svchost.exe + NTDLL.DLL Causing high CPU Usage

Satanical Eve said:

Threads for it...

That's all one thread, and it's relatively strange, as if the kernel is trying to map info into the user-mode address space of a process whose threads are themselves not running for some reason, as if they've been suspended.

The svchost to which this thread belongs is the "DcomLaunch" instance - that's visible from your first screenshot. There are multiple services in there by default:

svchost.exe 708 DcomLaunch, PlugPlay, Power

Your own machine may well be different (check by running TASKLIST /SVC).

If you temporarily split up those services into their own svchost instances, it'll become easier to gauge which service spawns the CPU chewing thread, and hence where to focus the troubleshooting. To split off the services into their own svchost instances, on an elevated (run as admin) CMD prompt:

SC CONFIG Power TYPE= OWN
SC CONFIG PlugPlay TYPE= OWN

Reboot, and then check which of the services is blasting the processor.

H2SO4 said:

Satanical Eve said:

Threads for it...

That's all one thread, and it's relatively strange, as if the kernel is trying to map info into the user-mode address space of a process whose threads are themselves not running for some reason, as if they've been suspended.

The svchost to which this thread belongs is the "DcomLaunch" instance - that's visible from your first screenshot. There are multiple services in there by default:

svchost.exe 708 DcomLaunch, PlugPlay, Power

Your own machine may well be different (check by running TASKLIST /SVC).

If you temporarily split up those services into their own svchost instances, it'll become easier to gauge which service spawns the CPU chewing thread, and hence where to focus the troubleshooting. To split off the services into their own svchost instances, on an elevated (run as admin) CMD prompt:

SC CONFIG Power TYPE= OWN
SC CONFIG PlugPlay TYPE= OWN

Reboot, and then check which of the services is blasting the processor.

I did this earlier. Im going to leave this PC on though. The issue MIGHT be resolved but if the high cpu usage comes back Im gonna restart and check out whats going on with the services.

Google listed over 100,000 returns on that file, but I didn't quickly see anything directly related to your problem. Not sure, but I would consider downloading another copy of it, to see if the original is corrupted.

Satanical Eve said:

I restarted the pc last night and now Its starting that issue again 49%. Its the Plug And Play thats causing it. umpnpmgr.dll with ntdll.dll!tppwaiterp thread that makes the CPU spike. If I suspend the ntdll.dll thread thats causing it. the cpu goes back to normal BUT it comes back within a few hours. Now thats a work around right now but I do not want to continue doing that

Can you post the stacks of the threads in the PnP svchost at the point where the problem occurs again? I gather that you're observing involvement from multiple threads in that process, even if suspending one of them temporarily does the trick.

If you haven't already done so, I'd suggest testing what happens with your anti-virus completely uninstalled, not just disabled. The previous thread stack you posted is indicative of retry behaviour which may be caused by some type of interference from another component - possibly the AV.

H2SO4 said:

Satanical Eve said:

I restarted the pc last night and now Its starting that issue again 49%. Its the Plug And Play thats causing it. umpnpmgr.dll with ntdll.dll!tppwaiterp thread that makes the CPU spike. If I suspend the ntdll.dll thread thats causing it. the cpu goes back to normal BUT it comes back within a few hours. Now thats a work around right now but I do not want to continue doing that

Can you post the stacks of the threads in the PnP svchost at the point where the problem occurs again? I gather that you're observing involvement from multiple threads in that process, even if suspending one of them temporarily does the trick.

If you haven't already done so, I'd suggest testing what happens with your anti-virus completely uninstalled, not just disabled. The previous thread stack you posted is indicative of retry behaviour which may be caused by some type of interference from another component - possibly the AV.

I'll definitely do that. Well Kaspersky I never had issues with it when I got it installed with Windows 7 BUT Ill take the risk without the antivirus. If indeed it happens again. Ill post the stacks as well

Also did mailware bytes from the other poster.

Malwarebytes' Anti-Malware 1.41
Database version: 3149
Windows 6.1.7600

11/11/2009 5:17:16 PM
mbam-log-2009-11-11 (17-17-16).txt

Scan type: Quick Scan
Objects scanned: 89895
Time elapsed: 3 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChange s (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Brian\downloads\sopfilter.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Users\Brian\Desktop\Download 100,000 Emoticons!.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Users\Brian\Desktop\Sherv.NET - Animated Emoticons, Winks, Display Pics, plus more!.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Users\Brian\Local Settings\Temporary Internet Files\udRemove.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Found five instances. of errors and removed them

Jacee said:

Looks good! :)
sherv.net | McAfee SiteAdvisor Software ? Website Safety Ratings and Secure Search
SOPFILTER.EXE, Prevx
UD_HJSPLIT-2-4.EXE, Prevx

Before you disable Kaspersky, reboot and run your machine for a bit. Tell us if it's still spiking.

The weird thing is there is two sopfilter.exe, One of them i used for streaming video using the sop format and the other is an actual worm. Hopefully it wasn't the worm that got downloaded