Solved CPU Usage spikes

[andyfive]

Hi,

My Laptop has been suffering performance issues and I have identified two culprit processes using Process Explorer which seem to constantly spike the CPU - svchost.exe:3044 (DcomLaunch) and WmiPrvSE.exe:1212. When I look at the threads of these processes there seems to be a common link with what is causing the high CPU spikes, always with a Start Address : RPCRT4.dll!NdrTypeFlages+0x400 (Please see images below).



It would seem that this has something to do with a plug and play device so may be a driver issue but I'm not sure which one.

Any help in further identifiing what the issue may be would be most appreciated.

Many Thanks.

 

[richc46]

It may be a good idea to boot with a clean boot
Troubleshoot Application Conflicts by Performing a Clean Startup - Windows 7 Help Forums
You will be working with minimum services. If you no longer have the problem, put the services back one at a time until you can determine the cause of your problem
Run a full scan with your anti virus. Download and run a full scan with Malwarebytes.

 

[richc46]

You might also want to run a scan with eset online scanner

 

[andyfive]

Many Thanks for you reply richc.

I ran Malwarebytes and this found no problems. I've also performed the steps in you suggested regarding clean boot. With no services running the processes taking up the CPU now lok as follows:



The svchost process no longer seems to be using up any significant CPU but WmiPrvSE does still appear to still be there. Interrupts as also appeared and is constantly using between 10-30% CPU and interesingly, the explorer process has appeared and is constantly using a significant amount of CPU even though file explore is not open.

Any further suggestion most welcome.

Many Thanks

 

[richc46]

The wmiprvse.exe file should be located in C:WINDOWSSystem32Wbem. If it is not wmiprvse.exe is a virus, spyware, trojan or worm.
Check its location

 

[andyfive]

I can confirm that wmiprvse.exe is located in the correct directory. I'm just running the eset online scanner as suggested. Will update with results. Explorer.exe has now gone from the top of the list and interrupts.exe has dropped well down so these were probably red-herrings. Performace does seem to be makedly improved in clean boot mode so will do as suggested and turn back on services one by one to see if it stays the same.

 

[andyfive]

OK - a few PuP's found with eset scanner and deleted. Still no difference to the WmiPrvSE service though :



It still seems to spike upto around 20% CPU every five or so seconds. One thing I have noticed is that it seems to be this service that stops my laptop going to sleep automatically based on my Power Plan Settings. If I restart WmiPrvSE, auto sleep seems to work for a while until it eventually stops again.

Any more suggestions?

 

[richc46]

Give this a try
Restart the Windows management Instrumentation Service.
You can use this method to restart

Click Start, in search type Services, hit Enter. Under Services (Local), scroll down until you find the “Windows Management Instrumentation” service and select Restart.

This is easy and I think you will be very surprised by the result

 

[andyfive]

Thanks richc. When I do this, the WmiPrvSE service stops spiking in process explorer as does the svchost service. So, what appears to be happening is something is at some point is causing the WmiPrvSE service to start spiking the CPU. I could just restart the Windows management Instrumentation Service each time this happens but is would be nice to try and diagnose why this his happening and somehow stop it.

Any Thoughts?

 

[richc46]

My thought is that I was right, but am disappointed. When you reset the service, everything works the way it should but the problem persists.
Lets give this a try, go into clean boot, then reset the service. If it works, put services back one at a time to find the problem.

 

[andyfive]

When I do a clean boot and look at process explorer, WmiPrvSE is still there spiking upto 15% cpu every 5 seconds . When I restart the “Windows Management Instrumentation” service it stops the WmiPrvSE service from spiking but upon reboot, regardless of what service I re-enable back comes WmiPrvSE. Very strange.

 

[richc46]

See if it happens in safe mode
If it continues in safe mode, it could be a registry problem, which requires a reinstall
or
A problem with the basic OS which can be fixed with an SFC
http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html
If errors are found run 3 times

 

[andyfive]

OK - booted in safe mode, checked process explorer and WmiPrvSE is there but always < 0.01% CPU. Also ran the sfc /scannow command but no problems were found.

 

[richc46]

The only solution that I can think of is a repair install. You must have an install DVD, however
http://www.vistax64.com/tutorials/88236-repair-install-vista.html
If you need the DVD you can get one here:
http://www.vistax64.com/general-discussion/296167-vista-iso-download-131.html
Be sure to read the notes of the tutorial. You need same SP, Edition etc

 

[andyfive]

OK, think I have solved this. Windows repair turned out not to be an option for me because the Product Key on the bottom of my Laptop had worn away. Tried it anyway (you get 30 days before you need to enter the key) but it did not improve the CPU Spikes so I had to revert to a system backup I had taken prior to the repair.

It turns out AVAST antivirus was what was causing the CPU spikes with WmiPrvSE. I noticed that performing the clean boot did not stop the AVAST service from running - even though it was de-selected, it came back when rebooting (obviously a security measure to stop the service being stopped maliciously and leaving you without antivirus). Anyway, I decided to uninstall AVAST and the spiking stopped. Also, laptop now goes into sleep mode when it should which was obviously being prevented by the constant CPU usage.

Obviously, I still need an Antivirus!! I tried Avira and that did exactly the same thing as Avast and caused the CPU Spikes. Currently testing COMODO Antivirus and this seems to be working OK at the moment.

Still, thanks richc for taking the time to help me out with this. Much Appreciated.

 

[richc46]

You are welcome. Do not forget Panda a excellent choice for anti virus. It uses very little resources.