kernel32.dll!RegisterWaitForInputIdle+0x4a

[flyingwolf]

Ok so I was sitting around one day reading a message board (take a guess which one) and I noticed my PC was a bit sluggish.

SO I opened up the Task manger to see what was up. Well now svchost.exe was running 79 - 100 % CPU Usage constantly.

So I started to look into it. Came across a couple of newb sites, people with no information there, so on I go to do my own thing, open up Process Explorer from Sysinternlas and lo and behold, there is one particular thread in this svchost.exe that is taking up everything.

Well this one instance of svchost.exe is running my GUI, Audio, Lan, Internet connection, and many many other items, about 12 in total, SO I watched the thread for a few minutes and narrowed it down to one particular thread, killed that one thread with PE and moved on, upon each reboot I get this same problem.

So full virus/spyware/malware/grayware/whateverware scan later I see no problems other then a couple of cookies.

So now I ask the minds here at MSFN, what could this be that is causing all of this usage. I can easily kill the process upon each reboot, (once a week at the most, more like once a month) but still thats not normal to do, so any ideas of what this could be?

Once again that process thread was "kernel32.dll!RegisterWaitForInputIdle+0x4a"

There are about 15 of those threads running in this once instance of svchost.exe and I only have to kill the one causing the high usage to stop all of the sluggishness, PC runs like a champ and after a month i have seen no adverse effects, so if anyone has a clue, I would really appreciate it.

[jago_lfn]

Try looking in the event viewer for any errors, sounds like some driver or service hung waiting for input.

[HyperHacker]

I get similar problems myself. The instance running Windows Audio and many others seems to have a memory leak. I look at it and it's using up like 400MB. If I just terminate it, it respawns and all is well for a while.

[Mr Snrub]

Did you look at the stack for the offending thread, for clues as to which driver it could have been?

Might be worth identifying the service under the svchost instance which owns that thread, by breaking them out into their own instances - just remember to return them to a shared instance afterwards as this can break the system if left in this state.

MS article on svchost

MSDN blog with details on how to break svchost processes into their own instances for debugging

[cluberti]

I'd have to second taking a look at the stack on this one, as that kernel32.dll call is done by almost every driver and .dll function on the system. You'd have to look at the call stack of that particular thread when it's in state and chewing up CPU to see what actually called the function, as kernel32.dll is just the victim here, not the culprit.

[flyingwolf]

Will do, And I wil let you al know the outcome, I will eventually egt this SOB knocked out, ( I am betting it is a custom video driver I installed) but we will see.

[flyingwolf]

Ok a stack of the service didn't reveal anything.

Here is a copy from the tasklist /SVC.

AudioSrv, Browser, CryptSvc, ERSvc,

EventSystem, FastUserSwitchingCompatibility

helpsvc, lanmanserver, lanmanworkstation,

Netman, Nla, RasMan, Schedule, seclogon,

SENS, ShellHWDetection, srservice, TapiSrv,

TermService, Themes, winmgmt

The computer has been running for 26 hours, and this process has used 10:38:28 seconds of that in CPU time. So its definitely using the CPU when I am not, I do not know what is causing it but I should be able to get it taken care of with y'alls help.

Ok after doing some checking and rechecking I stumbled upon the answer, I would like to say it was my brilliant deduction, but frankly I just happened to see this.

Seems that my Sygate Personal Firewall is causing the problem.

It has never done this before, and should not be doing it now.

But it is.

So has anyone heard of this happening with the latest version?

Oh and the usage for the firewall is minimal if anything.

svchost.exe (this instance) is currently using 18,408 K of memory. Guess I need to find a new firewall.

Edited April 7, 2006 by flyingwolf

[cluberti]

Download LiveKD from www.sysinternals, install the debugging tools for Windows from the microsoft site, then use LiveKD to gather a dump while this thread is consuming CPU. I'll take a look at the dump and let you know what's going on.