented:
No.  That would have no effect on winsock.

Do you have same behavior when PC is connected to Internet and disconnected from internal network or when other PC is off?
0
 
CallandorCommented:
You may have a damaged or loose hard drive cable, so swap it out.  It's not likely, since you would be experiencing other problems accessing the hard drive, but it's an easy fix to try.
0
 
knoxzooCommented:
Try reinstalling the drivers for your network card.  If the network card is flaky, it can cause damaged packets.  Damaged packets result in massively increased demands on the CPU.  Since you have multiple instances of the packet monitoring dll loading, that would be my first guess.  If reinstalling the drivers doesn't do it, try a different card.  Also, reboot your modem, just in case.
0
 
garycaseCommented:
"... when I download or copy things across my network ..." ==> in other words, whenever you're writing to or reading from one of your disks.   This MAY simply be a case where your disk has reverted to PIO access.   If so, this will fix it  (this is a harmless registry edit -- the deleted values will be reset by Windows at next boot):

Load RegEdit (Start - Run - Regedit)

Go to the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\000x

The last four digits will be 0000, 0001, 0002, 0003, and so on.

Under each key, delete all occurences of the following values:

     MasterIdDataChecksum
     SlaveIdDataChecksum

Now reboot your system and see if the problem disappears.

You can check this in advance if you want by going to Device Manager; expanding your IDE/ATAPI controller line; and, for each IDE channel (Primary & Secondary) do a right-click, Properties, and look on the Advanced tab to see what the "Transfer Mode" is set to (should ALL be "DMA if available"), and what the "Current Transfer Mode" is (you can't change that in Device Manager -- that's what the above registry mod will force Windows to detect).
0
 
Booda2usCommented:
This also may be a symptom of you're 'index.dat' files growing so large that they're choking your CPU by causing data transfers from memory to hdd. They usually can only be deleted in DOS mode or by a 3rd party application. One such application is called Mil Shield, which isn't free and is available at:
http://www.milincorporated.com/a_indexdat.html 
at that site you can find instruction and education about and how to delete index.dat files manually also.
I hope this helps you out...Booda2us
0
 
Odyssey122Author Commented:
willcomp - thank you for the response...it seems to happen on internet and off internet as I explained I have disconnected it from my router and just hooked it and another computer straight to a hub.  Not internet acess and set up dynamic ip's so I could make a file transfer, this as well showed high cpu in the same way.

Callandor - This is very good assumption, I have not tried this and if I recall I have rebooted a couple times and the hard drive was not found by the BIOS...I hate SATA now if this is the case...cause the connection to the board is so easily accessible to be wiggled out or just loose.

knoxzoo - I thank you for your response, but as I have stated I have changed out several different brands of network cards, cause I too thought it may be a driver issue, I have also tried updating all drivers per those cards with no change in problem.  I have also rebooted modem and router several times, but like I say this happens off the router and the modem as well.

garycase - I will try this tonight, I think you are right, I think something is wrong with my I/O somehow...wether it be cable, board, or hard drive...i will try these registry settings tonight and see what happens...
0
 
Odyssey122Author Commented:
Booda2us - I have read about that, and have thought about doing that...I will try that tonight as well and see if that is causing the problem.  I have noticed that it is mostly "Kernel" utilization that is spiking it to 100% which led me to believe a bad pagefile.  This was not the case though.  Thank you...
0
 
garycaseCommented:
... if you've noticed spiking CPU with other I/O that's almost certainly what's happened.  I'd try the registry mods before bothering to open up the case ==> if that's the issue you'll be done :-)
0
 
willcompCommented:
The dll in question handles a number of functions including handling UNC and URL.  Also take a look at your hosts file and remove any extraneous entries.

What happens when you copy files from folder to folder on local hard disk?  If it's a drive problem, should show up there also.
0
 
Odyssey122Author Commented:
garycase - Yeah if it is I'll kiss ya dude...I'll keep you posted, I get off work in 3 hours...I'll go straight home and do all these awesome suggestions...I thank you...

willcomp - nah, it doesn't spike when I'm copying from folder to folder on the same drive...seems to only do it when I download from the internet, be it from torrents, p2p, IE or network transfer is when it does it.  I will check hosts file when I get home tonight...thank you for your help...
0
 
willcompCommented:
As you may have noted, common bond seems to be network transmissions using TCP/IP protocol.  That's why I've been trying to delve into settings that effect TCP/IP transmission.  However, there are folks around that know much more about TCP/IP than I do.  Maybe one of them can follow up if none of the suggestions above work.
0
 
garycaseCommented:
"... it doesn't spike when I'm copying from folder to folder on the same drive ..." ==> in this case it's probably not a PIO mode on the disk (do you have multiple disks??)   willcomp's winsock fix may be what you need, since the spiking issue is only associated with network activity; and is apparently not being caused by the incidental disk activity that occurs when using the network.
0
 
lizardqueen007Commented:
I also would repair the winsock since it's easy and has never caused problems:
http://www.majorgeeks.com/download4372.html

Also, did you say what kind of resident antispyware and antivirus programs you have running?
Some of these, especially if you have more than one, can cause things to bog down, use too much cpu resources.
I have found Norton is often the culprit.
If you've used spybot search and destroy and hijack this without results, I would fix the winsock and then if that does not remedy the problem.  Uninstall your resident scanners.   I have found that some resident scanners still slow things down even when seemingly disabled.
LW
0
 
willcompCommented:
Good point from lizardqueen re resident software.

May want to disable all startup items using msconfig and see if that helps.
0
 
lizardqueen007Commented:
Also, try downloading process explore from sysinternals to see what application is using the process.

http://www.sysinternals.com/Utilities/ProcessExplorer.html

If it turns out that the process belongs to an application that you really need, you could try reinstalling the app.

0
 
Odyssey122Author Commented:
nothing has worked so far guys...I'm begining to think I don't have any other choice but to format....prolly gonna do it this weekend....wish I knew what did it though...oh well...

lizardqueen007 - please read my first post where I say "I have downloaded Proccess Explorer and the thread that is utilizing all the cpu is "Shlwapi.dll".  I have looked it up and it isn't showing as spyware...I see 3 or 4 of them...but only one of them is spiking my CPU when I download or copy things across my network."  Thanks though...
0
 
garycaseCommented:
Does your Shlwapi.dll version number (right-click, Properties on the file) match the version of Internet Explorer you're using?   This component is "tied" to IE and must match to work properly.

... and do you have the same issue if you use a different browser?  (e.g. Firefox)
0
 
lizardqueen007Commented:
Ok Odyssey122,
but which application is using the process????  If you find the answer to this than you have some idea what to do.
0
 
Odyssey122Author Commented:
garycase - I understand it's tired to IE...so I upgraded to IE7...still no luck...I have tired repairing IE as well...no luck...remember it also does it when I open two explorer windows...one being a network share and one being my physical drive...copying files across the network or downloading from a p2p program spikes the cpu.

lizardqueen007 - The process that is spiking the CPU is Explorer.exe...the thread that is spiking explorer.exe is "Shlwapi.dll".  It's not any certain application that is spiking it...it's anytime there is a large load on the network...wether it be downloading or copying from physical drive to network share....thanks for reading all my posts...I have explained this already...
0
 
willcompCommented:
Explorer.exe is used for essentially all file handling and shlwapi.dll is a mini shell that covers a lot of territory itself.

Since there were no problems copying folder to folder (which would use same processes), it still seems likely that the culprit is network related.  A clean install of XP may very well be required to cure problem.
0
 
Odyssey122Author Commented:
yeah, that's what I was gonna do this weekend...just back up everything and reinstall xp...gonna leave this open until then though....just in case it's still not fixed for some odd reason....if it does fix it I'm gonna split points between willcomp and garycase evenly.
0
 
garycaseCommented:
Backing everything up before doing the reinstall is, of course, absolutely what you should do.  However, AFTER you've done that, you may be able to just do a "Repair" installation -- which will install XP without causing you to lose all of your data and programs.  Follow the detailed instructions here:  http://www.michaelstevenstech.com/XPrepairinstall.htm

Note:  If your XP CD is not the same service pack level as your current installation (i.e. not SP2) you will need to create a "slipstreamed" CD before doing this.  There are several ways to do this -- here's a link to one of them:  http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.html
0
 
willcompCommented:
In this case, I'm afraid that problem will continue after repair install due to settings retained (registry and network configuration).  That said; a repair install is still worth a try since it may work, is far less painful than a clean install, and should only take about 30 minutes or so.
0
 
garycaseCommented:
... willcomp may very well be correct about that => just depends on exactly what's wrong.   But (especially if you already have an SP2 CD --> and even if not you may want to go ahead and create a slipstreamed one) a quick try would quite possibly save a lot of reload time if it does the trick.
0
 
willcompCommented:
Gary, that's basically what I said -> it's worth a shot.  Just don't want to raise hopes too high on this one.  I'll reiterate that it is critical to have same or later SP as that installed (I always use XP SP2 since it will upgrade an earlier version to SP2 during repair install).  Also need same XP type, e.g. OEM, retail, or VL.
0
 
Odyssey122Author Commented:
Thank you everyone for your help.  I ended up having to wipe the computer and start from a clean slate.  It's now working great..

I have awarded points to will and gary...thank you guys...
0
 
willcompCommented:
You're welcome.  Glad it's resolved.  A clean install cures many ills.
0

Featured Post

[Video] Oticon Case Study

Open office environments can create the dynamics for innovation, but they also bring some challenges. With over 1,000 employees in an open office, Oticon needed a solution that would preserve the environment while mitigating disruptive background noises.

Watch how they did it.

  • 11
  • 10
  • 6
  • +4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now