Solved

High CPU when downloading?

Posted on 2006-06-12
34
453 Views
Last Modified: 2010-04-26
Only recently, my computer has started to have a high a CPU usage whenever I am downloading stuff, be it from IE or from copying files across my network. By having high CPU usage, the music I am playing while downloading from winamp or windows media player would skip, keyboard input would lag and skip too. All this only happens when I am downloading, I am still able to play games, or run several program at the same time without lagging.  When I download though my "Explorer.exe" is at 99%...

I have downloaded Proccess Explorer and the thread that is utilizing all the cpu is "Shlwapi.dll".  I have looked it up and it isn't showing as spyware...I see 3 or 4 of them...but only one of them is spiking my CPU when I download or copy things across my network.  I have looked for hours and hour on the internet and have tried many things.  One is deleting my pagefile cause it seems the Kernel is using all of the CPU.  This did not work...I have tried disabling certain registry keys I have found that have helped others with similair spiking issues.  I just haven't found anyone that has my exact probelm that has been solved.  Could this be my hardware going out or a simple fix I can do?

Please help!

- Ody
0
Comment
Question by:Odyssey122
  • 11
  • 10
  • 6
  • +4
34 Comments
 
LVL 32

Expert Comment

by:willcomp
ID: 16887252
Although a process or service is not associated with malware per se, that doesn't mean that malware is not using a legitimate process or service for nefarious purposes.

I recommend that you do a good adware/spyware scan with Spybot S&D, AdAware SE, and/or other good removal programs of your choosing.  Also, a virus scan is in order if not already done.

Hijack This will also aid in identifying malware and allow it to be stopped in many cases.

What about firewall software?  Have you tried disabling firewall to see if that makes a difference?
0
 
LVL 69

Expert Comment

by:Callandor
ID: 16887291
Are you running WinXP?  Perhaps your IE was corrupted and needs to be repaired: http://support.microsoft.com/?kbid=318378  It's not a hardware problem, given that it only occurs on downloads.
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16887423
willcomp - I have done all that and more...my xp firewall is disabled and I have no other firewalls...I have also tried many other nic cards to rule out driver issues...this has done nothing for me...I have norton corporate edtion on my computer with updated definitions as well..

Callandor - I am running Windows XP.  I have thought about that, but I have also mentioned in my post that it also happens when just copying files across my network.  Not using IE of course, using Explorer.  Now I know IE and Explorer are closely related, but I don't see how this would occur when it was working perfectly before.  So updating it I don't see the point in that.

I have also ruled out my router to see if I was getting packet loss or latency from it.  I have hooked up two computer to a 10mbps hub and tried copying files between the two computers.  It also does it then, ruling out my router as the problem.  I have also traded out network cables to rule out a bad network cable.  It's driving me bonkers and leading me to believe it's I/O problems with possibly my hard drive or my motherboard.

Ugghh...can anyone verify this for me before I reinstall to see if it's software, before I go out and buy a new hard drive and motherboard?
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16887525
By "done all that and more," assume you have checked for adware/spyware with Spybot et al and ahve used Hijack This.  Norton is poor at best in identifying and removing adware/spyware.

Have you checked winsock LSPs for a problem?
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16887553
yes you assumed correclty...i have used ewido, spybot, hijackthis, adaware, cwshredder, housecall and panda antivirus several times...

winsock LSP's?  what's that?
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16887651
Layered Service Providers in Windows Sockets.  You can check by running Spybot in advanced mode and selecting tools.  A rouge or corrupt LSP in winsock can cause problems.

Since all traffic is controlled by TCP/IP utilizing winsock, it's worth a shot resetting winsock.  There's a little utility that will do it for you (winsockfix).  Will have to reconfigure TCP/IP settings for network unless you are using DHCP.

http://www.tacktech.com/display.cfm?ttid=257
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16887736
hmmm, never thought of that...can I ask a stupid question though...wouldn't of switching out 3 different brand network cards bypass this as being a possible culprit?
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16887840
No.  That would have no effect on winsock.

Do you have same behavior when PC is connected to Internet and disconnected from internal network or when other PC is off?
0
 
LVL 69

Expert Comment

by:Callandor
ID: 16887959
You may have a damaged or loose hard drive cable, so swap it out.  It's not likely, since you would be experiencing other problems accessing the hard drive, but it's an easy fix to try.
0
 
LVL 11

Expert Comment

by:knoxzoo
ID: 16888037
Try reinstalling the drivers for your network card.  If the network card is flaky, it can cause damaged packets.  Damaged packets result in massively increased demands on the CPU.  Since you have multiple instances of the packet monitoring dll loading, that would be my first guess.  If reinstalling the drivers doesn't do it, try a different card.  Also, reboot your modem, just in case.
0
 
LVL 70

Expert Comment

by:garycase
ID: 16888440
"... when I download or copy things across my network ..." ==> in other words, whenever you're writing to or reading from one of your disks.   This MAY simply be a case where your disk has reverted to PIO access.   If so, this will fix it  (this is a harmless registry edit -- the deleted values will be reset by Windows at next boot):

Load RegEdit (Start - Run - Regedit)

Go to the following keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\000x

The last four digits will be 0000, 0001, 0002, 0003, and so on.

Under each key, delete all occurences of the following values:

     MasterIdDataChecksum
     SlaveIdDataChecksum

Now reboot your system and see if the problem disappears.

You can check this in advance if you want by going to Device Manager; expanding your IDE/ATAPI controller line; and, for each IDE channel (Primary & Secondary) do a right-click, Properties, and look on the Advanced tab to see what the "Transfer Mode" is set to (should ALL be "DMA if available"), and what the "Current Transfer Mode" is (you can't change that in Device Manager -- that's what the above registry mod will force Windows to detect).
0
 
LVL 6

Expert Comment

by:Booda2us
ID: 16888629
This also may be a symptom of you're 'index.dat' files growing so large that they're choking your CPU by causing data transfers from memory to hdd. They usually can only be deleted in DOS mode or by a 3rd party application. One such application is called Mil Shield, which isn't free and is available at:
http://www.milincorporated.com/a_indexdat.html
at that site you can find instruction and education about and how to delete index.dat files manually also.
I hope this helps you out...Booda2us
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16888648
willcomp - thank you for the response...it seems to happen on internet and off internet as I explained I have disconnected it from my router and just hooked it and another computer straight to a hub.  Not internet acess and set up dynamic ip's so I could make a file transfer, this as well showed high cpu in the same way.

Callandor - This is very good assumption, I have not tried this and if I recall I have rebooted a couple times and the hard drive was not found by the BIOS...I hate SATA now if this is the case...cause the connection to the board is so easily accessible to be wiggled out or just loose.

knoxzoo - I thank you for your response, but as I have stated I have changed out several different brands of network cards, cause I too thought it may be a driver issue, I have also tried updating all drivers per those cards with no change in problem.  I have also rebooted modem and router several times, but like I say this happens off the router and the modem as well.

garycase - I will try this tonight, I think you are right, I think something is wrong with my I/O somehow...wether it be cable, board, or hard drive...i will try these registry settings tonight and see what happens...
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16888669
Booda2us - I have read about that, and have thought about doing that...I will try that tonight as well and see if that is causing the problem.  I have noticed that it is mostly "Kernel" utilization that is spiking it to 100% which led me to believe a bad pagefile.  This was not the case though.  Thank you...
0
 
LVL 70

Expert Comment

by:garycase
ID: 16888717
... if you've noticed spiking CPU with other I/O that's almost certainly what's happened.  I'd try the registry mods before bothering to open up the case ==> if that's the issue you'll be done :-)
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16888801
The dll in question handles a number of functions including handling UNC and URL.  Also take a look at your hosts file and remove any extraneous entries.

What happens when you copy files from folder to folder on local hard disk?  If it's a drive problem, should show up there also.
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16888877
garycase - Yeah if it is I'll kiss ya dude...I'll keep you posted, I get off work in 3 hours...I'll go straight home and do all these awesome suggestions...I thank you...

willcomp - nah, it doesn't spike when I'm copying from folder to folder on the same drive...seems to only do it when I download from the internet, be it from torrents, p2p, IE or network transfer is when it does it.  I will check hosts file when I get home tonight...thank you for your help...
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 32

Expert Comment

by:willcomp
ID: 16888989
As you may have noted, common bond seems to be network transmissions using TCP/IP protocol.  That's why I've been trying to delve into settings that effect TCP/IP transmission.  However, there are folks around that know much more about TCP/IP than I do.  Maybe one of them can follow up if none of the suggestions above work.
0
 
LVL 70

Expert Comment

by:garycase
ID: 16890142
"... it doesn't spike when I'm copying from folder to folder on the same drive ..." ==> in this case it's probably not a PIO mode on the disk (do you have multiple disks??)   willcomp's winsock fix may be what you need, since the spiking issue is only associated with network activity; and is apparently not being caused by the incidental disk activity that occurs when using the network.
0
 
LVL 1

Expert Comment

by:lizardqueen007
ID: 16890254
I also would repair the winsock since it's easy and has never caused problems:
http://www.majorgeeks.com/download4372.html

Also, did you say what kind of resident antispyware and antivirus programs you have running?
Some of these, especially if you have more than one, can cause things to bog down, use too much cpu resources.
I have found Norton is often the culprit.
If you've used spybot search and destroy and hijack this without results, I would fix the winsock and then if that does not remedy the problem.  Uninstall your resident scanners.   I have found that some resident scanners still slow things down even when seemingly disabled.
LW
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16890300
Good point from lizardqueen re resident software.

May want to disable all startup items using msconfig and see if that helps.
0
 
LVL 1

Expert Comment

by:lizardqueen007
ID: 16900669
Also, try downloading process explore from sysinternals to see what application is using the process.

http://www.sysinternals.com/Utilities/ProcessExplorer.html

If it turns out that the process belongs to an application that you really need, you could try reinstalling the app.

0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16903171
nothing has worked so far guys...I'm begining to think I don't have any other choice but to format....prolly gonna do it this weekend....wish I knew what did it though...oh well...

lizardqueen007 - please read my first post where I say "I have downloaded Proccess Explorer and the thread that is utilizing all the cpu is "Shlwapi.dll".  I have looked it up and it isn't showing as spyware...I see 3 or 4 of them...but only one of them is spiking my CPU when I download or copy things across my network."  Thanks though...
0
 
LVL 70

Expert Comment

by:garycase
ID: 16905168
Does your Shlwapi.dll version number (right-click, Properties on the file) match the version of Internet Explorer you're using?   This component is "tied" to IE and must match to work properly.

... and do you have the same issue if you use a different browser?  (e.g. Firefox)
0
 
LVL 1

Expert Comment

by:lizardqueen007
ID: 16906520
Ok Odyssey122,
but which application is using the process????  If you find the answer to this than you have some idea what to do.
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16907614
garycase - I understand it's tired to IE...so I upgraded to IE7...still no luck...I have tired repairing IE as well...no luck...remember it also does it when I open two explorer windows...one being a network share and one being my physical drive...copying files across the network or downloading from a p2p program spikes the cpu.

lizardqueen007 - The process that is spiking the CPU is Explorer.exe...the thread that is spiking explorer.exe is "Shlwapi.dll".  It's not any certain application that is spiking it...it's anytime there is a large load on the network...wether it be downloading or copying from physical drive to network share....thanks for reading all my posts...I have explained this already...
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16907846
Explorer.exe is used for essentially all file handling and shlwapi.dll is a mini shell that covers a lot of territory itself.

Since there were no problems copying folder to folder (which would use same processes), it still seems likely that the culprit is network related.  A clean install of XP may very well be required to cure problem.
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16912007
yeah, that's what I was gonna do this weekend...just back up everything and reinstall xp...gonna leave this open until then though....just in case it's still not fixed for some odd reason....if it does fix it I'm gonna split points between willcomp and garycase evenly.
0
 
LVL 70

Expert Comment

by:garycase
ID: 16912455
Backing everything up before doing the reinstall is, of course, absolutely what you should do.  However, AFTER you've done that, you may be able to just do a "Repair" installation -- which will install XP without causing you to lose all of your data and programs.  Follow the detailed instructions here:  http://www.michaelstevenstech.com/XPrepairinstall.htm

Note:  If your XP CD is not the same service pack level as your current installation (i.e. not SP2) you will need to create a "slipstreamed" CD before doing this.  There are several ways to do this -- here's a link to one of them:  http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.html
0
 
LVL 32

Accepted Solution

by:
willcomp earned 250 total points
ID: 16912654
In this case, I'm afraid that problem will continue after repair install due to settings retained (registry and network configuration).  That said; a repair install is still worth a try since it may work, is far less painful than a clean install, and should only take about 30 minutes or so.
0
 
LVL 70

Assisted Solution

by:garycase
garycase earned 250 total points
ID: 16912981
... willcomp may very well be correct about that => just depends on exactly what's wrong.   But (especially if you already have an SP2 CD --> and even if not you may want to go ahead and create a slipstreamed one) a quick try would quite possibly save a lot of reload time if it does the trick.
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16913439
Gary, that's basically what I said -> it's worth a shot.  Just don't want to raise hopes too high on this one.  I'll reiterate that it is critical to have same or later SP as that installed (I always use XP SP2 since it will upgrade an earlier version to SP2 during repair install).  Also need same XP type, e.g. OEM, retail, or VL.
0
 
LVL 2

Author Comment

by:Odyssey122
ID: 16945582
Thank you everyone for your help.  I ended up having to wipe the computer and start from a clean slate.  It's now working great..

I have awarded points to will and gary...thank you guys...
0
 
LVL 32

Expert Comment

by:willcomp
ID: 16946442
You're welcome.  Glad it's resolved.  A clean install cures many ills.
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Suggested Solutions

Great sound, comfort and fit, excellent build quality, versatility, compatibility. These are just some of the many reasons for choosing a headset from Sennheiser.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
This tutorial demonstrates a quick way of adding group price to multiple Magento products.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now