svchost.exe + NTDLL.DLL Causing high CPU Usage

I'm not the right person to talk to about this, but that dll is a required one used by the kernel. I'm guessing, but I think that both of the processes that you mentioned may indicate that the problem is being caused by some other third party software on your system If that be the case, you would need to locate it by a process of elimination. Go into msconfig and using selective startup, disable everything listed on the startup tab window, and run it that way long enough to see if the problem reappears. If it does, then you might have to consider other possibilities, like a system restore or repair install.

I'm gonna do that. I disabled my tuner card just to make sure that isn't causing the issue. But I doubt thats the cause because it happens regardless of if I use it or not

did you happen to setup windows media experience recently ?

I had the same issue you are describing shortly after setting up the media experience feature. De-installing it sadly did not resolve the issue. After troubleshooting for a few hours i decided to restore my windows from a previous automatic backup from the day before, which resolved the issue.

So I'm still not 100% certain about the cause, but my issue was resolved by restoring windows to a previous automatic backup.

cosomotion said:

did you happen to setup windows media experience recently ?

I had the same issue you are describing shortly after setting up the media experience feature. De-installing it sadly did not resolve the issue. After troubleshooting for a few hours i decided to restore my windows from a previous automatic backup from the day before, which resolved the issue.

So I'm still not 100% certain about the cause, but my issue was resolved by restoring windows to a previous automatic backup.

Hello cosomotion,

What kind of backup did you restore?
- A system image?
- System recovery point?

Just so we know how you solved this. ;-)

Best regards,

zx81

Satanical Eve said:

... Can anyone help me as to the exact cause and how to resolve it. Thank you very much

Nice job on the troubleshooting :)

The function names displayed for the ntoskrnl image are mostly wrong because there's no symbolic info. To get a more accurate stack representation, in Process Explorer, under Options, Configure symbols, put this into the "Symbols path:" field:

SRV*c:\SymCache*http://msdl.microsoft.com/download/symbol

Then restart ProcExp, repeat the procedure to find the offending thread, and copy it's stack once more (that "copy" button copies text to the clipboard so you don't have to bother with the screenshots).

An accurate stack representation of the busy thread should help in diagnosing the issue.

H2SO4 said:

Satanical Eve said:

... Can anyone help me as to the exact cause and how to resolve it. Thank you very much

Nice job on the troubleshooting :)

The function names displayed for the ntoskrnl image are mostly wrong because there's no symbolic info. To get a more accurate stack representation, in Process Explorer, under Options, Configure symbols, put this into the "Symbols path:" field:

SRV*c:\SymCache*http://msdl.microsoft.com/download/symbol

Then restart ProcExp, repeat the procedure to find the offending thread, and copy it's stack once more (that "copy" button copies text to the clipboard so you don't have to bother with the screenshots).

An accurate stack representation of the busy thread should help in diagnosing the issue.

I did it
Thread 752 - ntdll.dll!tppwaiterpthread

Thats exactly what appears for it. With the same information for the stack as before

logicearth said:

Not going to state anything conclusive. But NTDLL is not the cause. But what is interesting is that this svhost has Power Management, and Plug and Play Management. Something tells me it might have something to do with PnP and something (hardware) you have plugged in.

User-mode Power Service: Windows 7 DLL File Information - umpo.dll
User-mode Plug-and-Play Service: Windows 7 DLL File Information - umpnpmgr.dll

Well the only PNP devices I have installed are my webcam(Logitech Pro 4000), My Tuner Card(MSI TV Anywhere PCI). HP Printer, and my Bluetooth Adapter.

Thanks for the help guys.