HELP! intermittent random hang/release, low CPU usage but seeminglyhigh (?) mem usage

Posted: 11-25-2003, 06:48 PM

brosenau[

Guest
Posts: n/a

Hi, so I'm really hoping someone can help me with this...

The problem: at seemingly random times, the system hangs. Something as
simple as scrolling through a file just STOPS. Waiting anywhere from
several seconds to a minute or more usually causes everything to get
back to normal, but these things happen very frequently, often during
very minor tasks with nothing else running. Trying to look at the
properties page of a disk drive involves waiting way longer than on most
systems, as I said, scrolling a file in Visual Studio or even a text
editor sometimes causes this, and any number of other operations do as
well. Sometimes the system marks the program this happens to as "not
responding", but waiting, as I said, generally restores it to normal
operation. Oddly, CPU usage does not tend to be high or go up when this
happens--it may be 3-5% and this still occurs. Memory usage on the
system seems to be a bit high (but I don't really know what it should
be, for an XP system)--with minimal applications running physical memory
available is often around 200-300 MB, out of 512. This seems like a
minor problem, but it's really driving me nuts because it happens so
often. Does anyone have any ideas? I thought about viruses (but don't
have any as near as I can tell) and excessive Spyware running (same),
very fragmented hard disks (but each gets defragged weekly), etc...

System info: I'm running XP Pro SP1 on a dual P3-800 system with 512 MB
ram, two 40GB hard disks (C:, D

connected to the on-motherboard IDE
controller and a 150GB (G

hard disk connected via a Promise Ultra133
TX2 IDE controller. Page files are on the D (1-2 GB) and G (1-4 GB)
drives; the OS and program executables are on the C drive.
StartupTracker info follows:

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce

No Items Found

-- Registry --
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

vptray C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce

No Items Found

-- Registry --
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run

ctfmon.exe C:\WINDOWS\System32\ctfmon.exe

-- Registry --
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce

No Items Found

-- Start Menu - Current User --
No Items Found

-- Start Menu - All Users --
No Items Found

-- Disabled Items --
msmsgs
qttask
Acrobat Assistant
Microsoft Office

-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon --
Explorer.exe

-- Running Processes --
System Idle Process
System
smss.exe \SystemRoot\System32\smss.exe
csrss.exe
winlogon.exe winlogon.exe
services.exe C:\WINDOWS\system32\services.exe
lsass.exe C:\WINDOWS\system32\lsass.exe
svchost.exe C:\WINDOWS\system32\svchost -k rpcss
svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
Crypserv.exe crypserv.exe
DefWatch.exe "C:\Program Files\Symantec_Client_Security\Symantec
AntiVirus\DefWatch.exe"
Rtvscan.exe "C:\Program Files\Symantec_Client_Security\Symantec
AntiVirus\Rtvscan.exe"
RemotSvc.exe "C:\Program Files\Dantz\Client\Remotsvc.exe"
retroclient.exe "C:\Program Files\Dantz\Client\retroclient.exe"
svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
explorer.exe C:\WINDOWS\Explorer.EXE
VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"
ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -Embedding
taskmgr.exe taskmgr.exe
mozilla.exe "C:\Program Files\mozilla.org\Mozilla\mozilla.exe" -mail
StartupTracker3.exe "C:\Documents and Settings\Ben
Rosenau\Desktop\Utilities and
Installers\StartupTracker3\StartupTracker3.exe"
wmiprvse.exe

-- Running Services --

Name: AudioSrv
Description: Manages audio devices for Windows-based programs. If this
service is stopped, audio devices and effects will not function
properly. If this service is disabled, any services that explicitly
depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Browser
Description: Maintains an updated list of computers on the network and
supplies this list to computers designated as browsers. If this service
is stopped, this list will not be updated or maintained. If this service
is disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Crypkey License
Description:
Startup Mode: Auto
Run from: crypserv.exe

Name: CryptSvc
Description: Provides three management services: Catalog Database
Service, which confirms the signatures of Windows files; Protected Root
Service, which adds and removes Trusted Root Certification Authority
certificates from this computer; and Key Service, which helps enroll
this computer for certificates. If this service is stopped, these
management services will not function properly. If this service is
disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: DefWatch
Description:
Startup Mode: Auto
Run from: C:\Program Files\Symantec_Client_Security\Symantec
AntiVirus\DefWatch.exe

Name: Dhcp
Description: Manages network configuration by registering and updating
IP addresses and DNS names.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: dmserver
Description: Detects and monitors new hard disk drives and sends disk
volume information to Logical Disk Manager Administrative Service for
configuration. If this service is stopped, dynamic disk status and
configuration information may become out of date. If this service is
disabled, any services that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Dnscache
Description: Resolves and caches Domain Name System (DNS) names for this
computer. If this service is stopped, this computer will not be able to
resolve DNS names and locate Active Directory domain controllers. If
this service is disabled, any services that explicitly depend on it will
fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService

Name: ERSvc
Description: Allows error reporting for services and applictions running
in non-standard environments.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Eventlog
Description: Enables event log messages issued by Windows-based programs
and components to be viewed in Event Viewer. This service cannot be stopped.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\services.exe

Name: EventSystem
Description: Supports System Event Notification Service (SENS), which
provides automatic distribution of events to subscribing Component
Object Model (COM) components. If the service is stopped, SENS will
close and will not be able to provide logon and logoff notifications. If
this service is disabled, any services that explicitly depend on it will
fail to start.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: FastUserSwitchingCompatibility
Description: Provides management for applications that require
assistance in a multiple user environment.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: helpsvc
Description: Enables Help and Support Center to run on this computer. If
this service is stopped, Help and Support Center will be unavailable. If
this service is disabled, any services that explicitly depend on it will
fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: lanmanserver
Description: Supports file, print, and named-pipe sharing over the
network for this computer. If this service is stopped, these functions
will be unavailable. If this service is disabled, any services that
explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: lanmanworkstation
Description: Creates and maintains client network connections to remote
servers. If this service is stopped, these connections will be
unavailable. If this service is disabled, any services that explicitly
depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: LmHosts
Description: Enables support for NetBIOS over TCP/IP (NetBT) service and
NetBIOS name resolution.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: Messenger
Description: Transmits net send and Alerter service messages between
clients and servers. This service is not related to Windows Messenger.
If this service is stopped, Alerter messages will not be transmitted. If
this service is disabled, any services that explicitly depend on it will
fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Netman
Description: Manages objects in the Network and Dial-Up Connections
folder, in which you can view both local area network and remote
connections.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Nla
Description: Collects and stores network configuration and location
information, and notifies applications when this information changes.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Norton AntiVirus Server
Description:
Startup Mode: Auto
Run from: C:\Program Files\Symantec_Client_Security\Symantec
AntiVirus\Rtvscan.exe

Name: PlugPlay
Description: Enables a computer to recognize and adapt to hardware
changes with little or no user input. Stopping or disabling this service
will result in system instability.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\services.exe

Name: PolicyAgent
Description: Manages IP security policy and starts the ISAKMP/Oakley
(IKE) and the IP security driver.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\lsass.exe

Name: ProtectedStorage
Description: Provides protected storage for sensitive data, such as
private keys, to prevent access by unauthorized services, processes, or
users.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\lsass.exe

Name: RemoteRegistry
Description: Enables remote users to modify registry settings on this
computer. If this service is stopped, the registry can be modified only
by users on this computer. If this service is disabled, any services
that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k LocalService

Name: Retrospect Client
Description:
Startup Mode: Auto
Run from: C:\Program Files\Dantz\Client\Remotsvc.exe

Name: RpcSs
Description: Provides the endpoint mapper and other miscellaneous RPC
services.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost -k rpcss

Name: SamSs
Description: Stores security information for local user accounts.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\lsass.exe

Name: Schedule
Description: Enables a user to configure and schedule automated tasks on
this computer. If this service is stopped, these tasks will not be run
at their scheduled times. If this service is disabled, any services that
explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: seclogon
Description: Enables starting processes under alternate credentials. If
this service is stopped, this type of logon access will be unavailable.
If this service is disabled, any services that explicitly depend on it
will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SENS
Description: Tracks system events such as Windows logon, network, and
power events. Notifies COM+ Event System subscribers of these events.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: ShellHWDetection
Description:
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: Spooler
Description: Loads files to memory for later printing.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\spoolsv.exe

Name: srservice
Description: Performs system restore functions. To stop service, turn
off System Restore from the System Restore tab in My Computer->Properties
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: SSDPSRV
Description: Enables discovery of UPnP devices on your home network.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: stisvc
Description: Provides image acquisition services for scanners and cameras.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc

Name: TermService
Description: Allows multiple users to be connected interactively to a
machine as well as the display of desktops and applications to remote
computers. The underpinning of Remote Desktop (including RD for
Administrators), Fast User Switching, Remote Assistance, and Terminal
Server.
Startup Mode: Manual
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: TrkWks
Description: Maintains links between NTFS files within a computer or
across computers in a network domain.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: uploadmgr
Description: Manages synchronous and asynchronous file transfers between
clients and servers on the network. If this service is stopped,
synchronous and asynchronous file transfers between clients and servers
on the network will not occur. If this service is disabled, any services
that explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: W32Time
Description: Maintains date and time synchronization on all clients and
servers in the network. If this service is stopped, date and time
synchronization will be unavailable. If this service is disabled, any
services that explicitly depend on it will fail to start.

Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

Name: WebClient
Description: Enables Windows-based programs to create, access, and
modify Internet-based files. If this service is stopped, these functions
will not be available. If this service is disabled, any services that
explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k LocalService

Name: winmgmt
Description: Provides a common interface and object model to access
management information about operating system, devices, applications and
services. If this service is stopped, most Windows-based software will
not function properly. If this service is disabled, any services that
explicitly depend on it will fail to start.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: wuauserv
Description: Enables the download and installation of critical Windows
updates. If the service is disabled, the operating system can be
manually updated at the Windows Update Web site.
Startup Mode: Auto
Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs

Name: WZCSVC
Description: Provides automatic configuration for the 802.11 adapters
Startup Mode: Auto
Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs

THANKS!!!
Ben Rosenau

HELP! intermittent random hang/release, low CPU usage but seeminglyhigh (?) mem usage

Responses to "HELP! intermittent random hang/release, low CPU usage but seeminglyhigh (?) mem usage"

Tom Swift

Guest
Posts: n/a

Re: HELP! intermittent random hang/release, low CPU usage but seemingly high (?) mem usage

Posted: 11-25-2003, 07:28 PM

"I thought about viruses (but don't have any as near as I can tell)..."
You mean, your virus scanner isn't sure?

"...and excessive Spyware running."
Is there a certain level of spyware that is acceptable to you?

May I suggest, as a first step, that you 1) be very certain that you are
not infected with a virus, and 2) that you remove all spyware from your
system.

Tom Swift

"brosenau[" <"brosenau["@]jhu.edu> wrote in message
news:%23kMIc04sDHA.2492@TK2MSFTNGP12.phx.gbl...

> Hi, so I'm really hoping someone can help me with this...
>
> The problem: at seemingly random times, the system hangs. Something as
> simple as scrolling through a file just STOPS. Waiting anywhere from
> several seconds to a minute or more usually causes everything to get
> back to normal, but these things happen very frequently, often during
> very minor tasks with nothing else running. Trying to look at the
> properties page of a disk drive involves waiting way longer than on most
> systems, as I said, scrolling a file in Visual Studio or even a text
> editor sometimes causes this, and any number of other operations do as
> well. Sometimes the system marks the program this happens to as "not
> responding", but waiting, as I said, generally restores it to normal
> operation. Oddly, CPU usage does not tend to be high or go up when this
> happens--it may be 3-5% and this still occurs. Memory usage on the
> system seems to be a bit high (but I don't really know what it should
> be, for an XP system)--with minimal applications running physical memory
> available is often around 200-300 MB, out of 512. This seems like a
> minor problem, but it's really driving me nuts because it happens so
> often. Does anyone have any ideas? I thought about viruses (but don't
> have any as near as I can tell) and excessive Spyware running (same),
> very fragmented hard disks (but each gets defragged weekly), etc...
>
> System info: I'm running XP Pro SP1 on a dual P3-800 system with 512 MB
> ram, two 40GB hard disks (C:, D connected to the on-motherboard IDE
> controller and a 150GB (G hard disk connected via a Promise Ultra133
> TX2 IDE controller. Page files are on the D (1-2 GB) and G (1-4 GB)
> drives; the OS and program executables are on the C drive.
> StartupTracker info follows:
>
> -- Registry --
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce
>
> No Items Found
>
> -- Registry --
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
>
> vptray C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
>
> -- Registry --
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce
>
> No Items Found
>
> -- Registry --
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
>
> ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
>
> -- Registry --
> HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce
>
> No Items Found
>
> -- Start Menu - Current User --
> No Items Found
>
> -- Start Menu - All Users --
> No Items Found
>
> -- Disabled Items --
> msmsgs
> qttask
> Acrobat Assistant
> Microsoft Office
>
> -- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon --
> Explorer.exe
>
> -- Running Processes --
> System Idle Process
> System
> smss.exe \SystemRoot\System32\smss.exe
> csrss.exe
> winlogon.exe winlogon.exe
> services.exe C:\WINDOWS\system32\services.exe
> lsass.exe C:\WINDOWS\system32\lsass.exe
> svchost.exe C:\WINDOWS\system32\svchost -k rpcss
> svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
> svchost.exe
> svchost.exe
> spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
> Crypserv.exe crypserv.exe
> DefWatch.exe "C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\DefWatch.exe"
> Rtvscan.exe "C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\Rtvscan.exe"
> RemotSvc.exe "C:\Program Files\Dantz\Client\Remotsvc.exe"
> retroclient.exe "C:\Program Files\Dantz\Client\retroclient.exe"
> svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
> explorer.exe C:\WINDOWS\Explorer.EXE
> VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"
> ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
> wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -Embedding
> taskmgr.exe taskmgr.exe
> mozilla.exe "C:\Program

Files\mozilla.org\Mozilla\mozilla.exe" -mail

> StartupTracker3.exe "C:\Documents and Settings\Ben
> Rosenau\Desktop\Utilities and
> Installers\StartupTracker3\StartupTracker3.exe"
> wmiprvse.exe
>
> -- Running Services --
>
> Name: AudioSrv
> Description: Manages audio devices for Windows-based programs. If this
> service is stopped, audio devices and effects will not function
> properly. If this service is disabled, any services that explicitly
> depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Browser
> Description: Maintains an updated list of computers on the network and
> supplies this list to computers designated as browsers. If this service
> is stopped, this list will not be updated or maintained. If this service
> is disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Crypkey License
> Description:
> Startup Mode: Auto
> Run from: crypserv.exe
>
> Name: CryptSvc
> Description: Provides three management services: Catalog Database
> Service, which confirms the signatures of Windows files; Protected Root
> Service, which adds and removes Trusted Root Certification Authority
> certificates from this computer; and Key Service, which helps enroll
> this computer for certificates. If this service is stopped, these
> management services will not function properly. If this service is
> disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: DefWatch
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\DefWatch.exe
>
> Name: Dhcp
> Description: Manages network configuration by registering and updating
> IP addresses and DNS names.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: dmserver
> Description: Detects and monitors new hard disk drives and sends disk
> volume information to Logical Disk Manager Administrative Service for
> configuration. If this service is stopped, dynamic disk status and
> configuration information may become out of date. If this service is
> disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Dnscache
> Description: Resolves and caches Domain Name System (DNS) names for this
> computer. If this service is stopped, this computer will not be able to
> resolve DNS names and locate Active Directory domain controllers. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService
>
> Name: ERSvc
> Description: Allows error reporting for services and applictions running
> in non-standard environments.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Eventlog
> Description: Enables event log messages issued by Windows-based programs
> and components to be viewed in Event Viewer. This service cannot be

stopped.

> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\services.exe
>
> Name: EventSystem
> Description: Supports System Event Notification Service (SENS), which
> provides automatic distribution of events to subscribing Component
> Object Model (COM) components. If the service is stopped, SENS will
> close and will not be able to provide logon and logoff notifications. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: FastUserSwitchingCompatibility
> Description: Provides management for applications that require
> assistance in a multiple user environment.
> StartupMode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: helpsvc
> Description: Enables Help and Support Center to run on this computer. If
> this service is stopped, Help and Support Center will be unavailable. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: lanmanserver
> Description: Supports file, print, and named-pipe sharing over the
> network for this computer. If this service is stopped, these functions
> will be unavailable. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: lanmanworkstation
> Description: Creates and maintains client network connections to remote
> servers. If this service is stopped, these connections will be
> unavailable. If this service is disabled, any services that explicitly
> depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: LmHosts
> Description: Enables support for NetBIOS over TCP/IP (NetBT) service and
> NetBIOS name resolution.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: Messenger
> Description: Transmits net send and Alerter service messages between
> clients and servers. This service is not related to Windows Messenger.
> If this service is stopped, Alerter messages will not be transmitted. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Netman
> Description: Manages objects in the Network and Dial-Up Connections
> folder, in which you can view both local area network and remote
> connections.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Nla
> Description: Collects and stores network configuration and location
> information, and notifies applications when this information changes.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Norton AntiVirus Server
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\Rtvscan.exe
>
> Name: PlugPlay
> Description: Enables a computer to recognize and adapt to hardware
> changes with little or no user input. Stopping or disabling this service
> will result in system instability.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\services.exe
>
> Name: PolicyAgent
> Description: Manages IP security policy and starts the ISAKMP/Oakley
> (IKE) and the IP security driver.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\lsass.exe
>
> Name: ProtectedStorage
> Description: Provides protected storage for sensitive data, such as
> private keys, to prevent access by unauthorized services, processes, or
> users.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\lsass.exe
>
> Name: RemoteRegistry
> Description: Enables remote users to modify registry settings on this
> computer. If this service is stopped, the registry can be modified only
> by users on this computer. If this service is disabled, any services
> that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k LocalService
>
> Name: Retrospect Client
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Dantz\Client\Remotsvc.exe
>
> Name: RpcSs
> Description: Provides the endpoint mapper and other miscellaneous RPC
> services.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost -k rpcss
>
> Name: SamSs
> Description: Stores security information for local user accounts.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\lsass.exe
>
> Name: Schedule
> Description: Enables a user to configure and schedule automated tasks on
> this computer. If this service is stopped, these tasks will not be run
> at their scheduled times. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: seclogon
> Description: Enables starting processes under alternate credentials. If
> this service is stopped, this type of logon access will be unavailable.
> If this service is disabled, any services that explicitly depend on it
> will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: SENS
> Description: Tracks system events such as Windows logon, network, and
> power events. Notifies COM+ Event System subscribers of these events.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: ShellHWDetection
> Description:
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Spooler
> Description: Loads files to memory for later printing.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\spoolsv.exe
>
> Name: srservice
> Description: Performs system restore functions. To stop service, turn
> off System Restore from the System Restore tab in My Computer->Properties
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: SSDPSRV
> Description: Enables discovery of UPnP devices on your home network.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: stisvc
> Description: Provides image acquisition services for scanners and cameras.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc
>
> Name: TermService
> Description: Allows multiple users to be connected interactively to a
> machine as well as the display of desktops and applications to remote
> computers. The underpinning of Remote Desktop (including RD for
> Administrators), Fast User Switching, Remote Assistance, and Terminal
> Server.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: TrkWks
> Description: Maintains links between NTFS files within a computer or
> across computers in a network domain.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: uploadmgr
> Description: Manages synchronous and asynchronous file transfers between
> clients and servers on the network. If this service is stopped,
> synchronous and asynchronous file transfers between clients and servers
> on the network will not occur. If this service is disabled, any services
> that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: W32Time
> Description: Maintains date and time synchronization on all clients and
> servers in the network. If this service is stopped, date and time
> synchronization will be unavailable. If this service is disabled, any
> services that explicitly depend on it will fail to start.
>
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: WebClient
> Description: Enables Windows-based programs to create, access, and
> modify Internet-based files. If this service is stopped, these functions
> will not be available. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: winmgmt
> Description: Provides a common interface and object model to access
> management information about operating system, devices, applications and
> services. If this service is stopped, most Windows-based software will
> not function properly. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: wuauserv
> Description: Enables the download and installation of critical Windows
> updates. If the service is disabled, the operating system can be
> manually updated at the Windows Update Web site.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: WZCSVC
> Description: Provides automatic configuration for the 802.11 adapters
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>
>
>
> THANKS!!!
> Ben Rosenau
>

brosenau[

Guest
Posts: n/a

Re: HELP! intermittent random hang/release, low CPU usage but seeminglyhigh (?) mem usage

Posted: 11-25-2003, 08:29 PM

Sorry, I guess I wasn't terribly clear though. I have absolutely no
viruses so far as I can trust NAV w/ the latest definitions; I have no
spyware so far as I can trust Ad-aware with its latest updates. I run
full scans with both once a week (using task scheduler), and have NAV
running real time protection constantly. It is possible that some
adware/spyware gets on the comp between scans, but this is a long term
problem, so presumably anything less than a week old is not the cause of
the problem.

Further compter info, if it will spark any ideas in anyone:
Sandra results :

System Summary

Mainboard Information

CPU1 Fan Speed 1896rpm
CPU2 Fan Speed 1918rpm
Notice 224 SMBIOS/DMI information may be inaccurate.
Warning 2508 All memory slots are full. Upgrading the memory may be
difficult or expensive.
Warning 2519 One of the system fans has failed or is spinning too slowly.

CPU and BIOS Information

CPU1 Fan Speed 1875rpm
Tip 210 Processor 1 : Mainboard supports faster CPUs, so the CPU can be
upgraded when needed.
Notice 224 Processor 1 : SMBIOS/DMI information may be inaccurate.
Warning 216 Processor 1 : CPU fan has failed! Check it.
CPU2 Fan Speed 1918rpm
Tip 210 Processor 2 : Mainboard supports faster CPUs, so the CPU can be
upgraded when needed.
Notice 224 Processor 2 : SMBIOS/DMI information may be inaccurate.
Warning 216 Processor 2 : CPU fan has failed! Check it.
Warning 236 Processor 2 : Vcore higher than rated maximum. Check Vcore
setting!
Notice 224 System BIOS : SMBIOS/DMI information may be inaccurate.
Tip 212 System BIOS : BIOS can be shadowed so check whether it is.
Warning 214 System BIOS : BIOS is flash-able but surface-mounted. An
unsuccessful flash may be fatal.

APM and ACPI Information

Notice 224 SMBIOS/DMI information may be inaccurate.

PCI, AGP, CardBus Bus(es) Information

Video System Information

Tip 314 Primary Display Driver (display) : Video BIOS is too old. Check
for an update.
Tip 322 Primary Display Driver (display) : Turn off screen savers. Use
the monitor power saving mode.
Tip 323 Primary Display Driver (display) : Remove the desktop wallpaper
to save memory and improve performance.
Tip 314 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : Video BIOS is too old. Check for an update.
Tip 322 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : Turn off screen savers. Use the monitor power saving mode.
Tip 323 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : Remove the desktop wallpaper to save memory and improve
performance.
Tip 314 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : Video BIOS is too old. Check for an update.
Tip 322 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : Turn off screen savers. Use the monitor power saving mode.
Tip 323 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : Remove the desktop wallpaper to save memory and improve
performance.

Windows Memory Information

Tip 2004 Page file is too large. The page file should be maximum 2.5
times system memory.

Drives Information

Warning 1.44MB 3.5" (A

: Cannot obtain drive information; check that
a disk is in the drive and it is correctly formatted.
Tip 1821 Hard Disk (C

: Label (name) drive.
Tip 1821 Hard Disk (D

: Label (name) drive.
Warning Removable Drive (E

: Cannot obtain drive information; check
that a disk is in the drive and it is correctly formatted.
Warning CD-ROM/DVD (F

: Cannot obtain drive information; check that a
disk is in the drive and it is correctly formatted.
Tip 1821 Hard Disk (G

: Label (name) drive.

Ports Information

Keyboard Information

Mouse Information

Sound Card Information

Printer and Fax Information

Tip 401 Acrobat PDFWriter : Printer resolution may have been set too
low. Check settings.
Tip 402 Acrobat PDFWriter : Print quality may have been set too low.
Check settings.

MCI Devices Information

Windows Information

WinSock Information

Processes Information

Tip 1601 SiSoftware Sandra : Program consumes a large amount of memory.

Modules Information

DirectX Information

Warning 2207 Primary Display Driver (display) : Video card does not
have 3D accelerated hardware. Consider upgrading.
Tip 2212 Primary Display Driver (display) : No hardware stretch support.
Tip 2213 Primary Display Driver (display) : No hardware overlay support.
Tip 2216 Primary Display Driver (display) : No Z-buffering support.
Warning 2211 Primary Display Driver (display) : No hardware
colour-space conversion support.
Warning 2207 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : Video card does not have 3D accelerated hardware.
Consider upgrading.
Tip 2212 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : No hardware stretch support.
Tip 2213 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : No hardware overlay support.
Tip 2216 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : No Z-buffering support.
Warning 2211 Matrox Millennium G400 DualHead Max (\\.\DISPLAY1) @
\\.\DISPLAY1 : No hardware colour-space conversion support.
Warning 2207 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : Video card does not have 3D accelerated hardware.
Consider upgrading.
Tip 2212 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : No hardware stretch support.
Tip 2213 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : No hardware overlay support.
Tip 2216 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : No Z-buffering support.
Warning 2211 Matrox Millennium G400 DualHead Max (\\.\DISPLAY2) @
\\.\DISPLAY2 : No hardware colour-space conversion support.

Font Information

OpenGL Video Information

Tip 312 OpenGL support may be required for 3D rendering applications or
games. Install OpenGL.

Services Information

Tip 2130 Error Reporting Service : Service may be disabled on
Home/Professional OS version.
Tip 2130 Help and Support : Service may be disabled on
Home/Professional OS version.
Tip 2130 Messenger : Service may be disabled on Home/Professional OS
version.
Tip 2130 IPSEC Services : Service may be disabled on Home/Professional
OS version.
Tip 2130 Remote Registry : Service may be disabled on Home/Professional
OS version.
Tip 2130 Secondary Logon : Service may be disabled on Home/Professional
OS version.
Tip 2130 Windows Image Acquisition (WIA) : Service may be disabled on
Home/Professional OS version.
Tip 2130 Distributed Link Tracking Client : Service may be disabled on
Home/Professional OS version.

ATA/ATAPI Information

Warning 3103 ATA device (fixed) : Acoustic Management enabled.
Peformance may be impaired.
Warning 3104 ATA device (fixed) : Current mode not optimal. Check settings.
Warning 3103 ATA device (fixed) : Acoustic Management enabled.
Peformance may be impaired.
Warning 3104 ATA device (fixed) : Current mode not optimal. Check settings.

Tom Swift wrote:

> "I thought about viruses (but don't have any as near as I can tell)..."
> You mean, your virus scanner isn't sure?
>
> "...and excessive Spyware running."
> Is there a certain level of spyware that is acceptable to you?
>
> May I suggest, as a first step, that you 1) be very certain that you are
> not infected with a virus, and 2) that you remove all spyware from your
> system.
>
> Tom Swift
>
> "brosenau[" <"brosenau["@]jhu.edu> wrote in message
> news:%23kMIc04sDHA.2492@TK2MSFTNGP12.phx.gbl...
>
>>Hi, so I'm really hoping someone can help me with this...
>>
>>The problem: at seemingly random times, the system hangs. Something as
>>simple as scrolling through a file just STOPS. Waiting anywhere from
>>several seconds to a minute or more usually causes everything to get
>>back to normal, but these things happen very frequently, often during
>>very minor tasks with nothing else running. Trying to look at the
>>properties page of a disk drive involves waiting way longer than on most
>>systems, as I said, scrolling a file in Visual Studio or even a text
>>editor sometimes causes this, and any number of other operations do as
>>well. Sometimes the system marks the program this happens to as "not
>>responding", but waiting, as I said, generally restores it to normal
>>operation. Oddly, CPU usage does not tend to be high or go up when this
>>happens--it may be 3-5% and this still occurs. Memory usage on the
>>system seems to be a bit high (but I don't really know what it should
>>be, for an XP system)--with minimal applications running physical memory
>>available is often around 200-300 MB, out of 512. This seems like a
>>minor problem, but it's really driving me nuts because it happens so
>>often. Does anyone have any ideas? I thought about viruses (but don't
>>have any as near as I can tell) and excessive Spyware running (same),
>>very fragmented hard disks (but each gets defragged weekly), etc...
>>
>>System info: I'm running XP Pro SP1 on a dual P3-800 system with 512 MB
>>ram, two 40GB hard disks (C:, D connected to the on-motherboard IDE
>>controller and a 150GB (G hard disk connected via a Promise Ultra133
>>TX2 IDE controller. Page files are on the D (1-2 GB) and G (1-4 GB)
>>drives; the OS and program executables are on the C drive.
>>StartupTracker info follows:
>>
>>-- Registry --
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu rrentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Registry --
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu rrentVersion\Run
>>
>>vptray C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
>>
>>-- Registry --
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\Cur rentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Registry --
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\Cur rentVersion\Run
>>
>>ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
>>
>>-- Registry --
>>HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\C urrentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Start Menu - Current User --
>>No Items Found
>>
>>-- Start Menu - All Users --
>>No Items Found
>>
>>-- Disabled Items --
>>msmsgs
>>qttask
>>Acrobat Assistant
>>Microsoft Office
>>
>>-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows
>>NT\CurrentVersion\Winlogon --
>>Explorer.exe
>>
>>-- Running Processes --
>>System Idle Process
>>System
>>smss.exe \SystemRoot\System32\smss.exe
>>csrss.exe
>>winlogon.exe winlogon.exe
>>services.exe C:\WINDOWS\system32\services.exe
>>lsass.exe C:\WINDOWS\system32\lsass.exe
>>svchost.exe C:\WINDOWS\system32\svchost -k rpcss
>>svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
>>svchost.exe
>>svchost.exe
>>spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
>>Crypserv.exe crypserv.exe
>>DefWatch.exe "C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\DefWatch.exe"
>>Rtvscan.exe "C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\Rtvscan.exe"
>>RemotSvc.exe "C:\Program Files\Dantz\Client\Remotsvc.exe"
>>retroclient.exe "C:\Program Files\Dantz\Client\retroclient.exe"
>>svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
>>explorer.exe C:\WINDOWS\Explorer.EXE
>>VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"
>>ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
>>wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -Embedding
>>taskmgr.exe taskmgr.exe
>>mozilla.exe "C:\Program
>
> Files\mozilla.org\Mozilla\mozilla.exe" -mail
>
>>StartupTracker3.exe "C:\Documents and Settings\Ben
>>Rosenau\Desktop\Utilities and
>>Installers\StartupTracker3\StartupTracker3.exe "
>>wmiprvse.exe
>>
>>-- Running Services --
>>
>>Name: AudioSrv
>>Description: Manages audio devices for Windows-based programs. If this
>>service is stopped, audio devices and effets will not function
>>properly. If this service is disabled, any services that explicitly
>>depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Browser
>>Description: Maintains an updated list of computers on the network and
>>supplies this list to computers designated as browsers. If this service
>>is stopped, this list will not be updated or maintained. If this service
>>is disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Crypkey License
>>Description:
>>Startup Mode: Auto
>>Run from: crypserv.exe
>>
>>Name: CryptSvc
>>Description: Provides three management services: Catalog Database
>>Service, which confirms the signatures of Windows files; Protected Root
>>Service, which adds and removes Trusted Root Certification Authority
>>certificates from this computer; and Key Service, which helps enroll
>>this computer for certificates. If this service is stopped, these
>>management services will not function properly. If this service is
>>disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: DefWatch
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\DefWatch.exe
>>
>>Name: Dhcp
>>Description: Manages network configuration by registering and updating
>>IP addresses and DNS names.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: dmserver
>>Description: Detects and monitors new hard disk drives and sends disk
>>volume information to Logical Disk Manager Administrative Service for
>>configuration. If this service is stopped, dynamic disk status and
>>configuration information may become out of date. If this service is
>>disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Dnscache
>>Description: Resolves and caches Domain Name System (DNS) names for this
>>computer. If this service is stopped, this computer will not be able to
>>resolve DNS names and locate Active Directory domain controllers. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService
>>
>>Name: ERSvc
>>Description: Allows error reporting for services and applictions running
>>in non-standard environments.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Eventlog
>>Description: Enables event log messages issued by Windows-based programs
>>and components to be viewed in Event Viewer. This service cannot be
>
> stopped.
>
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\services.exe
>>
>>Name: EventSystem
>>Description: Supports System Event Notification Service (SENS), which
>>provides automatic distribution of events to subscribing Component
>>Object Model (COM) components. If the service is stopped, SENS will
>>close and will not be able to provide logon and logoff notifications. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: FastUserSwitchingCompatibility
>>Description: Provides management for applications that require
>>assistance in a multiple user environment.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: helpsvc
>>Description: Enables Help and Support Center to run on this computer. If
>>this service is stopped, Help and Support Center will be unavailable. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: lanmanserver
>>Description: Supports file, print, and named-pipe sharing over the
>>network for this computer. If this service is stopped, these functions
>>will be unavailable. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: lanmanworkstation
>>Description: Creates and maintains client network connections to remote
>>servers. If this service is stopped, these connections will be
>>unavailable. If this service is disabled, any services that explicitly
>>depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: LmHosts
>>Description: Enables support for NetBIOS over TCP/IP (NetBT) service and
>>NetBIOS name resolution.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: Messenger
>>Description: Transmits net send and Alerter service messages between
>>clients and servers. This service is not related to Windows Messenger.
>>If this service is stopped, Alerter messages will not be transmitted. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Netman
>>Description: Manages objects in the Network and Dial-Up Connections
>>folder, in which you can view both local area network and remote
>>connections.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Nla
>>Description: Collects and stores network configuration and location
>>information, and notifies applications when this information changes.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Norton AntiVirus Server
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\Rtvscan.exe
>>
>>Name: PlugPlay
>>Description: Enables a computer to recognize and adapt to hardware
>>changes with little or no user input. Stopping or disabling this service
>>will result in system instability.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\services.exe
>>
>>Name: PolicyAgent
>>Description: Manages IP security policy and starts the ISAKMP/Oakley
>>(IKE) and the IP security driver.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\lsass.exe
>>
>>Name: ProtectedStorage
>>Description: Provides protected storage for sensitive data, such as
>>private keys, to prevent access by unauthorized services, processes, or
>>users.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\lsass.exe
>>
>>Name: RemoteRegistry
>>Description: Enables remote users to modify registry settings on this
>>computer. If this service is stopped, the registry can be modified only
>>by users on this computer. If this service is disabled, any services
>>that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k LocalService
>>
>>Name: Retrospect Client
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Dantz\Client\Remotsvc.exe
>>
>>Name: RpcSs
>>Description: Provides the endpoint mapper and other miscellaneous RPC
>>services.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost -k rpcss
>>
>>Name: SamSs
>>Description: Stores security information for local user accounts.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\lsass.exe
>>
>>Name: Schedule
>>Description: Enables a user to configure and schedule automated tasks on
>>this computer. If this service is stopped, these tasks will not be run
>>at their scheduled times. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: seclogon
>>Description: Enables starting processes under alternate credentials. If
>>this service is stopped, this type of logon access will be unavailable.
>>If this service is disabled, any services that explicitly depend on it
>>will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: SENS
>>Description: Tracks system events such as Windows logon, network, and
>>power events. Notifies COM+ Event System subscribers of these events.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: ShellHWDetection
>>Description:
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Spooler
>>Description: Loads files to memory for later printing.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\spoolsv.exe
>>
>>Name: srservice
>>Description: Performs system restore functions. To stop service, turn
>>off System Restore from the System Restore tab in My Computer->Properties
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: SSDPSRV
>>Description: Enables discovery of UPnP devices on your home network.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: stisvc
>>Description: Provides image acquisition services for scanners and cameras.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc
>>
>>Name: TermService
>>Description: Allows multiple users to be connected interactively to a
>>machine as well as the display of desktops and applications to remote
>>computers. The underpinning of Remote Desktop (including RD for
>>Administrators), Fast User Switching, Remote Assistance, and Terminal
>>Server.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: TrkWks
>>Description: Maintains links between NTFS files within a computer or
>>across computers in a network domain.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: uploadmgr
>>Description: Manages synchronous and asynchronous file transfers between
>>clients and servers on the network. If this service is stopped,
>>synchronous and asynchronous file transfers between clients and servers
>>on the network will not occur. If this service is disabled, any services
>>that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: W32Time
>>Description: Maintains date and time synchronization on all clients and
>>servers in the network. If this service is stopped, date and time
>>synchronization will be unavailable. If this service is disabled, any
>>services that explicitly depend on it will fail to start.
>>
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: WebClient
>>Description: Enables Windows-based programs to create, access, and
>>modify Internet-based files. If this service is stopped, these functions
>>will not be available. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: winmgmt
>>Description: Provides a common interface and object model to access
>>management information about operating system, devices, applications and
>>services. If this service is stopped, most Windows-based software will
>>not function properly. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: wuauserv
>>Description: Enables the download and installation of critical Windows
>>updates. If the service is disabled, the operating system can be
>>manually updated at the Windows Update Web site.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: WZCSVC
>>Description: Provides automatic configuration for the 802.11 adapters
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>
>>
>>
>>THANKS!!!
>>Ben Rosenau
>>
>
>
>

Bill

Guest
Posts: n/a

HELP! intermittent random hang/release, low CPU usage but seemingly high (?) mem usage

Posted: 11-29-2003, 02:36 AM

I agree with the two suggestions in your reply from
T.Swift. To remove spyware you might consider 'SpyBot'
(find via Google). When I turn on the computer in the
morning I start Spybot and then head for the coffee pot.
Bill

>-----Original Message-----
>Hi, so I'm really hoping someone can help me with this...
>
>The problem: at seemingly random times, the system

hangs. Something as

>simple as scrolling through a file just STOPS. Waiting

anywhere from

>several seconds to a minute or more usually causes

everything to get

>back to normal, but these things happen very frequently,

often during

>very minor tasks with nothing else running. Trying to

look at the

>properties page of a disk drive involves waiting way

longer than on most

>systems, as I said, scrolling a file in Visual Studio or

even a text

>editor sometimes causes this, and any number of other

operations do as

>well. Sometimes the system marks the program this

happens to as "not

>responding", but waiting, as I said, generally restores

it to normal

>operation. Oddly, CPU usage does not tend to be high or

go up when this

>happens--it may be 3-5% and this still occurs. Memory

usage on the

>system seems to be a bit high (but I don't really know

what it should

>be, for an XP system)--with minimal applications running

physical memory

>available is often around 200-300 MB, out of 512. This

seems like a

>minor problem, but it's really driving me nuts because it

happens so

>often. Does anyone have any ideas? I thought about

viruses (but don't

>have any as near as I can tell) and excessive Spyware

running (same),

>very fragmented hard disks (but each gets defragged

weekly), etc...

>
>System info: I'm running XP Pro SP1 on a dual P3-800

system with 512 MB

>ram, two 40GB hard disks (C:, D connected to the on-

motherboard IDE

>controller and a 150GB (G hard disk connected via a

Promise Ultra133

>TX2 IDE controller. Page files are on the D (1-2 GB) and

G (1-4 GB)

>drives; the OS and program executables are on the C

drive.

>StartupTracker info follows:
>
>-- Registry --
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersi

on\RunOnce

>
>No Items Found
>
>-- Registry --
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersi

on\Run

>
>vptray C:\PROGRA~1\SYMANT~1

\SYMANT~1\vptray.exe

>
>-- Registry --
>HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersio

n\RunOnce

>
>No Items Found
>
>-- Registry --
>HKEY_CURRENT_USER\Software\Microsoft\Windows\Curr entVersio

n\Run

>
>ctfmon.exe C:\WINDOWS\System32

\ctfmon.exe

>
>-- Registry --
>HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cu rrentVers

ion\RunOnce

>
>No Items Found
>
>-- Start Menu - Current User --
>No Items Found
>
>-- Start Menu - All Users --
>No Items Found
>
>-- Disabled Items --
>msmsgs
>qttask
>Acrobat Assistant
>Microsoft Office
>
>-- Registry - Shell Value -

HKLM\SOFTWARE\Microsoft\Windows

>NT\CurrentVersion\Winlogon --
>Explorer.exe
>
>-- Running Processes --
>System Idle Process
>System
>smss.exe \SystemRoot\System32\smss.exe
>csrss.exe
>winlogon.exe winlogon.exe
>services.exe C:\WINDOWS\system32\services.exe
>lsass.exe C:\WINDOWS\system32\lsass.exe
>svchost.exe C:\WINDOWS\system32\svchost -k rpcss
>svchost.exe C:\WINDOWS\System32\svchost.exe -k

netsvcs

>svchost.exe
>svchost.exe
>spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
>Crypserv.exe crypserv.exe
>DefWatch.exe "C:\Program

Files\Symantec_Client_Security\Symantec

>AntiVirus\DefWatch.exe"
>Rtvscan.exe "C:\Program

Files\Symantec_Client_Security\Symantec

>AntiVirus\Rtvscan.exe"
>RemotSvc.exe "C:\Program

Files\Dantz\Client\Remotsvc.exe"

>retroclient.exe "C:\Program

Files\Dantz\Client\retroclient.exe"

>svchost.exe C:\WINDOWS\System32\svchost.exe -k

imgsvc

>explorer.exe C:\WINDOWS\Explorer.EXE
>VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1

\vptray.exe"

>ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
>wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -

Embedding

>taskmgr.exe taskmgr.exe
>mozilla.exe "C:\Program

Files\mozilla.org\Mozilla\mozilla.exe" -mail

>StartupTracker3.exe "C:\Documents and Settings\Ben
>Rosenau\Desktop\Utilities and
>Installers\StartupTracker3\StartupTracker3.exe"
>wmiprvse.exe
>
>-- Running Services --
>
>Name: AudioSrv
>Description: Manages audio devices for Windows-based

programs. If this

>service is stopped, audio devices and effects will not

function

>properly. If this service is disabled, any services that

explicitly

>depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Browser
>Description: Maintains an updated list of computers on

the network and

>supplies this list to computers designated as browsers.

If this service

>is stopped, this list will not be updated or maintained.

If this service

>is disabled, any services that explicitly depend on it

will fail to start.

>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Crypkey License
>Description:
>Startup Mode: Auto
>Run from: crypserv.exe
>
>Name: CryptSvc
>Description: Provides three management services: Catalog

Database

>Service, which confirms the signatures of Windows files;

Protected Root

>Service, which adds and removes Trusted Root

Certification Authority

>certificates from this computer; and Key Service, which

helps enroll

>this computer for certificates. If this service is

stopped, these

>management services will not function properly. If this

service is

>disabled, any services that explicitly depend on it will

fail to start.

>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
>Name: DefWatch
>Description:
>Startup Mode: Auto
>Run from: C:\Program

Files\Symantec_Client_Security\Symantec

>AntiVirus\DefWatch.exe
>
>Name: Dhcp
>Description: Manages network configuration by registering

and updating

>IP addresses and DNS names.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: dmserver
>Description: Detects and monitors new hard disk drives

and sends disk

>volume information to Logical Disk Manager Administrative

Service for

>configuration. If this service is stopped, dynamic disk

status and

>configuration information may become out of date. If this

service is

>disabled, any services that explicitly depend on it will

fail to start.

>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Dnscache
>Description: Resolves and caches Domain Name System (DNS)

names for this

>computer. If this service is stopped, this computer will

not be able to

>resolve DNS names and locate Active Directory domain

controllers. If

>this service is disabled, any services that explicitly

depend on it will

>fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k

NetworkService

>
>Name: ERSvc
>Description: Allows error reporting for services and

applictions running

>in non-standard environments.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Eventlog
>Description: Enables event log messages issued by Windows-

based programs

>and components to be viewed in Event Viewer. This service

cannot be stopped.

>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\services.exe
>
>Name: EventSystem
>Description: Supports System Event Notification Service

(SENS), which

>provides automatic distribution of events to subscribing

Component

>Object Model (COM) components. If the service is stopped,

SENS will

>close and will not be able to provide logon and logoff

notifications. If

>this service is disabled, any services that explicitly

depend on it will

>fail to start.
>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: FastUserSwitchingCompatibility
>Description: Provides management for applications that

require

>assistance in a multiple user environment.
>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: helpsvc
>Desciption: Enables Help and Support Center to run on

this computer. If

>this service is stopped, Help and Support Center will be

unavailable. If

>this service is disabled, any services that explicitly

depend on it will

>fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: lanmanserver
>Description: Supports file, print, and named-pipe sharing

over the

>network for this computer. If this service is stopped,

these functions

>will be unavailable. If this service is disabled, any

services that

>explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: lanmanworkstation
>Description: Creates and maintains client network

connections to remote

>servers. If this service is stopped, these connections

will be

>unavailable. If this service is disabled, any services

that explicitly

>depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: LmHosts
>Description: Enables support for NetBIOS over TCP/IP

(NetBT) service and

>NetBIOS name resolution.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
>Name: Messenger
>Description: Transmits net send and Alerter service

messages between

>clients and servers. This service is not related to

Windows Messenger.

>If this service is stopped, Alerter messages will not be

transmitted. If

>this service is disabled, any services that explicitly

depend on it will

>fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Netman
>Description: Manages objects in the Network and Dial-Up

Connections

>folder, in which you can view both local area network and

remote

>connections.
>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Nla
>Description: Collects and stores network configuration

and location

>information, and notifies applications when this

information changes.

>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Norton AntiVirus Server
>Description:
>Startup Mode: Auto
>Run from: C:\Program

Files\Symantec_Client_Security\Symantec

>AntiVirus\Rtvscan.exe
>
>Name: PlugPlay
>Description: Enables a computer to recognize and adapt to

hardware

>changes with little or no user input. Stopping or

disabling this service

>will result in system instability.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\services.exe
>
>Name: PolicyAgent
>Description: Manages IP security policy and starts the

ISAKMP/Oakley

>(IKE) and the IP security driver.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\lsass.exe
>
>Name: ProtectedStorage
>Description: Provides protected storage for sensitive

data, such as

>private keys, to prevent access by unauthorized services,

processes, or

>users.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\lsass.exe
>
>Name: RemoteRegistry
>Description: Enables remote users to modify registry

settings on this

>computer. If this service is stopped, the registry can be

modified only

>by users on this computer. If this service is disabled,

any services

>that explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k LocalService
>
>Name: Retrospect Client
>Description:
>Startup Mode: Auto
>Run from: C:\Program Files\Dantz\Client\Remotsvc.exe
>
>Name: RpcSs
>Description: Provides the endpoint mapper and other

miscellaneous RPC

>services.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost -k rpcss
>
>Name: SamSs
>Description: Stores security information for local user

accounts.

>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\lsass.exe
>
>Name: Schedule
>Description: Enables a user to configure and schedule

automated tasks on

>this computer. If this service is stopped, these tasks

will not be run

>at their scheduled times. If this service is disabled,

any services that

>explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: seclogon
>Description: Enables starting processes under alternate

credentials. If

>this service is stopped, this type of logon access will

be unavailable.

>If this service is disabled, any services that explicitly

depend on it

>will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: SENS
>Description: Tracks system events such as Windows logon,

network, and

>power events. Notifies COM+ Event System subscribers of

these events.

>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
>Name: ShellHWDetection
>Description:
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: Spooler
>Description: Loads files to memory for later printing.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\spoolsv.exe
>
>Name: srservice
>Description: Performs system restore functions. To stop

service, turn

>off System Restore from the System Restore tab in My

Computer->Properties

>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: SSDPSRV
>Description: Enables discovery of UPnP devices on your

home network.

>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
>Name: stisvc
>Description: Provides image acquisition services for

scanners and cameras.

>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc
>
>Name: TermService
>Description: Allows multiple users to be connected

interactively to a

>machine as well as the display of desktops and

applications to remote

>computers. The underpinning of Remote Desktop (including

RD for

>Administrators), Fast User Switching, Remote Assistance,

and Terminal

>Server.
>Startup Mode: Manual
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: TrkWks
>Description: Maintains links between NTFS files within a

computer or

>across computers in a network domain.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
>Name: uploadmgr
>Description: Manages synchronous and asynchronous file

transfers between

>clients and servers on the network. If this service is

stopped,

>synchronous and asynchronous file transfers between

clients and servers

>on the network will not occur. If this service is

disabled, any services

>that explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: W32Time
>Description: Maintains date and time synchronization on

all clients and

>servers in the network. If this service is stopped, date

and time

>synchronization will be unavailable. If this service is

disabled, any

>services that explicitly depend on it will fail to start.
>
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>Name: WebClient
>Description: Enables Windows-based programs to create,

access, and

>modify Internet-based files. If this service is stopped,

these functions

>will not be available. If this service is disabled, any

services that

>explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
>Name: winmgmt
>Description: Provides a common interface and object model

to access

>management information about operating system, devices,

applications and

>services. If this service is stopped, most Windows-based

software will

>not function properly. If this service is disabled, any

services that

>explicitly depend on it will fail to start.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
>Name: wuauserv
>Description: Enables the download and installation of

critical Windows

>updates. If the service is disabled, the operating system

can be

>manually updated at the Windows Update Web site.
>Startup Mode: Auto
>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
>Name: WZCSVC
>Description: Provides automatic configuration for the

802.11 adapters

>Startup Mode: Auto
>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>
>
>
>THANKS!!!
>Ben Rosenau
>
>.
>

Dave

Guest
Posts: n/a

Re: HELP! intermittent random hang/release, low CPU usage but seemingly high (?) mem usage

Posted: 11-29-2003, 07:39 PM

This could be caused by one of the applications running on your
system.
I suspect it may be related to the application(s) that use the CrypKey
license service.
Note which applications are running when the problem occurs.
Try disabling the CrypKey License Service temporarily.
This will prevent the application that uses it from working, but you
can re-enable it after you have done some test on your system to see
if the problem re-occurs.
To disable the CrypKey License Service, right-click on My Computer.
Select Manage - Services.
Locate the CrypKey License Service and stop it. Also select the option
to disable it.
Now use your computer for a while and see how it works.
If it seems to be funtioning well, then start up the service again and
see what effect that has.
At the end of all this, if you suspect the CrypKey License Service is
involved, then contact the vendor of the program that installed it.
To find out which program uses the service, look in the crypkey.ini
located in your Windows directory - it will show the directory of the
application that uses the service. From there you can figure out which
vendor to contact.

Good Luck,
Dave

"brosenau[" <"brosenau["@]jhu.edu> wrote in message news:<#kMIc04sDHA.2492@TK2MSFTNGP12.phx.gbl>...

> Hi, so I'm really hoping someone can help me with this...
>
> The problem: at seemingly random times, the system hangs. Something as
> simple as scrolling through a file just STOPS. Waiting anywhere from
> several seconds to a minute or more usually causes everything to get
> back to normal, but these things happen very frequently, often during
> very minor tasks with nothing else running. Trying to look at the
> properties page of a disk drive involves waiting way longer than on most
> systems, as I said, scrolling a file in Visual Studio or even a text
> editor sometimes causes this, and any number of other operations do as
> well. Sometimes the system marks the program this happens to as "not
> responding", but waiting, as I said, generally restores it to normal
> operation. Oddly, CPU usage does not tend to be high or go up when this
> happens--it may be 3-5% and this still occurs. Memory usage on the
> system seems to be a bit high (but I don't really know what it should
> be, for an XP system)--with minimal applications running physical memory
> available is often around 200-300 MB, out of 512. This seems like a
> minor problem, but it's really driving me nuts because it happens so
> often. Does anyone have any ideas? I thought about viruses (but don't
> have any as near as I can tell) and excessive Spyware running (same),
> very fragmented hard disks (but each gets defragged weekly), etc...
>
> System info: I'm running XP Pro SP1 on a dual P3-800 system with 512 MB
> ram, two 40GB hard disks (C:, D connected to the on-motherboard IDE
> controller and a 150GB (G hard disk connected via a Promise Ultra133
> TX2 IDE controller. Page files are on the D (1-2 GB) and G (1-4 GB)
> drives; the OS and program executables are on the C drive.
> StartupTracker info follows:
>
> -- Registry --
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\RunOnce
>
> No Items Found
>
> -- Registry --
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
>
> vptray C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
>
> -- Registry --
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\RunOnce
>
> No Items Found
>
> -- Registry --
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
>
> ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
>
> -- Registry --
> HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\RunOnce
>
> No Items Found
>
> -- Start Menu - Current User --
> No Items Found
>
> -- Start Menu - All Users --
> No Items Found
>
> -- Disabled Items --
> msmsgs
> qttask
> Acrobat Assistant
> Microsoft Office
>
> -- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows
> NT\CurrentVersion\Winlogon --
> Explorer.exe
>
> -- Running Processes --
> System Idle Process
> System
> smss.exe \SystemRoot\System32\smss.exe
> csrss.exe
> winlogon.exe winlogon.exe
> services.exe C:\WINDOWS\system32\services.exe
> lsass.exe C:\WINDOWS\system32\lsass.exe
> svchost.exe C:\WINDOWS\system32\svchost -k rpcss
> svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
> svchost.exe
> svchost.exe
> spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
> Crypserv.exe crypserv.exe
> DefWatch.exe "C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\DefWatch.exe"
> Rtvscan.exe "C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\Rtvscan.exe"
> RemotSvc.exe "C:\Program Files\Dantz\Client\Remotsvc.exe"
> retroclient.exe "C:\Program Files\Dantz\Client\retroclient.exe"
> svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
> explorer.exe C:\WINDOWS\Explorer.EXE
> VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"
> ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
> wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -Embedding
> taskmgr.exe taskmgr.exe
> mozilla.exe "C:\Program Files\mozilla.org\Mozilla\mozilla.exe" -mail
> StartupTracker3.exe "C:\Documents and Settings\Ben
> Rosenau\Desktop\Utilities and
> Installers\StartupTracker3\StartupTracker3.exe"
> wmiprvse.exe
>
> -- Running Services --
>
> Name: AudioSrv
> Description: Manages audio devices for Windows-based programs. If this
> service is stopped, audio devices and effects will not function
> properly. If this service is disabled, any services that explicitly
> depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Browser
> Description: Maintains an updated list of computers on the network and
> supplies this list to computers designated as browsers. If this service
> is stopped, this list will not be updated or maintained. If this service
> is disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Crypkey License
> Description:
> Startup Mode: Auto
> Run from: crypserv.exe
>
> Name: CryptSvc
> Description: Provides three management services: Catalog Database
> Service, which confirms the signatures of Windows files; Protected Root
> Service, which adds and removes Trusted Root Certification Authority
> certificates from this computer; and Key Service, which helps enroll
> this computer for certificates. If this service is stopped, these
> management services will not function properly. If this service is
> disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: DefWatch
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\DefWatch.exe
>
> Name: Dhcp
> Description: Manages network configuration by registering and updating
> IP addresses and DNS names.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: dmserver
> Description: Detects and monitors new hard disk drives and sends disk
> volume information to Logical Disk Manager Administrative Service for
> configuration. If this service is stopped, dynamic disk status and
> configuration information may become out of date. If this service is
> disabled, any services that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Dnscache
> Description: Resolves and caches Domain Name System (DNS) names for this
> computer. If this service is stopped, this computer will not be able to
> resolve DNS names and locate Active Directory domain controllers. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService
>
> Name: ERSvc
> Description: Allows error reporting for services and applictions running
> in non-standard environments.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Eventlog
> Description: Enables event log messages issued by Windows-based programs
> and components to be viewed in Event Viewer. This service cannot be stopped.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\services.exe
>
> Name: EventSystem
> Description: Supports System Event Notification Service (SENS), which
> provides automatic distribution of events to subscribing Component
> Object Model (COM) components. If the service is stopped, SENS will
> close and will not b able to provide logon and logoff notifications. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: FastUserSwitchingCompatibility
> Description: Provides management for applications that require
> assistance in a multiple user environment.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: helpsvc
> Description: Enables Help and Support Center to run on this computer. If
> this service is stopped, Help and Support Center will be unavailable. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: lanmanserver
> Description: Supports file, print, and named-pipe sharing over the
> network for this computer. If this service is stopped, these functions
> will be unavailable. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: lanmanworkstation
> Description: Creates and maintains client network connections to remote
> servers. If this service is stopped, these connections will be
> unavailable. If this service is disabled, any services that explicitly
> depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: LmHosts
> Description: Enables support for NetBIOS over TCP/IP (NetBT) service and
> NetBIOS name resolution.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: Messenger
> Description: Transmits net send and Alerter service messages between
> clients and servers. This service is not related to Windows Messenger.
> If this service is stopped, Alerter messages will not be transmitted. If
> this service is disabled, any services that explicitly depend on it will
> fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Netman
> Description: Manages objects in the Network and Dial-Up Connections
> folder, in which you can view both local area network and remote
> connections.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Nla
> Description: Collects and stores network configuration and location
> information, and notifies applications when this information changes.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Norton AntiVirus Server
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Symantec_Client_Security\Symantec
> AntiVirus\Rtvscan.exe
>
> Name: PlugPlay
> Description: Enables a computer to recognize and adapt to hardware
> changes with little or no user input. Stopping or disabling this service
> will result in system instability.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\services.exe
>
> Name: PolicyAgent
> Description: Manages IP security policy and starts the ISAKMP/Oakley
> (IKE) and the IP security driver.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\lsass.exe
>
> Name: ProtectedStorage
> Description: Provides protected storage for sensitive data, such as
> private keys, to prevent access by unauthorized services, processes, or
> users.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\lsass.exe
>
> Name: RemoteRegistry
> Description: Enables remote users to modify registry settings on this
> computer. If this service is stopped, the registry can be modified only
> by users on this computer. If this service is disabled, any services
> that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k LocalService
>
> Name: Retrospect Client
> Description:
> Startup Mode: Auto
> Run from: C:\Program Files\Dantz\Client\Remotsvc.exe
>
> Name: RpcSs
> Description: Provides the endpoint mapper and other miscellaneous RPC
> services.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost -k rpcss
>
> Name: SamSs
> Description: Stores security information for local user accounts.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\lsass.exe
>
> Name: Schedule
> Description: Enables a user to configure and schedule automated tasks on
> this computer. If this service is stopped, these tasks will not be run
> at their scheduled times. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: seclogon
> Description: Enables starting processes under alternate credentials. If
> this service is stopped, this type of logon access will be unavailable.
> If this service is disabled, any services that explicitly depend on it
> will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: SENS
> Description: Tracks system events such as Windows logon, network, and
> power events. Notifies COM+ Event System subscribers of these events.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: ShellHWDetection
> Description:
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: Spooler
> Description: Loads files to memory for later printing.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\spoolsv.exe
>
> Name: srservice
> Description: Performs system restore functions. To stop service, turn
> off System Restore from the System Restore tab in My Computer->Properties
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: SSDPSRV
> Description: Enables discovery of UPnP devices on your home network.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: stisvc
> Description: Provides image acquisition services for scanners and cameras.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc
>
> Name: TermService
> Description: Allows multiple users to be connected interactively to a
> machine as well as the display of desktops and applications to remote
> computers. The underpinning of Remote Desktop (including RD for
> Administrators), Fast User Switching, Remote Assistance, and Terminal
> Server.
> Startup Mode: Manual
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: TrkWks
> Description: Maintains links between NTFS files within a computer or
> across computers in a network domain.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: uploadmgr
> Description: Manages synchronous and asynchronous file transfers between
> clients and servers on the network. If this service is stopped,
> synchronous and asynchronous file transfers between clients and servers
> on the network will not occur. If this service is disabled, any services
> that explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: W32Time
> Description: Maintains date and time synchronization on all clients and
> servers in the network. If this service is stopped, date and time
> synchronization will be unavailable. If this service is disabled, any
> services that explicitly depend on it will fail to start.
>
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
> Name: WebClient
> Description: Enables Windows-based programs to create, access, and
> modify Internet-based files. If this service is stopped, these functions
> will not be available. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>
> Name: winmgmt
> Description: Provides a common interface and object model to access
> management information about operating system, devices, applications and
> services. If this service is stopped, most Windows-based software will
> not function properly. If this service is disabled, any services that
> explicitly depend on it will fail to start.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: wuauserv
> Description: Enables the download and installation of critical Windows
> updates. If the service is disabled, the operating system can be
> manually updated at the Windows Update Web site.
> Startup Mode: Auto
> Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>
> Name: WZCSVC
> Description: Provides automatic configuration for the 802.11 adapters
> Startup Mode: Auto
> Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>
>
>
>
> THANKS!!!
> Ben Rosenau

SPY WARE REMOVAL

Guest
Posts: n/a

HELP! intermittent random hang/release, low CPU usage but seemingly high (?) mem usage

Posted: 11-30-2003, 05:24 AM

>-----Original Message-----
>

http://www.spykiller.com

brosenau[

Guest
Posts: n/a

Re: HELP! intermittent random hang/release, low CPU usage but seeminglyhigh (?) mem usage

Posted: 12-03-2003, 02:37 PM

Dave,
Thanks for the help. Unfortunately, it's not CrypKey that's causing the
problem, as the problem's been around for quite some time, and the
program that uses CrypKey has only been on the system for about 2 weeks.
I appreciate the advice though--any other ideas?
Thanks,
Ben

Dave wrote:

> This could be caused by one of the applications running on your
> system.
> I suspect it may be related to the application(s) that use the CrypKey
> license service.
> Note which applications are running when the problem occurs.
> Try disabling the CrypKey License Service temporarily.
> This will prevent the application that uses it from working, but you
> can re-enable it after you have done some test on your system to see
> if the problem re-occurs.
> To disable the CrypKey License Service, right-click on My Computer.
> Select Manage - Services.
> Locate the CrypKey License Service and stop it. Also select the option
> to disable it.
> Now use your computer for a while and see how it works.
> If it seems to be funtioning well, then start up the service again and
> see what effect that has.
> At the end of all this, if you suspect the CrypKey License Service is
> involved, then contact the vendor of the program that installed it.
> To find out which program uses the service, look in the crypkey.ini
> located in your Windows directory - it will show the directory of the
> application that uses the service. From there you can figure out which
> vendor to contact.
>
> Good Luck,
> Dave
>
> "brosenau[" <"brosenau["@]jhu.edu> wrote in message news:<#kMIc04sDHA.2492@TK2MSFTNGP12.phx.gbl>...
>
>>Hi, so I'm really hoping someone can help me with this...
>>
>>The problem: at seemingly random times, the system hangs. Something as
>>simple as scrolling through a file just STOPS. Waiting anywhere from
>>several seconds to a minute or more usually causes everything to get
>>back to normal, but these things happen very frequently, often during
>>very minor tasks with nothing else running. Trying to look at the
>>properties page of a disk drive involves waiting way longer than on most
>>systems, as I said, scrolling a file in Visual Studio or even a text
>>editor sometimes causes this, and any number of other operations do as
>>well. Sometimes the system marks the program this happens to as "not
>>responding", but waiting, as I said, generally restores it to normal
>>operation. Oddly, CPU usage does not tend to be high or go up when this
>>happens--it may be 3-5% and this still occurs. Memory usage on the
>>system seems to be a bit high (but I don't really know what it should
>>be, for an XP system)--with minimal applications running physical memory
>>available is often around 200-300 MB, out of 512. This seems like a
>>minor problem, but it's really driving me nuts because it happens so
>>often. Does anyone have any ideas? I thought about viruses (but don't
>>have any as near as I can tell) and excessive Spyware running (same),
>>very fragmented hard disks (but each gets defragged weekly), etc...
>>
>>System info: I'm running XP Pro SP1 on a dual P3-800 system with 512 MB
>>ram, two 40GB hard disks (C:, D connected to the on-motherboard IDE
>>controller and a 150GB (G hard disk connected via a Promise Ultra133
>>TX2 IDE controller. Page files are on the D (1-2 GB) and G (1-4 GB)
>>drives; the OS and program executables are on the C drive.
>>StartupTracker info follows:
>>
>>-- Registry --
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu rrentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Registry --
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cu rrentVersion\Run
>>
>>vptray C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
>>
>>-- Registry --
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\Cur rentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Registry --
>>HKEY_CURRENT_USER\Software\Microsoft\Windows\Cur rentVersion\Run
>>
>>ctfmon.exe C:\WINDOWS\System32\ctfmon.exe
>>
>>-- Registry --
>>HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\C urrentVersion\RunOnce
>>
>>No Items Found
>>
>>-- Start Menu - Current User --
>>No Items Found
>>
>>-- Start Menu - All Users --
>>No Items Found
>>
>>-- Disabled Items --
>>msmsgs
>>qttask
>>Acrobat Assistant
>>Microsoft Office
>>
>>-- Registry - Shell Value - HKLM\SOFTWARE\Microsoft\Windows
>>NT\CurrentVersion\Winlogon --
>>Explorer.exe
>>
>>-- Running Processes --
>>System Idle Process
>>System
>>smss.exe \SystemRoot\System32\smss.exe
>>csrss.exe
>>winlogon.exe winlogon.exe
>>services.exe C:\WINDOWS\system32\services.exe
>>lsass.exe C:\WINDOWS\system32\lsass.exe
>>svchost.exe C:\WINDOWS\system32\svchost -k rpcss
>>svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs
>>svchost.exe
>>svchost.exe
>>spoolsv.exe C:\WINDOWS\system32\spoolsv.exe
>>Crypserv.exe crypserv.exe
>>DefWatch.exe "C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\DefWatch.exe"
>>Rtvscan.exe "C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\Rtvscan.exe"
>>RemotSvc.exe "C:\Program Files\Dantz\Client\Remotsvc.exe"
>>retroclient.exe "C:\Program Files\Dantz\Client\retroclient.exe"
>>svchost.exe C:\WINDOWS\System32\svchost.exe -k imgsvc
>>explorer.exe C:\WINDOWS\Explorer.EXE
>>VPTray.exe "C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe"
>>ctfmon.exe "C:\WINDOWS\System32\ctfmon.exe"
>>wisptis.exe "C:\WINDOWS\System32\wisptis.exe" -Embedding
>>taskmgr.exe taskmgr.exe
>>mozilla.exe "C:\Program Files\mozilla.org\Mozilla\mozilla.exe" -mail
>>StartupTracker3.exe "C:\Documents and Settings\Ben
>>Rosenau\Desktop\Utilities and
>>Installers\StartupTracker3\StartupTracker3.exe "
>>wmiprvse.exe
>>
>>-- Running Services --
>>
>>Name: AudioSrv
>>Description: Manages audio devices for Windows-based programs. If this
>>service is stopped, audio devices and effects will not function
>>properly. If this service is disabled, any services that explicitly
>>depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Browser
>>Description: Maintains an updated list of computers on the network and
>>supplies this list to computers designated as browsers. If this service
>>is stopped, this list will not be updated or maintained. If this service
>>is disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Crypkey License
>>Description:
>>Startup Mode: Auto
>>Run from: crypserv.exe
>>
>>Name: CryptSvc
>>Description: Provides three management services: Catalog Database
>>Service, which confirms the signatures of Windows files; Protected Root
>>Service, which adds and removes Trusted Root Certification Authority
>>certificates from this computer; and Key Service, which helps enroll
>>this computer for certificates. If this service is stopped, these
>>management services will not function properly. If this service is
>>disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: DefWatch
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\DefWatch.exe
>>
>>Name: Dhcp
>>Description: Manages network configuration by registering and updating
>>IP addresses and DNS names.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: dmserver
>>Description: Detects and monitors new hard disk drives and sends disk
>>volume information to Logical Disk Manager Administrative Service for
>>configuration. If this service is stopped, dynamic disk status and
>>configuration information may become out of date. If this service is
>>disabled, any services that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Dnscache
>>Description: Resolves and caches Domain Name System (DNS) names for this
>>computer. If this service is stopped, this computer will not be able to
>>resolve DNS names and locate Active Directory domain controllers. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k NetworkService
>>
>>Name: ERSvc
>>Description: Allows error reporting for services and applictions running
>>in non-standard environments.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Eventlog
>>Description: Enables event log messages issued by Windows-based programs
>>and components to be viewed in Event Viewer. This service cannot be stopped.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\services.exe
>>
>>Name: EventSystem
>>Description: Supports System Event Notification Service SENS), which
>>provides automatic distribution of events to subscribing Component
>>Object Model (COM) components. If the service is stopped, SENS will
>>close and will not be able to provide logon and logoff notifications. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: FastUserSwitchingCompatibility
>>Description: Provides management for applications that require
>>assistance in a multiple user environment.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: helpsvc
>>Description: Enables Help and Support Center to run on this computer. If
>>this service is stopped, Help and Support Center will be unavailable. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: lanmanserver
>>Description: Supports file, print, and named-pipe sharing over the
>>network for this computer. If this service is stopped, these functions
>>will be unavailable. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: lanmanworkstation
>>Description: Creates and maintains client network connections to remote
>>servers. If this service is stopped, these connections will be
>>unavailable. If this service is disabled, any services that explicitly
>>depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: LmHosts
>>Description: Enables support for NetBIOS over TCP/IP (NetBT) service and
>>NetBIOS name resolution.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: Messenger
>>Description: Transmits net send and Alerter service messages between
>>clients and servers. This service is not related to Windows Messenger.
>>If this service is stopped, Alerter messages will not be transmitted. If
>>this service is disabled, any services that explicitly depend on it will
>>fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Netman
>>Description: Manages objects in the Network and Dial-Up Connections
>>folder, in which you can view both local area network and remote
>>connections.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Nla
>>Description: Collects and stores network configuration and location
>>information, and notifies applications when this information changes.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Norton AntiVirus Server
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Symantec_Client_Security\Symantec
>>AntiVirus\Rtvscan.exe
>>
>>Name: PlugPlay
>>Description: Enables a computer to recognize and adapt to hardware
>>changes with little or no user input. Stopping or disabling this service
>>will result in system instability.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\services.exe
>>
>>Name: PolicyAgent
>>Description: Manages IP security policy and starts the ISAKMP/Oakley
>>(IKE) and the IP security driver.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\lsass.exe
>>
>>Name: ProtectedStorage
>>Description: Provides protected storage for sensitive data, such as
>>private keys, to prevent access by unauthorized services, processes, or
>>users.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\lsass.exe
>>
>>Name: RemoteRegistry
>>Description: Enables remote users to modify registry settings on this
>>computer. If this service is stopped, the registry can be modified only
>>by users on this computer. If this service is disabled, any services
>>that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k LocalService
>>
>>Name: Retrospect Client
>>Description:
>>Startup Mode: Auto
>>Run from: C:\Program Files\Dantz\Client\Remotsvc.exe
>>
>>Name: RpcSs
>>Description: Provides the endpoint mapper and other miscellaneous RPC
>>services.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost -k rpcss
>>
>>Name: SamSs
>>Description: Stores security information for local user accounts.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\lsass.exe
>>
>>Name: Schedule
>>Description: Enables a user to configure and schedule automated tasks on
>>this computer. If this service is stopped, these tasks will not be run
>>at their scheduled times. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: seclogon
>>Description: Enables starting processes under alternate credentials. If
>>this service is stopped, this type of logon access will be unavailable.
>>If this service is disabled, any services that explicitly depend on it
>>will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: SENS
>>Description: Tracks system events such as Windows logon, network, and
>>power events. Notifies COM+ Event System subscribers of these events.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: ShellHWDetection
>>Description:
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: Spooler
>>Description: Loads files to memory for later printing.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\spoolsv.exe
>>
>>Name: srservice
>>Description: Performs system restore functions. To stop service, turn
>>off System Restore from the System Restore tab in My Computer->Properties
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: SSDPSRV
>>Description: Enables discovery of UPnP devices on your home network.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: stisvc
>>Description: Provides image acquisition services for scanners and cameras.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k imgsvc
>>
>>Name: TermService
>>Description: Allows multiple users to be connected interactively to a
>>machine as well as the display of desktops and applications to remote
>>computers. The underpinning of Remote Desktop (including RD for
>>Administrators), Fast User Switching, Remote Assistance, and Terminal
>>Server.
>>Startup Mode: Manual
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: TrkWks
>>Description: Maintains links between NTFS files within a computer or
>>across computers in a network domain.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: uploadmgr
>>Description: Manages synchronous and asynchronous file transfers between
>>clients and servers on the network. If this service is stopped,
>>synchronous and asynchronous file transfers between clients and servers
>>on the network will not occur. If this service is disabled, any services
>>that explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: W32Time
>>Description: Maintains date and time synchronization on all clients and
>>servers in the network. If this service is stopped, date and time
>>synchronization will be unavailable. If this service is disabled, any
>>services that explicitly depend on it will fail to start.
>>
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>Name: WebClient
>>Description: Enables Windows-based programs to create, access, and
>>modify Internet-based files. If this service is stopped, these functions
>>will not be available. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k LocalService
>>
>>Name: winmgmt
>>Description: Provides a common interface and object model to access
>>management information about operating system, devices, applications and
>>services. If this service is stopped, most Windows-based software will
>>not function properly. If this service is disabled, any services that
>>explicitly depend on it will fail to start.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: wuauserv
>>Description: Enables the download and installation of critical Windows
>>updates. If the service is disabled, the operating system can be
>>manually updated at the Windows Update Web site.
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\system32\svchost.exe -k netsvcs
>>
>>Name: WZCSVC
>>Description: Provides automatic configuration for the 802.11 adapters
>>Startup Mode: Auto
>>Run from: C:\WINDOWS\System32\svchost.exe -k netsvcs
>>
>>
>>
>>
>>THANKS!!!
>>Ben Rosenau

LinkBack

Thread Tools

Display Modes

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Forum Jump

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
DPCs causing 100% processor usage at random times	sebbelcher	Windows Vista Performance & Maintenance	1	07-13-2007 03:02 PM
Random Hang ups	L. Vang	Windows XP Performance & Maintenance	1	11-18-2003 06:30 AM
Random CPU Usage Spikes	C.J.	Windows XP Performance & Maintenance	0	11-17-2003 07:51 AM
Intermittent Hang-up during Startup	Francis	Windows XP Basics	2	11-14-2003 12:54 AM
Hang with CPU usage problem(winXP)	Eddie	Windows XP Accessibility	0	09-11-2003 07:33 AM