svchost.exe causing 100% CPU usage: analysis

Hello all. I searched this forum on info on above mentioned topic and found little helpfull info. Did some research myself and came up with this:

Case:

-WinXP pro install
-Office 2003
-NAV2004
-PowerArchiver2003
-MediaPlayer 9
-Paint Shop Pro 8
-Adobe 6 complete (free thingy)
-Nero burning Rom 6
-InterVideo Home Theater
-Alcohol 120%

-all security fixes etc.

Caused:

CPU usage 100% on svchost.exe which turned out to be the RPC service when I killed the process. Thus shutting down your PC, rebooting and regaining the 100% CPU usage problem.

I do not have this problem on my other PC on the same router on my home network, so I figured it had to be something in software. I run all above mentioned programs on all my pc's, they are part of my basic install. No problems on any other PC.

Then I thought there had to be a difference in installed programs, because it has to be something right ?

Started deinstalling all my hotfixes and security patches... or at least, I was about to, when I thought I might apply some logic first. The RPC service is part of the networking component stuff. Knowing that I looked for installed security/hot fixes regarding networking related stuff that I did install on the new computer, but not on the others.

Almost immediately the Packet for Advanced Networking stuff jumped into my eye... I tried to remove it, and found out it stopped responding at the last step of uninstall.... then I killed the svchost.exe process causing the problem...offcourse my computer started whining about the RPC service being shut down and having to reboot, but the uninstall process started running again too...

After a reboot I seem to have lost the 100% spikes on CPU usage.

So, for everybody who jumped to the bottom of this post to read a conclusion:

Try deinstalling the Advanced networking stuff before you start tweaking everything else... also the remakrks I have read about getting rid of all updates are plain stupid. MS didnt make them for jack **** you know. It's just that some updates conflict with certain situations, or are only ment to be used in a certain situation...

Deinstall update 817778: Advanced Networking Pack before you try anything else that you are gonna regret.
It's mainly used for IPv6 anyways.

A(^^;(We are annoyed at too simple questions, but also at too detailed one.)

Then, most important suspect must be removed first.

This is that your PC may be infected by "W32.Welchia.Worm".

According Symantec, it produce itself as:

%System%\Wins\Dllhost.exe

Then copy itself to System folder.

%System%\Dllcache\Tftpd.exe is cloned as %System%\Wins\svchost.exe

Ehrm...FYI this was NOT a question, and if you are anoyed then don't bother replying.

Quit bugging everybody with worm warnings please ? I started my post with saying that I used a clean install.... I also referred to my home network and a router I use. Since all routers today have a build in firewall there is no chance in the world that I got a worm from internet. Then I clearly stated I use NAV2004... which is more than able to detect and remove that worm in the case that it was already on my network.

And YES I do install a system with the networking cable UNplugged !

And please...while you are annoyed, take some time to read my post twice next time... I said the problem was in svchost.exe that hosted the RPC service... proof of concept being that windows tells you the RPC service shut down unexpectedly after killing the 100% CPU usage svchost.exe

So basicaly, thanks for the reply, but I don't understand what use it is to me or anybody else.

(^^;(Sorry! If you are annoyed at too, but...)

I used FIND utility for the word"clean install". However found only in your #3 thread.

Then, the reader couldn't make out the whole thing in the teeth of that length.

Moreover, we are used to accept the questions. As far as the your discourse goes, what you want to know is not clearly represented.

I don't know wether you only assert or opinion, or ask something.

I first noticed the word "you searched"and "no helpful" Then I thought you're asking.

In any way I cannot help reading, and at last, your conclusion..

Certainly there seems to be many questions or articles about svchost.exe. So some people may be interested in your comments.

But, if you are kind enough to the reader, you might say at first. "I want to teach you" or "Here's valuable information about svchost.exe" at least in your second line.

For my part, I don't understand what use it is to me or anybody else.

(^^;( I surely was annoyed, but was not angry. I hope you might be so. We must understand each other.)

Thanks!

I didnt realize we where fighting a language barrier
I'll shed some light on this all...

I made this post because I could not find any usefull information on svchost.exe and the 100% CPU usage bug. In my case, when I killed the svchost.exe process, it turned out to be the RPC service that caused the 100% CPU usage. I base this conclusion on the fact that after I kill the svchost.exe process causing the 100% CPU usage, I get a critical error from windows, telling me that Windows is going to shut down in 60 seconds because the RPC service terminated unexpectedly.

All posts regarding this subject suggest stuff like virus scanners and 3rd party programs. But logic rules that out, since those things have nothing to do with the RPC service, and can't occur on a machine that is isolated from any network and undergoing a clean install.

Therefore I investigated what was causing the RPC service to behave like that, which I documented in my first post. It turned out to be that the Advanced Networking Package update from Microsoft was the bugger. This is logical, because that package adds functionality to the networking environment. The RPC service is part of that.

So I removed that update and that solved the 100% CPU usage bug for me. Since this method was not jet documented here I thought it would be best to create a new topic with the question and the answer in the first post, rather then answer a dusty topic that probably nobody even remembers.

I also gave some unwanted advice on what to do first when trying to diagnose this problem and would like to point out again that you should not only look at worms, virusses and bugged other programs. With Microsoft products you start to check the OS first. You check if you made recent updates (or maybe use auto update that could have done it without you knowing) that could cause this. Then you check whetter you changed your hardware config. Then you try and remember when the last time it worked good was, and think real hard what you installed between then and now. If it could be the cause (system updates/stuff that uses the network to operate) you remove it and see if that helped. During that step you should also be scanning your disc for virusses and worms. But please don't yell Worm at every little problem. It works confusing and draws attention away from the main problem.

And one other thing: I stated I was going to educate you in the topic. : analisys

(^^;(I got your attitude and what you mean. but...)

Analysis only do not always means that it is my analysis, you will be taught.

Particularly, the next word "I search""no help" dosen't go with it. this is like as small print on articles of agreement. At least, unkind to the reader. If I am in your shoes, I write thus.

Analysis: svchost.exe causing 100% CPU usage

or Analysis of....

But Even in this case, you wrote

"I searched this forum on info on above mentioned topic "

Then the above mentioned topic must be"svchost.exe causing 100% CPU usage: analysis "

So that, it is natural that the reader think You searched the said analysis. and found no help.

Concerning to Virus, I'm not familiar to it. However Symantec Page teach that the worms have something to do with RCP and refer to the below link.

http://support.microsoft.com/defaul...kb;EN-US;823980

(^^;(Don't you think it's about time to shake hands? Let's have a tea break. Here's Good Japanese Tea for you)