services.exe using 99% cpu = slowwww pc. 1

[mightyscotchpine]

I have a win 2k pro machine (sp3) that boots really slowly - the wall paper comes up, but I have yet to wait long enough for the taskbar or anything else to come up (and I've waited 30 minutes or more).
But, I can still bring up task mgr. with ctrl-alt-del.
I shows 100% cpu use, 99% of that is used by services.exe.
Does this fit any recent viruses? Any other ideas? Any thought on the matter is appreciated.

 

[bcastner]

What do the event logs show as the issue? Control Panel, Administrative Tools, Event Viewer.

 

[mightyscotchpine]

bcastner,

I can't even get that far. After logging in (which takes quite a while), I just get the wallpaper screen. I've waited 20 or 30 minutes, but nothing else comes up.
I can bring up the task manager - and it shows 100% cpu usage. But that's all I can do.

 

[edemiere]

When Windows Task Manager comes up go to:

File -> New Task (Run...) -> eventvwr

You type in event viewer, this should let you view the event log.

Good luck!

 

[BigOpie]

I am experiencing the same problems. Loading event viewer takes forever. Will post a reply if it works.

 

[bcastner]

BigOpie,

Not a good sign. If you run services.msc, and stop the Event log service, and set it to disabled, see if your machine dramaticly returns to normal.

 

[BigOpie]

All logs in Event Viewer were empty. Trying Services.msc now to disable. Will post conclusion or more problems.LOL.

 

[BigOpie]

Bcastner,

Thanks....worked like a charm....now I can SP the system and hopefully fix this lovely error.

 

[BigOpie]

Not good......I SP the system and everything. Restarted event log and PC is again freezing?? Any further suggestions???

 

[bcastner]

As I said originally, the situation is not a good one. I would not expect a Service Pack to resolve the problem.

Stop the service. Leave its startup desposition at Automatic.

Go to c:\winnt\system32\config

Delete the *.evt entries
Delete the *.LOG entries

Reboot. My guess is that there is an underlying process that is having difficulties.

 

[JacobRohlff]

I also had the same experience with Services.exe using 99% CPU. It happened after a bluescreen on a Windows 2000 server. I tracked the problem down to the "Event Log" service which never left it's "Starting" status. Most likely the *.evt files in \winnt\system32\config were corrupt, because the following solved my problem:
1. Set "Event Log" and "Event Log Watch" to Disabled.
2. Restart the server.
3. Rename (or delete) the *.evt files.
4. Set the two services to Automatic again, and start them.
Three new fresh .evt files were written and the server runs smoothly again.
I hope this helps those of you were a SP4 install didn't help. If the above isn't the issue, maybe another service is trying to start without succes.

 

[DarkDante]

This is an issue that I've been experiencing at the office. One of our field servers consistently runs at 100% due to Services.exe. The problem isn't necessarily with your service pack level though. (Unless you're now using SP4) The problem that Microsoft original reported in regards to this scenario was that the %systemroot%\system32\esent.dll file was not at a specified version level.

(That article can be obtained here:

http://support.microsoft.com/default.aspx?scid=kb;en-us;328885)

To summarize that article though, bring up the properties on your %systemroot%\system32\esent.dll file and make certain that the version level is at 6.1.3940.31 or later. Also, make certain that the modified date is June 19th 2003, or later.

This may resolve your issue. If you find that your version level is incorrect you can call Microsoft via the number provided in their article above and they'll send you a patch for it.

This may fix your issue. It still has yet to fix mine. That's what led me to this forum.

 

[Skadaddle]

I also had the same experience with Services.exe using 99% CPU. Thanks to Jacob. I followed his advise about the "Event Log" service which never left it's "Starting" status. User had shut down improperly (hit power switch)
Did the following and that resolved my problem

1. Set "Event Log" and "Event Log Watch" to Disabled.
2. Restart the server.
3. Rename (or delete) the *.evt files.
4. Set the two services to Automatic again, and start them.
Three new fresh .evt files were written

 

[DarkDante]

I have recently discovered that this will occur if you were previously using Symantec's Norton Antivirus. If you uninstall Norton, forget to uninstall Symantec Live Update, and then load McAfee Anti-Virus 7.0 or 7.1 (I don't know if any other versions are affected) then your system will run at 100% like that because of a conflict between the two programs.

I was able to eventually fix our remote servers by removing the Liveupdate program left behind by Symantec and then rebooting my system.

I don't know if this is still of any relevance to you but it might still be good knowledge to tuck away in your problem solving silo.

Adios

 

[anticore]

I recently had this same problem on a Windows 2000 Server - SERVICES.EXE using 99% CPU and the Event Log services stuck at 'Starting'.

Turns out that Jacob's solution resolved the issue. Thanks for that! Could not identify anything specific that caused the problem except the installation of a bunch of hotfixes including KB835732 (which has beem known to cause the System process to run at 99% CPU on some systems). HTH