Mysterious problem with T60

[alex3005b]

I recently had keyboard problems and sent my T60 in to be fixed. Since then, the keyboard problems are resolved but I have a new problem. I am not sure if this problem is related to sending the T60 in, or that it is simply a coincidence that the problem started at a similar time.

When my system is idling and all programs are closed, a mysterious process is consuming resources. The CPU performance meter shows regular spikes to 50% that hold for a second or two, goes down to 0% and back up to 50%.. repeating with the same period forever. The graph looks something like this: /***\/***\/***\ etc. with the crest at 50%. When other program run, it seems to mask this behavior.

My IBM tech support suggested running a anti-virus and anti-spyware, and if that fails to catch anything, to try reinstalling windows. I found no spyware or virii, but am reluctant to take the drastic measure of formatting/reinstalling for now. Is there anything else I can do. I do not have system restore or setback software.

I have one lead: when I closed all the programs and opened the windows task manager and sorted the processes by CPU usage, the process "System Idle Process" and "svchost.exe" ranked at the top. While I was unable to manually end "System idle process", I was able to turn off "svchost.exe." After that, the periodic spikes disappeared. With that svchost.exe turned off, I observe no apparent problems and my machine is running fine. Is there a way I can figure out what is the original source of this particular svchost.exe? (I know there are multiple svchosts, and most are supposed to run).

[NS]

I had the same problem like you the other day. My CPU goes up to 100% and my computer keeps emitting hot air. If you put your fingers near the vent, you will feeel like burning. When i check task manager, i saw something keeps using my memory and eating my CPU process. Same like you, i did not have any program running. I delete whatever consumed the most Kb process. Then later computer freeze and hang there. Reformat twice to get it running again. <sigh!>

[dsigma6]

theres a program that breaks down your task manager and tells you what each process is actually doing. naturally i cant remember the name as i only used it once. hopefully someone in here will.

i would recommend disabling unnecessary windows services if you havent already done so. google the same topic, its on majorgeeks.com.

edit: i recommend the above things regardless, but are you sure there werent any windows or other programs doing updates?

NS- just like if your car was idling high and your solution was to cut the serpentine belt.

[deforest]

Use process explorer from sysinternals (i.e. www.sysinternals.com).

It will show you the svchost and all the services that it contains so then you can isolate them.

I have an issue with svchost and cpu, and notice that if I disable windows firewall that it will drop cpu. I have another firewall on the machine so I'm not worried. But I noticed that I can disable the firewall and wait a minute, cpu drops to 0, then I can turn on the firewall again and the cpu doesn't spike back up.

I been trying to diagnose the issue, and the current theory is that my host file has a lot of entries in it (i.e. block addresses) that spybot is putting in there, and there is a known cpu issue for the dns service with large host files.

I especially noticed this when I would be using wireless and I would drop the signal and reconnect. The svchost would suddenly spike up again.

My solution was to disable windows firewall since I'm using another 3rd party product for firewall management, also I'm on a nat network.

[dsigma6]

thanks deforest, thats the program i was speaking of.

[Orevin]

Download and run HijackThis: http://www.hijackthis.de/
On the same page you can insert the results and check them.

HijackThis is a program used by experienced users in order to detect browser hijackers. It allows you to identify any sort of spyware and malware (as well as some trojan horses and worms). This is achieved by scanning special zones of the registry as well as the hard disk drive, the results being listed in a structured window.

[alex3005b]

I uses process explorer and found a specific SVChost.exe to be the culprit. It is affiliated with the following services:
Windows Audio, Cryptographic Services, DHCP Client, Logical Disk Manager, Error Reporting Service, COM+ Event System, Fast User Switching, Help and Support, Infrared Monitor, Lanmanserver, lanmanworkstation, network connections, network location awareness, remote access connection, schedule, seclogon, system event notification, Windows firewall/internet cxn sharing, shell hardware detection, telephony, themes, distributed link tracking client, windows time, windows management instrumentation, security center, automatic updates, and wireless zero config.

Which services can I disable, and how do I disable them?

[dsigma6]

did you read my post above about disabling services??

[alex3005b]

yeah, i read your post but don't know what part of majorgeeks.com to use. I once had spyware/trojan issues and they helped me out, but I'm not sure what they can do in this circumstance.

I went ahead and stopped various services registered to the culprit SVChost to see if it would take away the CPU idling problem. I found that killing the Windows Automatic Update service fixed the problem, so I believe that is the culprit.

So now I'm looking for a more specific reason as to why Windows Automatic Update service behaves this abnormally and long-term solutions... (preferably one that would allow me to turn on Automatic Updates again).