0

Hopefully this is a variation on the previous svchost.exe troubleshooting questions.

We initially got reports of slow performance on a number of Windows 7 PCs. Resource Monitor showed that the IP Helper Service was consuming a large amount of CPU time. We disabled the IP Helper Service across the organisation using GP as we don't use any IpV6 transition services.

After disabling IP Helper we continued to receive problem calls. This time Resource Monitor showed that the BITS service was consuming a large amount of CPU time. We can't disable this but instead moved BITS to its own svchost.exe process.

After moving BITS we still continued to receive calls. The User Profile Service (profsvc) is now the culprit! Presumably if we disabled this or moved it to a separate process the problem would move to a different service.

Obviously this is baffling as the problem seems to move from service to service, all within the netsvcs svchost.exe group.

  • Affected machines are Windows 7 SP1 32-bit. Latest Windows Updates installed.
  • This problem occurs at random. It can occur during startup, at the logon screen or when the user is already logged on
  • We've ran various malware scans (SCEP, MalwareBytes, RR) and found nothing.

Any troubleshooting strategies would be appreciated.

Improve this question
9
  • Did you run offline antivirus scanners (like the bootable rescue cd of avira or kaspersky)? Scanning from the running system will not show malware that knows how to hide
    – Dan
    Oct 28, 2015 at 10:05
  • Thanks for the suggestion. I have just ran the Avira Bootable CD on a machine that has had the problem. Unfortunately it did not detect anything.
    – AdamR
    Oct 28, 2015 at 11:23
  • capture a xperf trace (pastebin.com/pgE11HRD - the Win8.1 SDK/WPT works fine with Win7, but not the Win10 one) of the CPU usage and analyze what BITS does. if you need help, share the trace
    – magicandre1981
    Oct 29, 2015 at 5:14
  • If you can, check if the machine has suspicious internet traffic, it's not uncommon to become infected and part of a botnet which is used either to attack others or to send spam.
    – Dan
    Oct 29, 2015 at 7:15
  • Update: I checked for suspicious internet traffic using a WAN analyzer appliance, nothing visible.
    – AdamR
    Oct 29, 2015 at 13:28

1 Answer 1

Reset to default
0

Update: the KB2617858 hotfix does actually resolve this issue. However machines that already have a gigantic WMI repository require the repository to be deleted and recreated. This course of action was advised by Microsoft.

Improve this answer
1
  • If this does indeed fully solve the problem, you should mark this answer as accepted.
    – kasperd
    Dec 3, 2015 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .