Link to home
Start Free TrialLog in
Avatar of Tigasurf
TigasurfFlag for United Kingdom of Great Britain and Northern Ireland

asked on

My windows XP machine is running at 100% CPU all the time

Ive tried installing AVG and Avast to check for viruses but oddly they wont install, ie no shortcut.
Its a Dell D630 laptop on XP SP3
Avatar of Seth Simmons
Seth Simmons
Flag of United States of America image

have you looked at task manager as to what is using high cpu?
None of the current Antivirus products will install on XP.  XP has no longer supported by anyone for several years now.  Your Dell D630 is far too old.  You'll have to find an old Antivirus that's XP capable, and even then, you may not be able to get current virus signatures.

You may want to try task manager and see what's taking up the CPU.  It's possible that it's just such an old laptop that browsers are eating up that CPU.  You might try installing adblockers and script blockers in your browser so that you don't have ads eating up your resources.


If you look in Task Manager you should be able to see what application is using up the CPU.  If you click on the header labeled CPU, it should sort by CPU utilization.  If it sorts with the lowest at the top, click on the header again.

Once we know what is using up the CPU we can advise how to deal with it.

Did you install both AVG and Avast?  That could be a problem.

Avatar of Tigasurf

ASKER

Thanks , that saved me pulling my hair out.
I found a alternative program called Total AV and it ran.
I hacked away at old programs I dont use and cleared out some files 
but no change to the 100% though.
Ill see if I can screenshot the Task Manager
sort by cpu and look at the top of the column; the process causing high cpu will be at the top
Im just removing AVG and Avast.
Some background info :- 
I realise its an old machine but the Dos based software Im running wont work on Windows 7 or newer.
This is basically all I use it for.
User generated image
unfortunately it is about 18 yrs old...
so the system shows the top 2 items consuming your CPU
you can rt click and kill them
that solves your immediate issue
#2
have you tried running windows 7 in XP Mode
we have several articles onsite about that...
#3
additionally - for AV - you can always look at some old shareware/freeware sites for older versions
....majorgeek comes to mind - they have an AV tab with old stuff


Have you cleaned out the XP computer internally? Sometimes dust accumulation or clumps of dust can certainly build up inside and cleaning that out could potentially help the system overall. 
Is that machine currently connected to the Internet? If so, disconnect it. That may get the CPU to calm down enough for you to try scanning some things on it. Like everyone has said, XP is way outdated. In fact, I wouldn't even allow an Internet connection on it unless absolutely necessary.

I would strongly recommend you download Malwarebytes for XP and let it run a full scan on there. That spiking svchost could be anything, as many malware disguise themselves as that process, especially on XP.
Download - https://support.malwarebytes.com/hc/en-us/articles/360039024213-Download-and-install-Malwarebytes-for-Windows-v3
Thanks , I will investigate those suggestions tomorrow.
New day , new energy. :-)
Also, give the age of the PC, open the case and visually inspect the motherboard. Could be you've got some blown capacitors and that can cause all kinds of weird problems.
you can rt click and kill them
task manager cannot kill lsass (local security authority) and possibly not svchost depending on what service it is associated with

have a look at the event logs also

Avatar of ☠ MASQ ☠
☠ MASQ ☠

You could also boot to an offline AV scanner like
https://support.kaspersky.com/viruses/krd18

Which does contain all the latest virus definitions and, because it doesn't have to run in XP is unaffected by the fact you've an outdated operating system.

Create a bootable USB or CD/DVD from the image and then boot to it rather than your hard drive.
Running 2 AV's can all by itself cause you to run at 100% because they are continuously cross checking each other.  Never run more than 1 AV.
Or take the hard disk out, place it in a USB caddy and attach it to another machine and let that machine virus scan it.

Also investigate VDOS  https://www.vdos.info/  for running your DOS application under modern Windows.
lsass is supposed to be the local security authority subsystem service
svchost is the service host

If these are legitimate Windows services, they can't be killed.  There are some viruses that masquerade as these and some of these can be killed.  So, try ending the tasks and if you can kill it, then it's possibly a virus.  However, any number of services can trigger these.   You probably want to get psinfo from sysinternals to see exactly which executable is running. https://docs.microsoft.com/en-us/sysinternals/downloads/psinfo


Download a copy of Microsoft Process Monitor and have a closer look at the process tree for the offending processes.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Hovering over the process will give an idea of what children it has spawned.  Regrettably under XP svchost handles all the services, but it will at least narrow things down somewhat.

User generated image
Look at the services enabled in services.msc, and disable those you do not use.  If you're lucky it'll be one of those.  If Windows Networking is not in use, for example, both the Server and Workstation can be disabled.

Side note:  Firefox under XP will eat the system alive and only make the situation worse.  I finally had to get away from XP last week because Firefox was occupying 1.5 GB of memory and completely tying up one CPU.
User generated image
Morning all.

I pulled the network cable and it was still 100 % cpu without connection to the internet.
I tried to kill lsass.exe in task manager - says its a critical system process
I did manage to kill svchost.exe though and the pc then timed itself down to a shutdown.
I ran process explorer , see above
I dont have firefox installed

Cheers
Well, you can certainly turn off the Windows Update service.  There will never be another update for XP.

Since Process Explorer is certainly not prolix on XP regarding what service is eating the system, I'm afraid that you will need to run services.msc, disable those which are definitely unnecessary, reboot, look at which remain, and disable - reboot - look at the system again for the remaining services which can be disabled, one at a time.

My guess is that you will eventually to find that the problem is somehow related to networking.

Suggestion:  If you are not using Microsoft Networking (no shared files, no shared printers, the system is not a member of a domain -- and this should be the case, because SMB v1 is obsolete and dangerous), go to the network interface page and disable Microsoft Networking.  And since you have an antirvirus installed, also confirm that the Windows Firewall is disabled.

It may also be suggestive if you show us the bottom half of the Process Explorer window.

Side note:  I see a fair number of things in that system which I would disable, but none of them should be directly related to the problem at hand.
Dr Klahn

Where is the network interface page ?

Chris
well atleast we confirmed they are legit services - i was thinking they might have been malware....

and you have confirmed ity those 2 that are sucking up your CPU

Tiga

can you select svchost and see what exactly is running - it so generic - its hard to know what it is
Darin

"can you select svchost and see what exactly is running "

Sure , how do I do that ?
ASKER CERTIFIED SOLUTION
Avatar of Dr. Klahn
Dr. Klahn

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Ive turned off windows updates.
Bottom half of process explorer window....
User generated image
Ai yi yi.  How much memory is installed in this system?  And how many cores in the CPU (real cores, not hyperthreaded pseudo-cores)?
HI

I turned off

Client for Microsoft networks
Virtual Machine Network Services
File and Printer sharing for Microsot Networks

Rebooted and the CPU was OK for a bit
Then it went back up

And weirdly all 3 were checked back on again

Think were onto something here but have to go for now, will look at this evening
Download a copy of Microsoft TCP View and see what the system's up to as far as network connections and activity.

https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
you can also see the memory usage in Task Manager
Hi

I ran TCP View , it keep falling over but I managed to get this screenshot before it crashed
Then it did this

User generated image

TCP Viewer results below

User generated image
User generated image
You were asking about the processor and RAM

User generated image 

Yes, bnit specific  RAM Usage
post a screenshot of task manager > Performance -  also, showing ram usage
User generated image
"I realise its an old machine but the Dos based software Im running wont work on Windows 7 or newer.
This is basically all I use it for. "

A DOS program should be simple to install (just copy the appropriate folders).  If you have any extra drives around, I'd consider starting over.  Reinstall XP and the program.

Do you need network access with your DOS program?  If not, why not just set up the computer with DOS and your application and no networking?
Well, the system is as full of memory as it can get (3.25 GB is the limit for XP systems) so that's a dead-end.  I would have to say that a dual-core laptop is not the ideal platform for a system with this much going on.

I am quite sure that there is more going on vis-a-vis network activity in that system than the TCP View screenshot shows.  TCP View is apparently having some kind of problem which is confirmed by it crashing.

Download a copy of Microsoft Autoruns and see what is being loaded into the system at boot time.  Deo volens there are some things that can turned off.  Look in particular at the Login tab.

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

It is undeniably a tedious and lengthy approach to go at this problem from the "eliminate what it is not" approach, but if it's good enough for Sherlock Holmes ...
to me  it looks that the cpu is nearly at 0% use, then spikes up above 80% and more; can you link any app that does that?
i would reboot the system, and reopen this page, then start running the apps 1 by 1 to check what causes the spike
RAM looks ok : 4 gb installed, and more than 2 available
Thanks
I think Ive solved it by unchecking virtual machine network services in the network connection properties.
CPU running around 40% now.
Happy Days
OK.  Do note that any virtual machines on the system will be unable to use networking when that feature is disabled.
Thanks Dr Klahn.

Useful to know , luckily not a problem.
You were on the right track with the network activity, but also thanks to everyone,
some really helpful comments from all.