100% CPU Usage

[slicardie]

Hi everyone,

I am having a very big problem with a PC in my office. It is a Pentium IV 1.5 GHz, 256 RAM and HDD of 20 GB. It has Win2k Pro installed. When the user logs into it, some days (but almost always) the speed lows down, and if I use the Task Manager, the CPU usage graphic is at 100%!!!. So, to see what process was causing it, I went to the Processes tab and saw that it was "Services". When I tried to terminate it, as you may have guessed, Win told me that "This is a system process and can't be terminated". What I find very strange is that when I log on as the Administrator, if the CPU usage was at 100% when the user X was logged on, with the Administrator it starts to low down until it is at 3 or 4% cpu usage. What can be happening???

 

[Psingh]

There can be an application that u had installed for user x, that application might be giving some problem.

Findout recently which application u had insatlled for user x.

PSingh

 

[slicardie]

Unfortunately, I am new at the office and don't know what they have installed (I found things as unuseful as the Datemaker Intl.). Is there any way to see exactly what sub-processes are running under Service.exe??

 

[Psingh]

As u r saying that if u login with the Administrator it works fine and if with user x it is giving the problem, if possible try re-creating the profile of the user and see what all services r running from administartive tools in the control panel.

PSingh

 

[slicardie]

Well, the Administrator profile seems to be exactly the same as the user X profile. I went to computer management->system info->software environment->startup programs, and found references to programs already uninstalled (like the Datemaker Intl.). I saw the Startup folder in the Programs Menu, but they don't appear them... do I have to erase them manually in the registry?

 

[zelko961]

Go to control panel,administrative tools,services and then they are listed click on service You want and change properties stop or start,manual automatic or disable etc..

 

[lordeos]

Hello,

Login with the administrator account and write down all the services that it is using. Then login with the x account and see the differences.
Try to determine witch process is causing so much trouble and try to disable it in the "services" tab.

Mike

 

[slicardie]

Hi guys,

I tried everything you said. Even the administrator profile has more active services than the X user one!. I downloaded SP4 and actually it misconfigured Office!!. Well, when I installed it, the problem of the 100% cpu usage seemed to solve. But today it was the same... I noted two interesting things:

1. Sometimes, Win2k sent me an alert of svchost.exe being closed because it performed an illegal action. What I found is that it was the Telephony service, which of course I disabled.

2. When the user X logs on, the cpu usage goes to a 100%. If I log off and log on as Administrator, the cpu usage drops to 0-2%. If I log off again and log on as user X, the cpu usage stays 0-2%!!!. Please help me guys, I'm really going insane with this problem...

 

[lordeos]

Go to register and try to disable this in you registry settings ... delete the value . Then windows wont start this service anymore when starting up and then you can delete it or put his account to disabled.

Then on the other hand. Your user profile could be corrupted. so what you can do is try to delete the user accoutn make a new account and give him administrator rights and see what he does. If the cup stays down the profile was just corruped otherwise its a service .

Sorry that i cant tell more. But im trying to analyze the problem and that goes step by step
greetings
mike

 

[zelko961]

Find osa9.exe,remove it and reinstall office.That's how I've solved part of problems after installing sp4.

 

[lordeos]

MMM that host erros rings a bell. You sure you not infected with blaster virus.

 

[slicardie]

Well, I have the 4286 dat definition (mcafee), and nai says this virus definition protects you from the msblast. I'll check manually (in the registry) if I'm infected, but according to the symptoms of the virus, you get an error message from rpc that causes to reboot your computer when you're infected. And the computer doesn't reboot, I just get the 100% cpu usage... however, suppose I'm infected. What the virus does, is to make svchost.exe to crash. Then, it is not a part of services.exe... which is the process giving me trouble.

I'll check if I have the worm and let you know.

 

[slicardie]

Guys, as I told you, I checked the registry and I have not the virus. I checked also the cpu graphic and guess what? It is at 0-2% (user X is logged on)... what can be happening?

 

[lordeos]

So now when you log it works fine ????

 

[slicardie]

Not exactly... most of the time, when I log as user X, cpu usage is at 100%. Sometimes it is at 0-2%... what I noticed is that user x's profile is about 10 MB (I don't remember exactly if it is 10 MB or 1 MB). In any case, it is too big... I don't want to delete the profile because I don't want to lose all user X's preferences. How can I fix the profile?

 

[pweegar]

What process or service is using up memory? Log on as your user. Go into task manager->processes, click on mem usage. Anything look like it's eating up a lot of memory?

How long has it been since you have done any HD and/or registry maint.? Could be that User X had a program loaded at one time and then removed it, leaving behind registry entries that are causing a problem.

 

[slicardie]

Memory usage is like this:

qttask.exe 6,872 K
mcshield 6,728 K
svchost 5,660 K
services 5,204 K
vshwin32 5,100 K
svchost 5,060 K
svchost 4,936 K
explorer 4,484 K
spoolsv 4,184 K

Do you notice that svchost is listed 3 times? It seems strange to me, but remember that I DO NOT have the msblaster worm, and that the computer has installed the patch that microsoft released.

Now, for the registry and disk maintenance... I'm new at the job, and I haven't had time to do that. By disk maintenance you mean to erase unuseful files? And how do I do a good registry maintenance without misconfiguring the pc? Thanks for your help guys!

 

[ashpp]

slicardie,

>Do you notice that svchost is listed 3 times? It seems >strange to me, but remember that I DO NOT have the >msblaster worm, and that the computer has installed the >patch that microsoft released.

Don't worry it being listed multiple times is normal. So is it SVCHOST running at 100% or SERVICES at 100% or both?

Can you take a look in the event viewer and see if their are any errors in it?

 

[slicardie]

Services is running at 100% (99), svchost is not using cpu.

There is one error that seems to raise everyday:

Event Type: Error
Event Source: rasctrs
Event Category: None
Event ID: 2001
Date: 8/18/2003
Time: 8:08:10 AM
User: N/A
Computer: MICRONPC
Description:
The description for Event ID ( 2001 ) in Source ( rasctrs ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: The event log file is corrupt..

Today I haven't had time to check if the cpu usage was at 100% until now, so before I checked the event log, I opened the task manager and noticed that the cpu usage is at 0-2%. Weird, isn't it? (user X is logged on, so I would expect the cpu to be running at 100%, but today it is not like that...).

 

[slicardie]

Hi guys,

I still haven´t figured out how to fix the 100% cpu usage problem. The matter is that I do not have time to make a backup of the HDD and reformat the disk and reinstall win2k... and I also want to know what is happening, just in case it happens again. Anyone can help me??