T42p: 100% CPU Utilization/svchost.exe -> rpcss.exe

[Conmee]

This should probably go in a software/OS forum, but I was hoping to get some additional exposure in this forum before the thread is moved... lol

I've got the IBM Preload running on my T42p (2373GRU). I've got three user accounts: Me (admin), Administrator (admin), and User1 (power user). I've noticed that when I logoff from any one user, and log back in as a different user, the svchost.exe process is pegged at 100% of CPU (the sub-process it runs is the RPC service). No matter what combination of ways I log on/log off, this process brings my system to a crawl. It even does this with a retail install of WinXP. I've used all the service packs and patches from both IBM and MS, and the problem still occurs.

I'm thinking it might be the security chip (even though I've only loaded the drivers, not the security client itself), but that didn't seem to make any difference either, whether it was installed or not--the Atmel and CSMBUS drivers.

Initially, when I setup the users, there were no problems, and there weren't any problems when I initially docked my system. But after adding IIS, installing the Loopback adapter, requiring CTRL+ALT+DEL to logon v. the default WinXP signon screen, installing Roxio Media Creator 7, Bluetooth III software, and Intervideo DVR3 and USB drivers for my Adaptec TV/Video capture device... some combination of all the ThinkVantage apps and these apps above... and as soon as I logoff and log back on as a different user, the CPU is at 100% because of the svchost.exe (rpcss.exe) process. And it doesn't matter which user I initially logon as... the first time I logon after boot, things work fine. But the moment I try to logon as a different user, without rebooting, the CPU is stuck at 100%.

I've tried creating different user accounts, loading WinXP from a retail CD and changing the order of software I install... I have had the problem occur after installing Rapid Restor Ultra, the Security Client, the Intervideo software, the Roxio software, and MS Office. I've started with the IBM Preload, installed an app, logon each user to make sure they work, install the next app, etc. And there doesn't seem to be any causal connection between any one app and the appearance of this error.

There doesn't seem to be any rhyme or reason as to when this problem starts, so I wondered if anyone else has this problem. Or has come across it. It's not a virus or trojan/worm, as I am not connected to any network and installing from retail CDs with no network support... and yet I still have the 100% CPU problem...

Currently, I have a complete retail copy of WinXP installed, with all the MS updates, and all the latest IBM ThinkVantage updates. I've got the security client working and installed, as well as Rapid Restore Ultra 4. I ghosted it at this point since it works. And all networking and AccConn/BattMax/APS, etc are installed and working. I've got a Palm desktop and driver installed, a Canon scanner, and HP printer, and Adaptec's USB TV/Capture device all connected, and a wireless mouse. It works fine, and I can logon with all user accounts in any order.

However, as soon as I install either Roxio Media Creator, Intervideo DVD 5, or DVR3, in any order, the problem will occur. It will also happen if I install MS Office.... and I'd venture to say, just about anything else I might try to install... will probably set off the problem again...

Any ideas? The only thing I haven't tried is a retail install of WinXP with NO ThinkVantage technologies. Maybe that will work, but if so... there goes part of the so-called "value add" of IBM... besides build quality, that's supposedly their biggest competitive differentiator, the ThinkVantage tools/apps.

By the way, when I kill the svchost.exe process that is chewing up 100% of my CPU, as one would expect, I get an NT Authority/System prompt telling me the RPC process has unexpectedly terminated and will reboot my system in 60 secs. lol

Daniel.

[JohnV]

Are you by chance on your home network while loading this laptop? Are there any other PC's on your network? If so I would check them for viruses. Also if you are on a high speed internet connection that is not protected by a router or firewall you can get infected with a number of viruses that use the name svchost.exe.

John

[JohnV]

Also why are you loading IIS?

John

[JohnV]

Here is a MS page that gives you details of what the svchost.exe does. Right now I have five instances of it running on my XP OS.

http://support.microsoft.com/default.as ... -US;314056

John

[aquina]

Does sound like a trojan/virus/worm to me.

I would run a good antivirus program like PC-cillin (not NAV as that doesn't catch all the trojans).

[Conmee]

The retail WinXP install that I loaded and the Preload are not on any network whatsoever. And the only home networking I have is the wireless router, but I've got that turned off while I'm configuring/building this system. The first thing I did was turn off all networking, but still encounter the same problem. I also uninstalled IIS and the loopback adapter and that didn't solve the problem.

As for why I'm running IIS, I use it to serve up web pages I work with on the localhost. If I could verify that IIS was causing a problem, I'd run Apache instead, but this svchost.exe problem occurs even when I've uninstalled IIS and the loopback adapter. And I've got the loopback installed so that IIS is only listening/serving the localhost machine, and isn't using the built-in networking adapters of the T42p.

And I've read all the Microsoft documentation thus far, and I know what svchost.exe is for and what it does. And as I mentioned, I know that the svchost.exe in question is running/launching the rpcss.exe process, which is the RPC component that is used by the OS for many different things. It's as if it hangs or is in some sort of loop waiting for a response from some application when I logoff and log back on. If I reboot, no problems.

Most of what I've come across on the Internet has to do with various viruses and trojans causing buffer overflows, etc, but this problem happens even when I restore the factory contents and haven't connected to any network. I never had this problem with the same setup on my T40p, so I was thinking it may be an MS or IBM update/patch/Thinkvantage technology causing the problem.

Thanks for the help and suggestions... if anyone has more ideas, let me konw.

Daniel.

[JohnV]

No chance that you may be connecting to a neighbors wireless router by accident while you are loading your laptop?

John

[andyk]

Doesn't sound like hardware, but perhaps run a hard drive surface scan first?

It seems the only effect of installing additional software is that they use up more disk space. And if using more disk space causes the problem...

Also, perhaps pop out the DVD/CD-RW just to be sure it's not causing anything.

[Guest]

Are you freaking kidding me. I have that same scvhost thing on my computer. That is crazy. A few months ago I brough MCaffee antivirus home from college. I put it on my computer but can't update it because I am not on the school's server. So in between that time I have a virus. I have the old one from Christmas. If you guygs have aol instant messenger it is the virus that says somethning like "You want to see my new year's eve pics". I though the scvhost,exe was my antivirus in the background. it is in my toolbar but is is not on. That is crazy. Well i am on dial up now so and my computer is workng fine I guess. I am taking this computer with me to school and will get rid of it their. My school will notice that as soon as i plug the ethernet cord and then will boot me off. It is interesting how what i thought my antivirus was/is a virus.

[Conmee]

No, the wireless is disabled and still no luck. As for a hard drive problem, I've Ghosted a working image onto a T41p and another T42, and I get the same problem.

Here's something weird though: I started uninstalling stuff, one thing at a time... and got the 100% CPU utilization to go away. I uninstalled APS, rebooted, Fax, rebooted, Indexing Service, rebooted, and finally Message Queuing and rebooted, and each logon worked fine again, no 100% CPU utilization. So, figuring it was MQ, I reinstalled Indexing, Fax, and APS, and the 100% CPU utilization problem reappeared?!!?! So I uninstalled Indexing again, and the problem disappeared.

Thinking that I had figured it out, I proceeded to install Intervideo WinDVD 5, and guess what... the problem reappeared. I've turned off System Restore during all this, so things wouldn't get restored/reinstalled automatically as I'm uninstalling and rebooting.

It's as if the uninstall/install process causes the problem to disappear/reappear after doing a number of installs/uninstalls of applications and Windows components.... haven't come across something like this before.

Anyhow, if I get this figured out, I'll post my findings....

Daniel.

[Conmee]

There is a virus called SCVHOST.EXE which is NOT the same as SVCHOST.EXE which is a required system component in Windows XP...

See here.... http://ask-leo.com/archives/000105.html

Daniel.