Services.exe running at 100% CPU and using 100s of MB of memory – Windows XP SP3



I came across an interesting one in the last few days. This system was a Windows XP system with current updates – SP3, IE 8…. and among other things there was a complaint of very sluggish behavior. I updated the antimalware software installed and ran scans. Malware Bytes antimalware actually found and removed two suspect files, but that didn’t seem to sole the sluggishness. The web browser (internet explorer) would take what seemed like a minute or so to respond to any action. One thing I discovered is that Internet explorer 8 can behave VERY slowly if there are a lot of sites in the restricted zone. (Spybot S&D immunization puts lot’s of sites in restricted zones.) So, I found a way to remove them all and retry and things seemed quicker, but… after running for 15-20 minutes the system really started to become unresponsive and so I had to start looking for another cause…. services.exe was running at 99% cpu or 100% cpu from time to time and the memory footprint was growing – the high mark I saw was 350MB of memory in use for it (!)


The first hint I had was a site claiming that if the event logs get to be too large it could cause services.exe to respond this way – taking up 98% or 99% cpu and more and more memory. So, after attempting to skim the logfiles for any helpfull info, I cleared them and restarted to wait and see what would happen next. It wasn’t long before the same behavior came back.

So, I searched quite a bit online (the even log items didn’t seem to give ANY clues) and found many discussions about the same issue. Most were a bit old (2-3 years), but in one discussion someone mentioned that they disabled the windows firewall and internet connection sharing service and their problem went away. So, I gave this a try and waited….. services.exe remained well behaved for a couple hours.

Not wanting to leave the system without the firewall, I tried resetting the windows firewall to it’s default settings and restarted it as a service. I let the system reboot and sit for a couple hours without the issue recurring. So, hopefully this reset of the windows firewall settings has solved the problem on this machine!

Side notes: Internet Explorer really shouldn’t respond differently if there is 1 site in restricted zones or 5000 – I mean really – Microsoft should address this problem. I do read that apparently there are features in IE 8 that should make spybot’s immunization unnecessary. Also, re: the firewall being the culprit here, it’s not wise to run a windows machine connected directly to the internet without a firewall of some sort. If this problem seems to affect you and resetting the firewall to it’s defaults doesn’t resolve it, you might consider looking at the free software firewalls that are available, or consider a hardware firewall (router) between your machine and the internet.

Utility to remove all sites from restricted zone is available here.

Related Posts

Blog Traffic Exchange Related Posts
  • Making sense of the different versions of Vista Microsoft Vista is now out, the next version of Windows, successor to XP. While Windows XP will continue to receive updates into 2014 there are many that might be eager to upgrade and move to the latest greatest. (Note to those: Service Pack one may be en route THIS calendar......
  • Internet Explorer zero-day This time around, the zero day is related to Internet Explorer and activex... (directanimation specifically). Incidents has a good update on the issue. This is a second exploit, there was another at the end of August, MS has an advisory on the issue. I think a safe bet would be......
  • Remote Tech Support with x11vnc and wrapper script So, the idea is that I wanted something "like" the Ultranvnc Single Click download, only for linux. The main idea being is that if someone is looking for a bit of desktop tech support on linux, we don't need to be giving instructions for 5 different package managers, or source......
Blog Traffic Exchange Related Websites
  • Steadfast Finances was Hacked, Now Restored. (Thanks HostGator!) Last week, several lines of "seemingly malicious code" found its way into SF's theme. This prompted Google, Firefox, Google Chrome and even Twitter, to quickly label this blog as a "Reported Attack Site". If you happened to visit SF from the RSS feed, the email subscriber list, or basically clicked......
  • 10 of the Best Defensive Canadian Stocks Whether we're in a bull or bear market, it always helps to have a portion of your portfolio in defensive stocks, so-called because of the relative protection they offer from price volatility and many business and market risks.  This is not to say that there are no risks involved with......
  • A Look at Globelines DSL Internet Service 2 personal concerns: 1) This is just to let everyone know that Globelines DSL was down from 01-15-2009 to 01-21-2009. According to the Globe customer service-bot, Globelines was undergoing maintenance. But what really was frustrating was the fact that Globelines never informed me of the said downtime beforehand. I put......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site