NICK - CPU usage with SAS - problem

[Rick]

"Steve" <No Spam> wrote in news:4568af5b$1@dnews.tpgi.com.au:

>
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
> news:wg_9h.11579$oP6.5397@trnddc03...
>>
>> I am seeing numerous threads in Microsoft Windows Update and WSUS
>> related News Groups of
>> high utilization most notable in SVCHOST.EXE. Often it is associated
>> with platforms using
>> Wireless connectivity.
>
> One session of SVCHOST slows my PC considerably for a long time after
> starting. My cure when it P's me off is to kill that particular
> process (and not the other half dozen or so). Is there a way to find
> out what is running each session of SVCHOST?


One way to approach it is to look and see who they are talking to. You
might try grabbing a copy of TCPView from Sysinternals (which has since
been absorbed by Microsoft at http://************/y82msb ) and have it set
to autostart. Then watch for your svchost connections and use whois to find
out who it is talking to.

Off the top of my head, I suspect you will find that it is Microsoft's WGA
program module that phones home shortly after booting up a Windows XP
system. Try going here:

http://en.wikipedia.org/wiki/Windows_Genuine_Advantage

for more info.


--
Rick Simon rsimon@cris.com

Include "spam(trap)key" somewhere in the
body of any email to avoid spam filters.

[Steve]

"Far Canal" <me@privacy.net> wrote in message
news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
> Rick wrote
>
>
>>
>> One way to approach it is to look and see who they are talking to. You
>> might try grabbing a copy of TCPView from Sysinternals (which has since
>> been absorbed by Microsoft at http://************/y82msb ) and have it set
>> to autostart. Then watch for your svchost connections and use whois to
>> find
>> out who it is talking to.
>>
>> Off the top of my head, I suspect you will find that it is Microsoft's
>> WGA
>> program module that phones home shortly after booting up a Windows XP
>> system. Try going here:
>>
>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
>>
>> for more info.
>>
>>
>>
>
> XP-AntiSpy is very useful for turning off unwanted M$ crap
> http://www.xp-antispy.org/
> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
> Version 3.96-4 has recently appeared and stops automatic install of IE7
> which is causing problems for many.
>

Thank you Kurt, Rick and Far Canal.

WGA certainly took it's toll on my resources. Decided to stick with it
rather than wind back the system to ease the pain of update.

The IE7 install seems to have slowed down the PC as well but IE7 itself
seems to run OK.

Time to start working our what is driving SVCHOST sessions. Thanks again,

--
Steve

[louise]

Steve wrote:
> "Far Canal" <me@privacy.net> wrote in message
> news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
>> Rick wrote
>>
>>
>>> One way to approach it is to look and see who they are talking to. You
>>> might try grabbing a copy of TCPView from Sysinternals (which has since
>>> been absorbed by Microsoft at http://************/y82msb ) and have it set
>>> to autostart. Then watch for your svchost connections and use whois to
>>> find
>>> out who it is talking to.
>>>
>>> Off the top of my head, I suspect you will find that it is Microsoft's
>>> WGA
>>> program module that phones home shortly after booting up a Windows XP
>>> system. Try going here:
>>>
>>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
>>>
>>> for more info.
>>>
>>>
>>>
>> XP-AntiSpy is very useful for turning off unwanted M$ crap
>> http://www.xp-antispy.org/
>> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
>> Version 3.96-4 has recently appeared and stops automatic install of IE7
>> which is causing problems for many.
>>
>
> Thank you Kurt, Rick and Far Canal.
>
> WGA certainly took it's toll on my resources. Decided to stick with it
> rather than wind back the system to ease the pain of update.
>
> The IE7 install seems to have slowed down the PC as well but IE7 itself
> seems to run OK.
>
> Time to start working our what is driving SVCHOST sessions. Thanks again,
>
> --
> Steve
>
>
I'm sorry to report that I have tried everything I can think
of - particularly everything that is different about my
portable than my desktop (where SAS doesn't drain resources).

Windows update is, and has been, disabled.
I turned off Windows firewall - seemed to have no effect.

I just spent the last hour using Process Explorer and
suspending each process to see if it reduced CPU use by SAS
and the excessive fluctuations. I could not find a process
that stopped the cpu jumping to 40+ usage, then to 12% and
right back to 40 something % - sometimes into the 50s.

Whatever this process is, it is happening literally every
one or two seconds - back and forth.

And, as noted before, it doesn't happen on my desktop.

If anyone has any other suggestions, I'll be happy to try
them as I'm really very disappointed to find SAS unusable on
my portable - the machine that is, in fact, much more
vulnerable because of the traveling it does and the various
wireless connections I make while traveling.

Is there a more thorough way to track this down?

Thanks.

Louise

[Lisa Simpson]

SAS is good software, no doubt, but try removing it & run AVG & AVG-AS & see
if that clears up the problem . . .

"louise" <louise@invalid.invalid> wrote in message
news:4svfk0Frs7amU1@mid.individual.net...
> Steve wrote:
> > "Far Canal" <me@privacy.net> wrote in message
> > news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
> >> Rick wrote
> >>
> >>
> >>> One way to approach it is to look and see who they are talking to.
You
> >>> might try grabbing a copy of TCPView from Sysinternals (which has
since
> >>> been absorbed by Microsoft at http://************/y82msb ) and have it
set
> >>> to autostart. Then watch for your svchost connections and use whois to
> >>> find
> >>> out who it is talking to.
> >>>
> >>> Off the top of my head, I suspect you will find that it is
Microsoft's
> >>> WGA
> >>> program module that phones home shortly after booting up a Windows XP
> >>> system. Try going here:
> >>>
> >>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
> >>>
> >>> for more info.
> >>>
> >>>
> >>>
> >> XP-AntiSpy is very useful for turning off unwanted M$ crap
> >> http://www.xp-antispy.org/
> >> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
> >> Version 3.96-4 has recently appeared and stops automatic install of IE7
> >> which is causing problems for many.
> >>
> >
> > Thank you Kurt, Rick and Far Canal.
> >
> > WGA certainly took it's toll on my resources. Decided to stick with it
> > rather than wind back the system to ease the pain of update.
> >
> > The IE7 install seems to have slowed down the PC as well but IE7 itself
> > seems to run OK.
> >
> > Time to start working our what is driving SVCHOST sessions. Thanks
again,
> >
> > --
> > Steve
> >
> >
> I'm sorry to report that I have tried everything I can think
> of - particularly everything that is different about my
> portable than my desktop (where SAS doesn't drain resources).
>
> Windows update is, and has been, disabled.
> I turned off Windows firewall - seemed to have no effect.
>
> I just spent the last hour using Process Explorer and
> suspending each process to see if it reduced CPU use by SAS
> and the excessive fluctuations. I could not find a process
> that stopped the cpu jumping to 40+ usage, then to 12% and
> right back to 40 something % - sometimes into the 50s.
>
> Whatever this process is, it is happening literally every
> one or two seconds - back and forth.
>
> And, as noted before, it doesn't happen on my desktop.
>
> If anyone has any other suggestions, I'll be happy to try
> them as I'm really very disappointed to find SAS unusable on
> my portable - the machine that is, in fact, much more
> vulnerable because of the traveling it does and the various
> wireless connections I make while traveling.
>
> Is there a more thorough way to track this down?
>
> Thanks.
>
> Louise

[Dustin Cook]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:wg_9h.11579$oP6.5397@trnddc03:

> From: "optikl" <optikl@invalid.invalid>
>
>| Yes. Have you tried disabling the Automatic Updates service? I've
>| seen this issue on some laptops, caused by AU. Go to start\run. Type
>| in "services.msc. Double click the service named Automatic Updates.
>| Change the start up type to disabled. Stop the service. Reboot and
>| see if this helps. You can always reverse this, and you will have to
>| when you wish to update your system via Microsoft Updates.
>|
>
> I am seeing numerous threads in Microsoft Windows Update and WSUS
> related News Groups of high utilization most notable in SVCHOST.EXE.
> Often it is associated with platforms using Wireless connectivity.
>

Can also be signs of a bad user profile...


--
Dustin Cook
Author of BugHunter - MalWare Removal Tool -V1.9.4
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: November 22nd, 2006

[David H. Lipman]

From: "Dustin Cook" <spamfilterineffect.see.sig@nowhere.com>


| Can also be signs of a bad user profile...
|

Bad User Profile ?

Do you mean NTUser.DAT, the User Registry ?

In what way ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Dustin Cook]

louise <louise@invalid.invalid> wrote in
news:4svfk0Frs7amU1@mid.individual.net:

> Steve wrote:
>> "Far Canal" <me@privacy.net> wrote in message
>> news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
>>> Rick wrote
>>>
>>>
>>>> One way to approach it is to look and see who they are talking to.
>>>> You
>>>> might try grabbing a copy of TCPView from Sysinternals (which has
>>>> since been absorbed by Microsoft at http://************/y82msb ) and
>>>> have it set to autostart. Then watch for your svchost connections
>>>> and use whois to find
>>>> out who it is talking to.
>>>>
>>>> Off the top of my head, I suspect you will find that it is
>>>> Microsoft's
>>>> WGA
>>>> program module that phones home shortly after booting up a Windows
>>>> XP system. Try going here:
>>>>
>>>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
>>>>
>>>> for more info.
>>>>
>>>>
>>>>
>>> XP-AntiSpy is very useful for turning off unwanted M$ crap
>>> http://www.xp-antispy.org/
>>> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
>>> Version 3.96-4 has recently appeared and stops automatic install of
>>> IE7 which is causing problems for many.
>>>
>>
>> Thank you Kurt, Rick and Far Canal.
>>
>> WGA certainly took it's toll on my resources. Decided to stick with
>> it rather than wind back the system to ease the pain of update.
>>
>> The IE7 install seems to have slowed down the PC as well but IE7
>> itself seems to run OK.
>>
>> Time to start working our what is driving SVCHOST sessions. Thanks
>> again,
>>
>> --
>> Steve
>>
>>
> I'm sorry to report that I have tried everything I can think
> of - particularly everything that is different about my
> portable than my desktop (where SAS doesn't drain resources).
>
> Windows update is, and has been, disabled.
> I turned off Windows firewall - seemed to have no effect.
>
> I just spent the last hour using Process Explorer and
> suspending each process to see if it reduced CPU use by SAS
> and the excessive fluctuations. I could not find a process
> that stopped the cpu jumping to 40+ usage, then to 12% and
> right back to 40 something % - sometimes into the 50s.
>
> Whatever this process is, it is happening literally every
> one or two seconds - back and forth.
>
> And, as noted before, it doesn't happen on my desktop.
>
> If anyone has any other suggestions, I'll be happy to try
> them as I'm really very disappointed to find SAS unusable on
> my portable - the machine that is, in fact, much more
> vulnerable because of the traveling it does and the various
> wireless connections I make while traveling.
>
> Is there a more thorough way to track this down?
>
> Thanks.
>
> Louise

For amusement... Would you create a new account on the computer, and see
if SAS does the same?



--
Dustin Cook
Author of BugHunter - MalWare Removal Tool -V1.9.4
web: http://bughunter.it-mate.co.uk
email: bughunter.dustin@gmail.com.removethis
Last updated: November 22nd, 2006

[pcbutts1]

I reported that to him a while ago, see my comparison screen shots.
http://www.pcbutts1.com/downloads/adaware.doc
http://www.pcbutts1.com/downloads/defender.doc
http://www.pcbutts1.com/downloads/ewido.doc
http://www.pcbutts1.com/downloads/superanti.doc



--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
NEW Embedded system W/Linux. We now sell DVR cards.
See it all at http://www.seedsv.com/products.htm
Sharpvision simply the best http://www.seedsv.com



"Dustin Cook" <spamfilterineffect.see.sig@nowhere.com> wrote in message
news:Xns988AD8AB058FFHHI2948AJD832@69.28.186.121.. .
> louise <louise@invalid.invalid> wrote in
> news:4svfk0Frs7amU1@mid.individual.net:
>
>> Steve wrote:
>>> "Far Canal" <me@privacy.net> wrote in message
>>> news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
>>>> Rick wrote
>>>>
>>>>
>>>>> One way to approach it is to look and see who they are talking to.
>>>>> You
>>>>> might try grabbing a copy of TCPView from Sysinternals (which has
>>>>> since been absorbed by Microsoft at http://************/y82msb ) and
>>>>> have it set to autostart. Then watch for your svchost connections
>>>>> and use whois to find
>>>>> out who it is talking to.
>>>>>
>>>>> Off the top of my head, I suspect you will find that it is
>>>>> Microsoft's
>>>>> WGA
>>>>> program module that phones home shortly after booting up a Windows
>>>>> XP system. Try going here:
>>>>>
>>>>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
>>>>>
>>>>> for more info.
>>>>>
>>>>>
>>>>>
>>>> XP-AntiSpy is very useful for turning off unwanted M$ crap
>>>> http://www.xp-antispy.org/
>>>> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
>>>> Version 3.96-4 has recently appeared and stops automatic install of
>>>> IE7 which is causing problems for many.
>>>>
>>>
>>> Thank you Kurt, Rick and Far Canal.
>>>
>>> WGA certainly took it's toll on my resources. Decided to stick with
>>> it rather than wind back the system to ease the pain of update.
>>>
>>> The IE7 install seems to have slowed down the PC as well but IE7
>>> itself seems to run OK.
>>>
>>> Time to start working our what is driving SVCHOST sessions. Thanks
>>> again,
>>>
>>> --
>>> Steve
>>>
>>>
>> I'm sorry to report that I have tried everything I can think
>> of - particularly everything that is different about my
>> portable than my desktop (where SAS doesn't drain resources).
>>
>> Windows update is, and has been, disabled.
>> I turned off Windows firewall - seemed to have no effect.
>>
>> I just spent the last hour using Process Explorer and
>> suspending each process to see if it reduced CPU use by SAS
>> and the excessive fluctuations. I could not find a process
>> that stopped the cpu jumping to 40+ usage, then to 12% and
>> right back to 40 something % - sometimes into the 50s.
>>
>> Whatever this process is, it is happening literally every
>> one or two seconds - back and forth.
>>
>> And, as noted before, it doesn't happen on my desktop.
>>
>> If anyone has any other suggestions, I'll be happy to try
>> them as I'm really very disappointed to find SAS unusable on
>> my portable - the machine that is, in fact, much more
>> vulnerable because of the traveling it does and the various
>> wireless connections I make while traveling.
>>
>> Is there a more thorough way to track this down?
>>
>> Thanks.
>>
>> Louise
>
> For amusement... Would you create a new account on the computer, and see
> if SAS does the same?
>
>
>
> --
> Dustin Cook
> Author of BugHunter - MalWare Removal Tool -V1.9.4
> web: http://bughunter.it-mate.co.uk
> email: bughunter.dustin@gmail.com.removethis
> Last updated: November 22nd, 2006
>

[Nick Skrepetos]

pcbutts1 wrote:
> I reported that to him a while ago, see my comparison screen shots.
> http://www.pcbutts1.com/downloads/adaware.doc
> http://www.pcbutts1.com/downloads/defender.doc
> http://www.pcbutts1.com/downloads/ewido.doc
> http://www.pcbutts1.com/downloads/superanti.doc
>
>
>
When were the screen shots taken, meaning startup, sitting for a long
time, scanning, etc. etc. What version of our software? What else was
running on the system, you can only see a few processes.......

If you are going to post "comparisons", etc. you really need to fully
disclose the systems, etc. I know you are new at this, but it seems
there has been enough discussion in these groups that you would know
you need to provide some additional data here so the "results" have
actual meaning.

Nick Skrepetos
SUPERAntiSpyware.com
http://www.superantispyware.com

[louise]

Dustin Cook wrote:
> louise <louise@invalid.invalid> wrote in
> news:4svfk0Frs7amU1@mid.individual.net:
>
>> Steve wrote:
>>> "Far Canal" <me@privacy.net> wrote in message
>>> news:MPG.1fd3afd4299f9be7989ed6@news.readfreenews. net...
>>>> Rick wrote
>>>>
>>>>
>>>>> One way to approach it is to look and see who they are talking to.
>>>>> You
>>>>> might try grabbing a copy of TCPView from Sysinternals (which has
>>>>> since been absorbed by Microsoft at http://************/y82msb ) and
>>>>> have it set to autostart. Then watch for your svchost connections
>>>>> and use whois to find
>>>>> out who it is talking to.
>>>>>
>>>>> Off the top of my head, I suspect you will find that it is
>>>>> Microsoft's
>>>>> WGA
>>>>> program module that phones home shortly after booting up a Windows
>>>>> XP system. Try going here:
>>>>>
>>>>> http://en.wikipedia.org/wiki/Windows_Genuine_Advantage
>>>>>
>>>>> for more info.
>>>>>
>>>>>
>>>>>
>>>> XP-AntiSpy is very useful for turning off unwanted M$ crap
>>>> http://www.xp-antispy.org/
>>>> Makes it easy to turn parts of it back on for M$ Update. Allegedly.
>>>> Version 3.96-4 has recently appeared and stops automatic install of
>>>> IE7 which is causing problems for many.
>>>>
>>> Thank you Kurt, Rick and Far Canal.
>>>
>>> WGA certainly took it's toll on my resources. Decided to stick with
>>> it rather than wind back the system to ease the pain of update.
>>>
>>> The IE7 install seems to have slowed down the PC as well but IE7
>>> itself seems to run OK.
>>>
>>> Time to start working our what is driving SVCHOST sessions. Thanks
>>> again,
>>>
>>> --
>>> Steve
>>>
>>>
>> I'm sorry to report that I have tried everything I can think
>> of - particularly everything that is different about my
>> portable than my desktop (where SAS doesn't drain resources).
>>
>> Windows update is, and has been, disabled.
>> I turned off Windows firewall - seemed to have no effect.
>>
>> I just spent the last hour using Process Explorer and
>> suspending each process to see if it reduced CPU use by SAS
>> and the excessive fluctuations. I could not find a process
>> that stopped the cpu jumping to 40+ usage, then to 12% and
>> right back to 40 something % - sometimes into the 50s.
>>
>> Whatever this process is, it is happening literally every
>> one or two seconds - back and forth.
>>
>> And, as noted before, it doesn't happen on my desktop.
>>
>> If anyone has any other suggestions, I'll be happy to try
>> them as I'm really very disappointed to find SAS unusable on
>> my portable - the machine that is, in fact, much more
>> vulnerable because of the traveling it does and the various
>> wireless connections I make while traveling.
>>
>> Is there a more thorough way to track this down?
>>
>> Thanks.
>>
>> Louise
>
> For amusement... Would you create a new account on the computer, and see
> if SAS does the same?
>
>
>
What do you mean by "create a new account"?

Louise