100% CPU utilization when connected to Internet

Gary Fuqua, CISSP
Gary Fuqua, CISSP used Ask the Experts™
on
I am working on a computer with Windows XP Home, SP3 workstation.     I have run msconfig and turn off everything in startup, and uncheck all non-Microsoft services.     The computer runs fine when it is not connected to a network (workgroup)

As soon as the ethernet cable is plugged in and you browse to one or two different sites using IE, the CPU utilization jumps to 100%.    

I am using Sysinternals process explorer to try and figure out what is going on.     It appears that it is services.exe that is hogging all the CPU time.    

Ran AVG, Trend Micro Housecall, Malwarebytes, and Combofix thinking it was virus related.    

I'm not sure what to do next.  

Any suggestions
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®

Commented:
Try to enter this process details and see what inside consumes CPU.
Do you have network monitor installed? Older version caused such behavior.

Author

Commented:
It doesn't break it down.    There are several processes in the tree, but no CPU utilization is listed, just the main services.exe is listed at 100%.
Sometimes the Link scanner of your AntiVirus Software creates this. Disable Link Scanner of your Antivirus and check whether it makes any change.
11/26 Forrester Webinar: Savings for Enterprise

How can your organization benefit from savings just by replacing your legacy backup solutions with Acronis' #CyberProtection? Join Forrester's Joe Branca and Ryan Davis from Acronis live as they explain how you can too.

Most Valuable Expert 2011
Top Expert 2011

Commented:
Process Explorer for Windows
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

Double click the offending file. If it is a svchost.exe, then Select the Services Tab. Please list what services are in that svchost.exe.

Then Select the Threads tab, and see what .exe or .dll is using the CPU, and then select it by double clicking it....and copying/pasting the call stack here.....
Most Valuable Expert 2011
Top Expert 2011

Commented:
Can also post screenshots of them, including the entire contents of the Threads tab....

Author

Commented:
Services.exe is jumping between 98 - 100%
Double cllick on Services.exe:
       
click on Services tab:  
                         Event Log
                         Plug and Play

Click on Threads:

kernel32.dll!CreateThread+0x22 is jumping from 96 to 98 %.    This seems to be the bugger.  

Author

Commented:
Sorry cant post screen shots.   This computer is unusable on the net at the moment.

Author

Commented:
Link scanner disabled.   Same problem.  
Most Valuable Expert 2011
Top Expert 2011

Commented:
Go to the Event Viewer, and clear out all your logs... Might have a corrupt one....
 
Start>run>eventvwr.msc. Right click a log, and you can select Delete, and dont save....

Author

Commented:
I took a few shots in the dark:

netsh winsock reset
netsh int ip reset c:\reset.txt

Now I can browse the net.     Go figure.  

Most Valuable Expert 2011
Top Expert 2011

Commented:
Actually, to determine the exact culprit..... Last few times I have had those two services present, It was the log, and thats the easiest to deal with....
Just disable them one by one. Process of elimination is a piece of cake when you only have two options.....
Most Valuable Expert 2011
Top Expert 2011

Commented:
Make sure you test this after rebooting as well...

Author

Commented:
Problem is back.     Will try Johnb6767's suggestions next.

Commented:
Open network conections and display properties of your connection. Can you post here list of bindings? these items with checboxes ;)

Author

Commented:
gtworek,

Interesting question.      Client for Microsoft networks, File & Printer Sharing for Microsoft networks, QoS Packet Scheduler, Internet Protocol.

While I was in there, I clicked on the Advanced Tab......   Windows cannot display the properties of this connection.   The Windows Management Instrumentation (WMI) information might be corrupted.    To correct this, use System Restore to restore Windows to an earlier time (called a Restore Point).   System Restore is located in the System Tools folder in Accessories.      

What do you think?   Is restoring to an earlier time going to cause data loss in client apps like Quicken?

Author

Commented:
I unistalled in the Device Manager and then re-added the NIC.    Same error on the Advanced Tab
Most Valuable Expert 2011
Top Expert 2011

Commented:
"Is restoring to an earlier time going to cause data loss in client apps like Quicken?"
No.
Guess disabling each of those services didnt resolve the high cpu usage?
 

Commented:
Your bindings are typical so probably issue is not located here.

Do you have any uncommon errors in event log? Your information about WMI sounds interesting... Try to dowload and run The WMI Diagnosis Utility from Microsoft website.

Author

Commented:
Disabling services did not help.      To solve the NIC problem, my choices are system restore or repair install according to Microsoft.  

I don't know how far back to go with the system restore,  so I think I am just going to do a repair install.  
Most Valuable Expert 2011
Top Expert 2011

Commented:
Can you please report what is listed under the THREADS Tab, and also please double click the one using the highest CPU, and copy the WHOLE call stack?
 Should be "kernel32.dll!CreateThread+0x22 " still I would assume.....
Also.....
Repairing and re-registering the WMI
http://windowsxp.mvps.org/repairwmi.htm
 
Alan HardistyCo-Owner
Top Expert 2011

Commented:
I don't see anyone having recommended Resetting IE back to clean install status.
Right-click the IE icon on your desktop (or start menu) and choose properties.
Click on the advanced tab and then click Reset and Restore Advanced Settings.
Close and re-open IE and see what happens.
Over the past few weeks one of our PCs started to slow down unexpectedly and utilized high CPU resources while we accessed the Internet. We were quite perplexed as every time we downloaded emails in Outlook, or downloaded files from the Internet the CPU usage would shoot up to 100%

Turned out the problem was due to AVG network scanner, which was making use of DPCs (Deferred Procedure Call) to create high-priority tasks to scan the network, which in turn slowed down the PC by shooting up the CPU resources.


At times you may also see problems while accessing regular websites, where pages may not load and show connection timeouts. 

The next time you are facing a slowdown while using the Internet, you can open task manager to see which process is using the most CPU resources, if you see DPCs taking up most of the resources, you can disable the AVG Network Scanner and then try see if the problem is solved. This may also occur with other Anti-virus software, disabling the Network scanner will fix the issue.
Most Valuable Expert 2011
Top Expert 2011

Commented:
Cant see DPC's in the Task Manager... Need Process Explorer for that.......
Thanks for all the great suggestions.    The repair install seems to have fixed the problem.  

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial