Services.exe running at 100% CPU and using 100s of MB of memory – Windows XP SP3
I came across an interesting one in the last few days. This system was a Windows XP system with current updates – SP3, IE 8…. and among other things there was a complaint of very sluggish behavior. I updated the antimalware software installed and ran scans. Malware Bytes antimalware actually found and removed two suspect files, but that didn’t seem to sole the sluggishness. The web browser (internet explorer) would take what seemed like a minute or so to respond to any action. One thing I discovered is that Internet explorer 8 can behave VERY slowly if there are a lot of sites in the restricted zone. (Spybot S&D immunization puts lot’s of sites in restricted zones.) So, I found a way to remove them all and retry and things seemed quicker, but… after running for 15-20 minutes the system really started to become unresponsive and so I had to start looking for another cause…. services.exe was running at 99% cpu or 100% cpu from time to time and the memory footprint was growing – the high mark I saw was 350MB of memory in use for it (!)
The first hint I had was a site claiming that if the event logs get to be too large it could cause services.exe to respond this way – taking up 98% or 99% cpu and more and more memory. So, after attempting to skim the logfiles for any helpfull info, I cleared them and restarted to wait and see what would happen next. It wasn’t long before the same behavior came back.
So, I searched quite a bit online (the even log items didn’t seem to give ANY clues) and found many discussions about the same issue. Most were a bit old (2-3 years), but in one discussion someone mentioned that they disabled the windows firewall and internet connection sharing service and their problem went away. So, I gave this a try and waited….. services.exe remained well behaved for a couple hours.
Not wanting to leave the system without the firewall, I tried resetting the windows firewall to it’s default settings and restarted it as a service. I let the system reboot and sit for a couple hours without the issue recurring. So, hopefully this reset of the windows firewall settings has solved the problem on this machine!
Side notes: Internet Explorer really shouldn’t respond differently if there is 1 site in restricted zones or 5000 – I mean really – Microsoft should address this problem. I do read that apparently there are features in IE 8 that should make spybot’s immunization unnecessary. Also, re: the firewall being the culprit here, it’s not wise to run a windows machine connected directly to the internet without a firewall of some sort. If this problem seems to affect you and resetting the firewall to it’s defaults doesn’t resolve it, you might consider looking at the free software firewalls that are available, or consider a hardware firewall (router) between your machine and the internet.
Utility to remove all sites from restricted zone is available here.