Link to home
Start Free TrialLog in
Avatar of Gary Fuqua, CISSP
Gary Fuqua, CISSPFlag for United States of America

asked on

100% CPU utilization when connected to Internet

I am working on a computer with Windows XP Home, SP3 workstation.     I have run msconfig and turn off everything in startup, and uncheck all non-Microsoft services.     The computer runs fine when it is not connected to a network (workgroup)

As soon as the ethernet cable is plugged in and you browse to one or two different sites using IE, the CPU utilization jumps to 100%.    

I am using Sysinternals process explorer to try and figure out what is going on.     It appears that it is services.exe that is hogging all the CPU time.    

Ran AVG, Trend Micro Housecall, Malwarebytes, and Combofix thinking it was virus related.    

I'm not sure what to do next.  

Any suggestions
Avatar of gtworek
gtworek
Flag of Poland image

Try to enter this process details and see what inside consumes CPU.
Do you have network monitor installed? Older version caused such behavior.
Avatar of Gary Fuqua, CISSP

ASKER

It doesn't break it down.    There are several processes in the tree, but no CPU utilization is listed, just the main services.exe is listed at 100%.
Sometimes the Link scanner of your AntiVirus Software creates this. Disable Link Scanner of your Antivirus and check whether it makes any change.
Avatar of johnb6767
Process Explorer for Windows
http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

Double click the offending file. If it is a svchost.exe, then Select the Services Tab. Please list what services are in that svchost.exe.

Then Select the Threads tab, and see what .exe or .dll is using the CPU, and then select it by double clicking it....and copying/pasting the call stack here.....
Can also post screenshots of them, including the entire contents of the Threads tab....
Services.exe is jumping between 98 - 100%
Double cllick on Services.exe:
       
click on Services tab:  
                         Event Log
                         Plug and Play

Click on Threads:

kernel32.dll!CreateThread+0x22 is jumping from 96 to 98 %.    This seems to be the bugger.  

Sorry cant post screen shots.   This computer is unusable on the net at the moment.
Link scanner disabled.   Same problem.  
Go to the Event Viewer, and clear out all your logs... Might have a corrupt one....
 
Start>run>eventvwr.msc. Right click a log, and you can select Delete, and dont save....
I took a few shots in the dark:

netsh winsock reset
netsh int ip reset c:\reset.txt

Now I can browse the net.     Go figure.  

Actually, to determine the exact culprit..... Last few times I have had those two services present, It was the log, and thats the easiest to deal with....
Just disable them one by one. Process of elimination is a piece of cake when you only have two options.....
Make sure you test this after rebooting as well...
Problem is back.     Will try Johnb6767's suggestions next.
Open network conections and display properties of your connection. Can you post here list of bindings? these items with checboxes ;)
gtworek,

Interesting question.      Client for Microsoft networks, File & Printer Sharing for Microsoft networks, QoS Packet Scheduler, Internet Protocol.

While I was in there, I clicked on the Advanced Tab......   Windows cannot display the properties of this connection.   The Windows Management Instrumentation (WMI) information might be corrupted.    To correct this, use System Restore to restore Windows to an earlier time (called a Restore Point).   System Restore is located in the System Tools folder in Accessories.      

What do you think?   Is restoring to an earlier time going to cause data loss in client apps like Quicken?
I unistalled in the Device Manager and then re-added the NIC.    Same error on the Advanced Tab
"Is restoring to an earlier time going to cause data loss in client apps like Quicken?"
No.
Guess disabling each of those services didnt resolve the high cpu usage?
 
Your bindings are typical so probably issue is not located here.

Do you have any uncommon errors in event log? Your information about WMI sounds interesting... Try to dowload and run The WMI Diagnosis Utility from Microsoft website.
Disabling services did not help.      To solve the NIC problem, my choices are system restore or repair install according to Microsoft.  

I don't know how far back to go with the system restore,  so I think I am just going to do a repair install.  
Can you please report what is listed under the THREADS Tab, and also please double click the one using the highest CPU, and copy the WHOLE call stack?
 Should be "kernel32.dll!CreateThread+0x22 " still I would assume.....
Also.....
Repairing and re-registering the WMI
http://windowsxp.mvps.org/repairwmi.htm
 
I don't see anyone having recommended Resetting IE back to clean install status.
Right-click the IE icon on your desktop (or start menu) and choose properties.
Click on the advanced tab and then click Reset and Restore Advanced Settings.
Close and re-open IE and see what happens.
Avatar of karam_al-ali
karam_al-ali

Over the past few weeks one of our PCs started to slow down unexpectedly and utilized high CPU resources while we accessed the Internet. We were quite perplexed as every time we downloaded emails in Outlook, or downloaded files from the Internet the CPU usage would shoot up to 100%

Turned out the problem was due to AVG network scanner, which was making use of DPCs (Deferred Procedure Call) to create high-priority tasks to scan the network, which in turn slowed down the PC by shooting up the CPU resources.


At times you may also see problems while accessing regular websites, where pages may not load and show connection timeouts. 

The next time you are facing a slowdown while using the Internet, you can open task manager to see which process is using the most CPU resources, if you see DPCs taking up most of the resources, you can disable the AVG Network Scanner and then try see if the problem is solved. This may also occur with other Anti-virus software, disabling the Network scanner will fix the issue.
Cant see DPC's in the Task Manager... Need Process Explorer for that.......
ASKER CERTIFIED SOLUTION
Avatar of Gary Fuqua, CISSP
Gary Fuqua, CISSP
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial