It's possessed!

September 28, 2007 11:17 PM

Windows services from hell, I command you to leave... please? How do I stop them eating cpu like candy?

The possessed: Toshiba Portege M200, 768K RAM, XP SP2, Intel Pentium M 1.67 GHz, NVidia Go 5200, no funny things floating inside as far as I know. Laptop is a lending, so not possible to follow the "reformat and reinstall" usual advice (which looks like a circus trick to do in any case, considering the thing lacks a CD/DVD/floppy drives and no USB boot capability). Followed several online hints about what services to kill and not, not much changed in the CPU frenzy. I can see a regular 20-30% eating, with often enough spikes into the 50%. It did got a little better once, when I tried lobotomizing the services right and left, but it screwed up most of the things I wanted to do. On sporadic occasions, svchost.exe and the NVidia nvsvc32.exe go bonkers and stay in 100% until I kill them. Or just the svchost.exe (so I can't blame NVidia - by the way, everybody and their momma has a diferent opinion about what version drivers for NVidia I should be using in this thing; right now it seems to be loaded or cursed with the 165.01 version). Spyware and virus scans with decent and updated tools show cleanliness and health, so I can't blame that either.

I'm halfways already to buying my own refurbished machine, but being the stubborn SOB I am, I want to beat this beast into some sort of submission (not to mention it would be a nice way to pay back the owner's kindness for the lending when I finally give it back in a better state than it left). Clues? Hopelessness to share?

posted by Iosephus to computers & internet (13 answers total)

You can disable the NVidia display driver helper service. I always do when fixing machines with NVidia graphics cards, and I've never seen any problems. Of course, YMMV.
posted by wsp at 11:28 PM on September 28, 2007

Understanding the processes that are running when the bog downs occur is the key to solving them. svchost.exe eating lots of CPU is kind of uninformative, until you bring up a command window, and type task /SVC at the command prompt. You'll get a list of processes using particular instances of svchost.exe, by PID (process ID number) for the svchost.exe instance they are associated with, at the instant you take the snapshot. Rollback the command history with your arrow keys to take subsequent, quick snapshots through time, if you see your CPU utilization changing, and you can get a pretty good idea of what is eating your CPU cycles.

But whether it's a good idea to kill certain processes to "improve" the laptop is questionable, this being mostly a matter of how any given user is going to use the machine. You for instance, may place a premium on interactive response, avoiding browser freezes, etc. So, turning off Windows Indexing services would seem like a big win for you, but it may be anathema to the next user, who spends a lot of time searching for locally stored files, and thus depends on an up to date disk index, much more than you. If it's not your box, at least have the good graces to make a record of what you've changed for your likes, and put it back the way you found it when returning it, unless it's going to be wiped and re-imaged before being passed along to the next user.
posted by paulsc at 11:58 PM on September 28, 2007 [1 favorite]

wsp, that's good to know, I'll left that one disabled then.

paulsc, yes, I will just leave all services on manual/automatic as they usually are and tell the owner about whatever tweaks worked for me. I tried the "task" in a command window, but it complains that there is no such command. I just installed Process Explorer, which gave some details on the svc consumption. It seems the black hole is the RPC service. What the?

*goes googling*
posted by Iosephus at 12:08 AM on September 29, 2007

task /SVC

Type exactly as above.
posted by paulsc at 12:25 AM on September 29, 2007

Well, that was fun. Seems the NVidia helper is a little hog, and causes the RPC service to go after the cpu candy. Disabling it fixes things for my liking now. paulsc's hint to figure out the internal diet of svc was what I was missing. Yay.

*shakes fist at stupid sexy NVidia*

(On preview: that didn't work, but as you can see don't worry about it, thanks!)
posted by Iosephus at 12:28 AM on September 29, 2007

(I could as well link my successful googling in case someone else finds this thread useful:

NVidia helper hogging CPU through RPC )
posted by Iosephus at 12:31 AM on September 29, 2007

paulsc: That task command seems awful useful, but it doesn't work for me either on XP SP2 (typed exactly like you wrote). I even did a search, and there is no program called 'task' on my computer. Is there something else that the OP and I need to install to get that command?
posted by philomathoholic at 2:13 AM on September 29, 2007

on XP SP2 the following works for me:
tasklist /svc

To see what's going on on your machine the free program Process Explorer, formerly of Sysinternals, is very handy.
posted by jouke at 3:04 AM on September 29, 2007

I find this kind of behaviour is very often caused by a borked virus scanner (assuming the machine isn't actually infected with a real virus)
Try completely uninstalling and reinstalling the virus scanner - just make sure you disconnect/unplug the internet connection while doing this.
posted by Lanark at 3:33 AM on September 29, 2007

tasklist.exe is not included in XP Home, you can download it here.
posted by wilko at 5:27 AM on September 29, 2007

Warning a little tough love follows:

svchost.exe is a service which runs other services. As explained above its easy to see what its running, easier with process explorer too.

Secondly, if a process is running at 50% cpu, then so what? You paid for that cpu and your computer is using it. This is like complaining your car is using gas at idle.

I can see a regular 20-30% eating, with often enough spikes into the 50%.

Thats fine. Every computer does that. Thats what computers do. If your computer is noticeably slow then you should consider that fact that you have what must be a 3 year old machine. This is why the spyware and virus utilities arent finding anything. Your machine is fine. Youre just looking for problems by looking at the task manager. Not good.


The only real problem I see here is that the video driver seems to occasionally lock up. The driver you should be using is the one toshiba offers on its website for the model of your laptop. Dont download anything else. Laptop manufacturers doesnt usually use the stock driver and by putting it on there you may have screwed up this laptop.

I recommend the following:

1. Vist toshibas site and update the BIOS, video, and network drivers.

2. Disable automatic windows update and only get your updates through the windows update website. Automatic updates can be problematic on older slower machines. Essentially at every boot your computer does a sort of inventory and then polls the remote server for updates. This can make it seem like the computer is very slow. this runs under svchost

3. Defrag your drive.

4. Update your applications. Are you using an old version of whatever you are using? This may be an application issue.

5. What is in your system tray? Do you need all these auto running programs? Also, if you feel confident in your tech skills you can see what is going on with msconfig or autoruns and selectivly disable things you dont need. Autoupdaters for acrobat, anything quick start, itunes, itunes helper, dvd player app, etc can be safely disabled.
posted by damn dirty ape at 9:22 AM on September 29, 2007

@damn dirty ape -- On Windows XP SP2, idle CPU use is typically lower than 10%. Higher than that and it is useful to try to find out why because it may be that the machine is compromised and trying to blat spam at the rest of us.

Also, responsiveness goes down dramatically when the idle CPU is high. If the services eating CPU are needed, then I change the profile from "single user" (increased responsiveness) to "server" (increased CPU for services).

Ignore Microsoft's assertion that "single user" has increased responsiveness. Server mode is better if there are background services taking significant CPU.
posted by TeatimeGrommit at 10:01 AM on September 29, 2007

I have always used Black Viper's site for advice on which services can be safely disabled.
posted by jeffmik at 8:50 PM on September 30, 2007