We help IT Professionals succeed at work.

Check out this week's podcast, "Dairy Farms to Databases: Community's Hand in Technology"Listen Now

x
Troubleshooting Question

My windows XP machine is running at 100% CPU all the time

105 Views
Last Modified: 2020-09-25
Ive tried installing AVG and Avast to check for viruses but oddly they wont install, ie no shortcut.
Its a Dell D630 laptop on XP SP3
Comment
Watch Question

Seth SimmonsLead Systems Administrator
CERTIFIED EXPERT

Commented:
have you looked at task manager as to what is using high cpu?
CERTIFIED EXPERT

Commented:
None of the current Antivirus products will install on XP.  XP has no longer supported by anyone for several years now.  Your Dell D630 is far too old.  You'll have to find an old Antivirus that's XP capable, and even then, you may not be able to get current virus signatures.

You may want to try task manager and see what's taking up the CPU.  It's possible that it's just such an old laptop that browsers are eating up that CPU.  You might try installing adblockers and script blockers in your browser so that you don't have ads eating up your resources.


CERTIFIED EXPERT

Commented:
If you look in Task Manager you should be able to see what application is using up the CPU.  If you click on the header labeled CPU, it should sort by CPU utilization.  If it sorts with the lowest at the top, click on the header again.

Once we know what is using up the CPU we can advise how to deal with it.

Did you install both AVG and Avast?  That could be a problem.

Author

Commented:
Thanks , that saved me pulling my hair out.
I found a alternative program called Total AV and it ran.
I hacked away at old programs I dont use and cleared out some files 
but no change to the 100% though.
Ill see if I can screenshot the Task Manager
Seth SimmonsLead Systems Administrator
CERTIFIED EXPERT

Commented:
sort by cpu and look at the top of the column; the process causing high cpu will be at the top

Author

Commented:
Im just removing AVG and Avast.
Some background info :- 
I realise its an old machine but the Dos based software Im running wont work on Windows 7 or newer.
This is basically all I use it for.

Author

Commented:

DarinTCHSenior CyberSecurity Engineer
CERTIFIED EXPERT

Commented:
unfortunately it is about 18 yrs old...
so the system shows the top 2 items consuming your CPU
you can rt click and kill them
that solves your immediate issue
#2
have you tried running windows 7 in XP Mode
we have several articles onsite about that...
#3
additionally - for AV - you can always look at some old shareware/freeware sites for older versions
....majorgeek comes to mind - they have an AV tab with old stuff


Jazz KaurTechnical Support Specialist
CERTIFIED EXPERT

Commented:
Have you cleaned out the XP computer internally? Sometimes dust accumulation or clumps of dust can certainly build up inside and cleaning that out could potentially help the system overall. 
William FulksIT Services Analyst
CERTIFIED EXPERT

Commented:
Is that machine currently connected to the Internet? If so, disconnect it. That may get the CPU to calm down enough for you to try scanning some things on it. Like everyone has said, XP is way outdated. In fact, I wouldn't even allow an Internet connection on it unless absolutely necessary.

I would strongly recommend you download Malwarebytes for XP and let it run a full scan on there. That spiking svchost could be anything, as many malware disguise themselves as that process, especially on XP.
Download - https://support.malwarebytes.com/hc/en-us/articles/360039024213-Download-and-install-Malwarebytes-for-Windows-v3

Author

Commented:
Thanks , I will investigate those suggestions tomorrow.
New day , new energy. :-)
William FulksIT Services Analyst
CERTIFIED EXPERT

Commented:
Also, give the age of the PC, open the case and visually inspect the motherboard. Could be you've got some blown capacitors and that can cause all kinds of weird problems.
Seth SimmonsLead Systems Administrator
CERTIFIED EXPERT

Commented:
you can rt click and kill them
task manager cannot kill lsass (local security authority) and possibly not svchost depending on what service it is associated with

have a look at the event logs also

CERTIFIED EXPERT
Most Valuable Expert 2013

Commented:
You could also boot to an offline AV scanner like
https://support.kaspersky.com/viruses/krd18

Which does contain all the latest virus definitions and, because it doesn't have to run in XP is unaffected by the fact you've an outdated operating system.

Create a bootable USB or CD/DVD from the image and then boot to it rather than your hard drive.
Dave BaldwinFixer of Problems
CERTIFIED EXPERT
Most Valuable Expert 2014

Commented:
Running 2 AV's can all by itself cause you to run at 100% because they are continuously cross checking each other.  Never run more than 1 AV.
dbruntonQuid, Me Anxius Sum?  Illegitimi non carborundum.
CERTIFIED EXPERT

Commented:
Or take the hard disk out, place it in a USB caddy and attach it to another machine and let that machine virus scan it.

Also investigate VDOS  https://www.vdos.info/  for running your DOS application under modern Windows.
CERTIFIED EXPERT

Commented:
lsass is supposed to be the local security authority subsystem service
svchost is the service host

If these are legitimate Windows services, they can't be killed.  There are some viruses that masquerade as these and some of these can be killed.  So, try ending the tasks and if you can kill it, then it's possibly a virus.  However, any number of services can trigger these.   You probably want to get psinfo from sysinternals to see exactly which executable is running. https://docs.microsoft.com/en-us/sysinternals/downloads/psinfo


Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
Download a copy of Microsoft Process Monitor and have a closer look at the process tree for the offending processes.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

Hovering over the process will give an idea of what children it has spawned.  Regrettably under XP svchost handles all the services, but it will at least narrow things down somewhat.

new-1.PNG
Look at the services enabled in services.msc, and disable those you do not use.  If you're lucky it'll be one of those.  If Windows Networking is not in use, for example, both the Server and Workstation can be disabled.

Side note:  Firefox under XP will eat the system alive and only make the situation worse.  I finally had to get away from XP last week because Firefox was occupying 1.5 GB of memory and completely tying up one CPU.

Author

Commented:

Author

Commented:
Morning all.

I pulled the network cable and it was still 100 % cpu without connection to the internet.
I tried to kill lsass.exe in task manager - says its a critical system process
I did manage to kill svchost.exe though and the pc then timed itself down to a shutdown.
I ran process explorer , see above
I dont have firefox installed

Cheers
Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
Well, you can certainly turn off the Windows Update service.  There will never be another update for XP.

Since Process Explorer is certainly not prolix on XP regarding what service is eating the system, I'm afraid that you will need to run services.msc, disable those which are definitely unnecessary, reboot, look at which remain, and disable - reboot - look at the system again for the remaining services which can be disabled, one at a time.

My guess is that you will eventually to find that the problem is somehow related to networking.

Suggestion:  If you are not using Microsoft Networking (no shared files, no shared printers, the system is not a member of a domain -- and this should be the case, because SMB v1 is obsolete and dangerous), go to the network interface page and disable Microsoft Networking.  And since you have an antirvirus installed, also confirm that the Windows Firewall is disabled.

It may also be suggestive if you show us the bottom half of the Process Explorer window.

Side note:  I see a fair number of things in that system which I would disable, but none of them should be directly related to the problem at hand.

Author

Commented:
Dr Klahn

Where is the network interface page ?

Chris
DarinTCHSenior CyberSecurity Engineer
CERTIFIED EXPERT

Commented:
well atleast we confirmed they are legit services - i was thinking they might have been malware....

and you have confirmed ity those 2 that are sucking up your CPU

Tiga

can you select svchost and see what exactly is running - it so generic - its hard to know what it is

Author

Commented:
Darin

"can you select svchost and see what exactly is running "

Sure , how do I do that ?
Principal Software Engineer
CERTIFIED EXPERT
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
Ive turned off windows updates.
Bottom half of process explorer window....

Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
Ai yi yi.  How much memory is installed in this system?  And how many cores in the CPU (real cores, not hyperthreaded pseudo-cores)?

Author

Commented:
HI

I turned off

Client for Microsoft networks
Virtual Machine Network Services
File and Printer sharing for Microsot Networks

Rebooted and the CPU was OK for a bit
Then it went back up

And weirdly all 3 were checked back on again

Think were onto something here but have to go for now, will look at this evening
Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
Download a copy of Microsoft TCP View and see what the system's up to as far as network connections and activity.

https://docs.microsoft.com/en-us/sysinternals/downloads/tcpview
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
you can also see the memory usage in Task Manager

Author

Commented:
Hi

I ran TCP View , it keep falling over but I managed to get this screenshot before it crashed
Then it did this



Author

Commented:
TCP Viewer results below


Author

Commented:

Author

Commented:
You were asking about the processor and RAM

 

CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Yes, bnit specific  RAM Usage
post a screenshot of task manager > Performance -  also, showing ram usage

Author

Commented:

CERTIFIED EXPERT

Commented:
"I realise its an old machine but the Dos based software Im running wont work on Windows 7 or newer.
This is basically all I use it for. "

A DOS program should be simple to install (just copy the appropriate folders).  If you have any extra drives around, I'd consider starting over.  Reinstall XP and the program.

Do you need network access with your DOS program?  If not, why not just set up the computer with DOS and your application and no networking?
Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
Well, the system is as full of memory as it can get (3.25 GB is the limit for XP systems) so that's a dead-end.  I would have to say that a dual-core laptop is not the ideal platform for a system with this much going on.

I am quite sure that there is more going on vis-a-vis network activity in that system than the TCP View screenshot shows.  TCP View is apparently having some kind of problem which is confirmed by it crashing.

Download a copy of Microsoft Autoruns and see what is being loaded into the system at boot time.  Deo volens there are some things that can turned off.  Look in particular at the Login tab.

https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

It is undeniably a tedious and lengthy approach to go at this problem from the "eliminate what it is not" approach, but if it's good enough for Sherlock Holmes ...
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
to me  it looks that the cpu is nearly at 0% use, then spikes up above 80% and more; can you link any app that does that?
i would reboot the system, and reopen this page, then start running the apps 1 by 1 to check what causes the spike
RAM looks ok : 4 gb installed, and more than 2 available

Author

Commented:
Thanks
I think Ive solved it by unchecking virtual machine network services in the network connection properties.
CPU running around 40% now.
Happy Days
Dr. KlahnPrincipal Software Engineer
CERTIFIED EXPERT

Commented:
OK.  Do note that any virtual machines on the system will be unable to use networking when that feature is disabled.

Author

Commented:
Thanks Dr Klahn.

Useful to know , luckily not a problem.
You were on the right track with the network activity, but also thanks to everyone,
some really helpful comments from all.  

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.