SVCHOST.EXE causes CPU usage to 95+% after connecting to Internet through DATA CABLE

ramanandji · #1 08-31-2006, 09:10 AM

Description:
I have WINDOWS XP SP2 and Mobile Handset LG M4410 with Data Cable and a GPRS service from Airtel India. When I connect to Internet through data cable using the above mobile as modem, gets connected to net successfully. When I try to open any site just for a minute the data is downloaded and immediately CPU usage goes up to ~95%. And no more data transfer happens and CPU Fan makes lot of noise indicating heavy load. The computer almost hangs thereafter. Unless I disconnect datacable manually computer will not come to normal state.

I have observed the following things using PROCESS EXPLORER from systeminternals.com:

[1] It is svchost.exe which eats up CPU time. This file has lot services attached to it. I tried disabling all of them except RasMan.exe(Remote Access Connection Manager). Still the problem is seen, so I conclude that problem due to this service only.

[2] I have observed the threads also. This particular thread "kernel32.dll!CreateThread+0x27" causes lot of context switches. The CSwitchDelta oscillates between 150-200.

[3]This thread only eats 95% of CPU.

[4]No virus as far as I know. Because after formatting and reloading of XP also I obeserved the same problem.

[5]There is no problem if connect to Internet through bluetooth, I have browsed for hours but CPU usage never jumped to 95%. Only if connected through data cable it the problem is seen.

[6]I believe this problem is with LG Data Cable only, as I used Nokia3220 and Nokia6610i as modems and CA-42 serial cable to connect to Internet and browsed for hours but CPU usage never jumped to those levels(~95%).

Stack for this thread:

(a)
When connected to Internet and after CPU usage jumps to 95%:
------------------------------------------------------------
ntkrnlpa.exe!KiDispatchInterrupt+0x7f
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xaab
ntdll.dll!KiFastSystemCallRet
tapisrv.dll+0x181ed
tapisrv.dll+0x18ba4
tapisrv.dll+0x2055e
RPCRT4.dll!CheckVerificationTrailer+0x75
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!NdrServerCall2+0x19
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!NdrConformantArrayFree+0x42e
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

(b)
After disconnection by removing datacable CPU usage comes down to 1-3%
----------------------------------------------------------------------

ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtConnectPort+0x1cc8
ntkrnlpa.exe!NtConnectPort+0x1efc
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
shsvcs.dll+0x18217
shsvcs.dll+0x17b33
svchost.exe+0x11cc
ADVAPI32.dll!CryptVerifySignatureW+0x29
kernel32.dll!GetModuleFileNameA+0x1b4

Can somebody help me what shall I do to rectify this problem?

Similar stack traces repeatedly taken for clarity are given below;

Not yet Connected to Net, CPU Usage:Normal
------------------------------------------
ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtWriteFile+0x2b00
ntkrnlpa.exe!NtReadFile+0x580
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
ADVAPI32.dll!SetServiceStatus+0x238
ADVAPI32.dll!SetServiceStatus+0xcc
ADVAPI32.dll!StartServiceCtrlDispatcherW+0x8b
svchost.exe+0x2585

Connected, CPU Usage:~95%
-------------------------
ntkrnlpa.exe!KiDispatchInterrupt+0x7f
ntdll.dll!KiFastSystemCallRet
kernel32.dll!WaitForSingleObject+0x12
tapisrv.dll+0x18ab4
tapisrv.dll+0x19494
tapisrv.dll+0x20ede
RPCRT4.dll!CheckVerificationTrailer+0x75
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!NdrServerCall2+0x19
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!NdrConformantArrayFree+0x42e
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Disconnected, CPU Usage:Normal
------------------------------
ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtConnectPort+0x1cc8
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Connected, BUT CPU Usage has not yet JUMPED to 95%(within ~1min time)
---------------------------------------------------------------------
ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!IoSetIoCompletion+0x2c9
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0xcc2
RPCRT4.dll!I_RpcBCacheFree+0xbf3
RPCRT4.dll!I_RpcBCacheFree+0xd71
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Connected, CPU Usage:~95%
-------------------------
ntkrnlpa.exe!KiDispatchInterrupt+0x7f
ntdll.dll!KiFastSystemCall
kernel32.dll!WaitForSingleObject+0x12
tapisrv.dll+0x18ab4
tapisrv.dll+0x19494
tapisrv.dll+0x20ede
RPCRT4.dll!CheckVerificationTrailer+0x75
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!NdrServerCall2+0x19
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!NdrConformantArrayFree+0x42e
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Disconnected, CPU Usage:Normal
------------------------------
ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtConnectPort+0x1cc8
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Connected, BUT CPU Usage has not yet JUMPED to 95%(within ~1min time)
---------------------------------------------------------------------

ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtConnectPort+0x1cc8
ntkrnlpa.exe!NtConnectPort+0x1efc
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
shsvcs.dll+0x18217
shsvcs.dll+0x17b33
svchost.exe+0x11cc
ADVAPI32.dll!CryptVerifySignatureW+0x29
kernel32.dll!GetModuleFileNameA+0x1b4

Connected, CPU Usage:~95%
-------------------------

ntkrnlpa.exe!KiDispatchInterrupt+0x7f
ntkrnlpa.exe!ProbeForRead+0x160f
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
tapisrv.dll+0x181ed
tapisrv.dll+0x18ba4
tapisrv.dll+0x2055e
RPCRT4.dll!CheckVerificationTrailer+0x75
RPCRT4.dll!NdrStubCall2+0x215
RPCRT4.dll!NdrServerCall2+0x19
RPCRT4.dll!NdrGetTypeFlags+0x1c9
RPCRT4.dll!NdrGetTypeFlags+0x12e
RPCRT4.dll!NdrGetTypeFlags+0x5a
RPCRT4.dll!NdrConformantArrayFree+0x42e
RPCRT4.dll!NdrConformantArrayFree+0x28b
RPCRT4.dll!I_RpcBCacheFree+0x14c
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

Disconnected, CPU Usage:Normal
------------------------------

ntkrnlpa.exe!KiUnexpectedInterrupt+0xf0
ntkrnlpa.exe!NtConnectPort+0x1cc8
ntkrnlpa.exe!KeReleaseInStackQueuedSpinLockFromDpc Level+0xb14
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5ea
RPCRT4.dll!I_RpcBCacheFree+0x403
RPCRT4.dll!I_RpcBCacheFree+0x5d2
kernel32.dll!GetModuleFileNameA+0x1b4

QuicksandWalker · #2 04-25-2008, 02:37 PM

Did you ever find a solution to this?

I have even researched down to the thread stacks using Process Explorer and found the same culprit at the end of each stack "kernel32.dll!GetModuleFileNameA+0x1b4". For example:

ntoskrnl.exe!ExReleaseResourceLite+0x206
ntoskrnl.exe!CcUnpinDataForThread+0x338
ntoskrnl.exe!ZwYieldExecution+0xb78
ntdll.dll!KiFastSystemCallRet
RPCRT4.dll!I_RpcBCacheFree+0x5e3
RPCRT4.dll!I_RpcBCacheFree+0x405
RPCRT4.dll!I_RpcBCacheFree+0x5cb
kernel32.dll!GetModuleFileNameA+0x1b4

The command line to start this service is "C:\WINDOWS\System32\svchost.exe -k netsvcs".

The suspicious thing is, that even though there are dozens of instances of the svchost.exe running, only this one will occasionally peg my CPU at 95+%. And ONLY this one has more than a few services registered with it. It has 30 items in the Services list. And in the Threads tab (of Process Explorer) it will show 3 threads at a time jockying for CPU time and all three have the GetModuleFileNameA as the active thing on the stack. In fact, they all have the following 4 items on the top of the stack (bottom of list, visually):

RPCRT4.dll!I_RpcBCacheFree+0x5e3
RPCRT4.dll!I_RpcBCacheFree+0x405
RPCRT4.dll!I_RpcBCacheFree+0x5cb
kernel32.dll!GetModuleFileNameA+0x1b4

Does anyone know what these mean?

In the time it has taken to report this, it gave up and went back to normal operation. However, this pegging of the CPU can last for at least minutes. Killing the service will solve the problem and the PC still mostly works (no sound, etc.)