Svchost problem [ Edited ]

[Stof]

Hello,

I have problem with svchost during scanning via wifi. When I want scan, svchost starts to take 100% of CPU and never stops. Wifi printing works fine. USB printing and scanning works fine.

Printer: HP Photosmart 5515

OS: XP SP3

Firewall: ZoneAlarm free edition (but installed and tested without ZA)

Other computers (XP SP3 with windows FW, W7 with WFW) on our home net print and scan fine via wifi.

HPHNDU.exe doesn't identify any problem, but doesn't see the ZoneAlarm firewall.

HPSDU.exe Find the printer, doesn't indicate any manager for the scanner (it's declared as fine), but when try WIA scanning, the problem with svchost.exe occurs. HP TWAIN does the same problem.

Here is the log of the svchost.exe from MS ProcessExplorer:

Process PID CPU Private Bytes Working Set Description Company Name
svchost.exe 3360 92.74 6 720 K 9 652 K Generic Host Process for Win32 Services Microsoft Corporation
procexp.exe 5904 6.45 12 660 K 17 176 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com
Interrupts n/a 0.81 0 K 0 K Hardware Interrupts and DPCs
zatray.exe 592 40 864 K 3 680 K ZoneAlarm Check Point Software Technologies LTD
wmiprvse.exe 2872 4 572 K 7 444 K WMI Microsoft Corporation
wmiprvse.exe 4764 5 276 K 6 352 K WMI Microsoft Corporation
wmiapsrv.exe 3092 3 896 K 5 932 K WMI Performance Adapter Service Microsoft Corporation
winlogon.exe 964 9 032 K 5 720 K Windows NT Logon Application Microsoft Corporation
vsmon.exe 1732 23 016 K 23 420 K TrueVector Service Check Point Software Technologies LTD
tvtsched.exe 3512 3 600 K 6 508 K ThinkVantage Scheduler Lenovo Group Limited
tvt_reg_monitor_svc.exe 3440 2 304 K 3 888 K ThinkVantage Registry Monitor Service Lenovo Group Limited
TpWAudAp.exe 332 1 892 K 2 816 K
TPHKMGR.exe 1884 3 692 K 4 752 K
tcpsvcs.exe 3344 3 788 K 4 932 K TCP/IP Services Application Microsoft Corporation
System Idle Process 0 0 K 16 K
System 4 0 K 105 172 K
SynTPEnh.exe 196 4 120 K 6 240 K Synaptics TouchPad Enhancements Synaptics, Inc.
svchost.exe 1176 4 584 K 6 380 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1276 25 040 K 38 288 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1232 3 072 K 4 924 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1640 6 212 K 7 228 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1308 3 880 K 4 576 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 1548 6 164 K 7 736 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 5540 4 064 K 4 764 K Generic Host Process for Win32 Services Microsoft Corporation
svchost.exe 2568 2 448 K 4 180 K Generic Host Process for Win32 Services Microsoft Corporation
SUService.exe 4012 13 804 K 12 012 K ThinkVantage System Update Service Lenovo Group Limited
STDKEYPAD.EXE 1964 2 900 K 4 556 K
spoolsv.exe 396 8 400 K 11 072 K Spooler SubSystem App Microsoft Corporation
SoundMan.exe 184 3 308 K 3 828 K Realtek Sound Manager Realtek Semiconductor Corp.
smss.exe 664 176 K 420 K Správce relací systému Windows NT Microsoft Corporation
scheduler_proxy.exe 412 4 228 K 6 312 K scheduler_proxy Application Lenovo Group Limited
services.exe 1008 3 324 K 5 304 K Services and Controller app Microsoft Corporation
ScanToPCActivationApp.exe 868 4 084 K 8 484 K ScanToPCActivationApp Hewlett-Packard Co.
S24EvMon.exe 1480 3 036 K 5 380 K Event Monitor - Supports driver extensions to NIC Driver for wireless adapters. Intel Corporation
RegSrvc.exe 3252 2 140 K 3 708 K RegSrvc Module Intel Corporation
PhotoshopElementsFileAgent.exe 2656 2 916 K 1 876 K Adobe Photoshop Elements 8.0 (component) Adobe Systems Incorporated
oodag.exe 3156 3 984 K 5 372 K O&O Defrag Agent O&O Software GmbH
MDM.EXE 2956 2 456 K 4 120 K Machine Debug Manager Microsoft Corporation
lsass.exe 1020 6 256 K 1 504 K LSA Shell (Export Version) Microsoft Corporation
LPMGR.EXE 1844 4 108 K 6 564 K Lenovo Care Manager Lenovo Group Limited
jusched.exe 400 2 272 K 3 836 K Java(TM) Update Scheduler Sun Microsystems, Inc.
jqs.exe 2852 8 100 K 1 380 K Java(TM) Quick Starter Service Sun Microsystems, Inc.
ISWSVC.exe 232 10 248 K 9 772 K ZoneAlarm Browser Security Check Point Software Technologies
igfxtray.exe 1940 2 364 K 4 204 K igfxTray Module Intel Corporation
igfxpers.exe 1904 2 124 K 3 636 K persistence Module Intel Corporation
chrome.exe 5560 27 360 K 32 024 K Google Chrome Google Inc.
chrome.exe 464 56 920 K 20 792 K Google Chrome Google Inc.
chrome.exe 2896 107 396 K 112 624 K Google Chrome Google Inc.
chrome.exe 4720 90 152 K 94 172 K Google Chrome Google Inc.
chrome.exe 5580 16 064 K 20 788 K Google Chrome Google Inc.
chrome.exe 4552 43 056 K 47 944 K Google Chrome Google Inc.
chrome.exe 5596 20 168 K 22 288 K Google Chrome Google Inc.
chrome.exe 540 18 928 K 21 444 K Google Chrome Google Inc.
hpwuschd2.exe 520 2 048 K 3 112 K hpwuSchd Application Hewlett-Packard
HPSDU.exe 4704 11 020 K 16 180 K HP Scan Diagnostic Utility Hewlett-Packard
HPSDU.exe 3716 2 236 K 4 164 K
HPNetworkCommunicator.exe 6068 6 384 K 6 748 K HPNetworkCommunicator Hewlett-Packard Co.
hkcmd.exe 1896 2 132 K 3 608 K hkcmd Module Intel Corporation
ForceField.exe 568 13 312 K 2 580 K ZoneAlarm Browser Security Check Point Software Technologies
explorer.exe 908 26 988 K 36 516 K Průzkumník Windows Microsoft Corporation
EvtEng.exe 1424 5 512 K 8 760 K EvtEng Module Intel Corporation
ctfmon.exe 616 3 484 K 4 516 K CTF Loader Microsoft Corporation
csrss.exe 936 1 960 K 6 644 K Client Server Runtime Process Microsoft Corporation
btwdins.exe 2808 2 168 K 3 180 K Bluetooth Support Server Broadcom Corporation.
BTTray.exe 1632 5 036 K 7 152 K Bluetooth Tray Application Broadcom Corporation.
BTStackServer.exe 2252 7 324 K 8 264 K Bluetooth Stack COM Server Broadcom Corporation.
avgwdsvc.exe 2776 9 520 K 16 032 K AVG Watchdog Service AVG Technologies CZ, s.r.o.
avgtray.exe 348 8 788 K 3 700 K AVG Tray Monitor AVG Technologies CZ, s.r.o.
avgrsx.exe 704 18 868 K 2 560 K AVG Resident Shield Service AVG Technologies CZ, s.r.o.
avgnsx.exe 3480 4 708 K 140 K AVG Online Shield Service AVG Technologies CZ, s.r.o.
AVGIDSAgent.exe 3632 17 912 K 9 748 K AVG Identity Protection Service AVG Technologies CZ, s.r.o.
avgcsrvx.exe 736 11 196 K 5 312 K AVG Scanning Core Module - Server Part AVG Technologies CZ, s.r.o.
AVerScheduleService.exe 2716 7 440 K 11 240 K ScheduleService Module
AVerRemote.exe 2704 9 048 K 12 668 K AVerRemote MFC Application AVerMedia
AVerQuick.exe 1568 2 716 K 5 140 K AVerQuick AVerMedia TECHNOLOGIES, Inc.
AVerHIDReceiver.exe 1528 2 284 K 4 200 K HIDRec Application
Amoumain.exe 340 3 348 K 4 160 K Amoumain A4Tech Co., Ltd.
alg.exe 3612 2 248 K 3 912 K Application Layer Gateway Service Microsoft Corporation

Process: svchost.exe Pid: 3360

Type Name
Desktop \Default
Directory \KnownDlls
Directory \Windows
Directory \BaseNamedObjects
Event \BaseNamedObjects\DINPUTWINMM
Event \BaseNamedObjects\userenv: User Profile setup event
Event \BaseNamedObjects\crypt32LogoffEvent
File C:\WINDOWS\system32
File \Device\KsecDD
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
File \Device\NamedPipe\net\NtControlPipe24
File C:\WINDOWS\Sti_Trace.log
File C:\WINDOWS\wiaservc.log
File C:\WINDOWS\Sti_Trace.log
File \Device\WMIDataDevice
File C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86
File \Device\WMIDataDevice
File C:\WINDOWS\Temp\IswTmp\Logs\ISWSHEX.swl
File C:\WINDOWS\wiadebug.log
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
File \Device\Tcp
File C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
File \Device\Tcp
File \Device\Ip
File \Device\Ip
File \Device\Ip
File \Device\Tcp6
File \Device\Tcp6
File \Device\Ip6
File \Device\Ip6
File \Device\Ip6
File \Device\Tcp
File \Device\Afd
Key HKLM
Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key HKCR
Key HKCR
Key HKCR
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKU
Key HKCR
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCR
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKU
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKLM\SOFTWARE\Microsoft\COM3
Key HKCR\CLSID
Key HKCR
Key HKLM\SYSTEM\ControlSet001\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0004
Key HKCR
Key HKCR
Key HKU\.DEFAULT
Key HKLM\SYSTEM\ControlSet001\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0004
Key HKLM\SYSTEM\ControlSet001\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0002
Key HKLM\SYSTEM\ControlSet001\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0005
Key HKLM\SYSTEM\ControlSet001\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0003
Key HKCR
Key HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
Key HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK
Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Key HKLM\SYSTEM\ControlSet001\Services\Tcpip\Linkage
Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces
Key HKLM\SYSTEM\ControlSet001\Services\NetBT\Parameters
Key HKCR
Key HKCR
Key HKCR
Key HKLM\SYSTEM\Setup
Key HKCR
Key HKCR
Key HKCR
Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
Key HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
KeyedEvent \KernelObjects\CritSecOutOfMemoryEvent
Mutant \BaseNamedObjects\SHIMLIB_LOG_MUTEX
Mutant \BaseNamedObjects\StiTraceMutexSti_Trace.log
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\StiTraceMutexSti_Trace.log
Mutant \BaseNamedObjects\WiaDebugFileMut
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesLock
Mutant \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorLock
Mutant \BaseNamedObjects\XmlFileCache#HP Photosmart 5510d series#CN1AK1B45H05RW
Port \RPC Control\OLEFBB2EDFDB613461C973ABCE7A005
Port \RPC Control\STI_LRPC
Process svchost.exe(3360)
Section \BaseNamedObjects\_ISWINTERNAL_EPT32_SHEX_K32_0_1c9aa2e9615d300_7c80_S-1-5-18
Section \BaseNamedObjects\_ISWINTERNAL_EPT32_SHEX_A32_0_1c98aa50121d080_77dc_S-1-5-18
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]RegValuesMappedFile
Section \BaseNamedObjects\HPScanTRDrv_PS5510d[3360]ExtMonitorMappedFile
Semaphore \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Semaphore \BaseNamedObjects\0004
Thread svchost.exe(3360): 3364
Thread svchost.exe(3360): 3436
Thread svchost.exe(3360): 3448
Thread svchost.exe(3360): 3216
Thread svchost.exe(3360): 4648
Thread svchost.exe(3360): 3436
Thread svchost.exe(3360): 4500
Thread svchost.exe(3360): 4648
Thread svchost.exe(3360): 4648
Thread svchost.exe(3360): 5952
Token NT AUTHORITY\NETWORK SERVICE:3e4
Token NOX\Stofa:18bb5
WindowStation \Windows\WindowStations\Service-0x0-3e7$
WindowStation \Windows\WindowStations\Service-0x0-3e7$

[007OHMSS]

"Svchost.exe" (Generic Host Process for Win32 Services) is an integral part of Windows. It cannot be stopped or restarted manually. This process manages system services that run from dynamic link libraries (files with extension .dll). Examples for such system services are: Automatic Updates, Windows Firewall, Plug and Play, etc... 
Normally  multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started.
If the process svchost.exe uses high CPU  resources only when scanning, then it is likely an issue with ZoneAlarm reacting to WiFi printer communication which to the program could resemble unwanted intrusion. Changing the settings in ZoneAlarm to allow scanning will probably fix this issue.  

However, if you tested this without ZoneAlarm installed, then something else may be happening. Try the utility located here,  it will check the scanning setup:

http://h10025.www1.hp.com/ewfrf/wc/document?docname=c02114802&cc=us&dlc=en&lc=en&product=5063582&tmp...

FYI: The svchost.exe file is located in the folder C:\Windows\System32. If located elsewhere it may not be a legitimate file, ie: malware, viruse, trojan, etc.....

[Stof]

Thank you for your response.

I tried the diagnostic software before the first question.

Quote: "HPSDU.exe Find the printer, doesn't indicate any manager for the scanner (it's declared as fine), but when try WIA scanning, the problem with svchost.exe occurs. HP TWAIN does the same problem."

Now I have tried it once again. I installed a windows features for faxing. From that time the problem with svchost doesn't appear when I have switch on the firewall (ZoneAlarm Free). When the FW is shut down the problem with svchost is sill in the same state.

I reinstalled the HP print/scan utility, but it doesn't any effect. I tried it twice. Once with FW, once without FW.

When the installation reaches the option to use the HPprinter as a default printer and option to use the "self scan utility" and I chose something (doesn't matter what I chose (I tries all possibilities)), than the svchost problem occurs (doesn't matter if the FW is on or off). After that, the question about cartridges occur and open a web browser to register the HP AIO.

It's necessary to mention that the svchost problem doesn't freeze the notebook at all, but all operations are really slow.

The left error says: "scanner with no reaction".

The bottom error says: "Scanner unavailable. Check if the product is plugged in the electricity... etc." 

Do you have any idea how to solve this connection problem?

Kind regards,

Petr

[007OHMSS]

I noticed in your log, that there are AVG executables, as well as ZoneAlarm. In many cases, this is a bad combination. If these are both running at the same time, that could be causing all kinds of issues. If you look at the forums for the conflicts between those 2 programs, the problems are plentiful. I am not saying that will clear this problem, but it will help your system according to all I have read out there on the Web. However, svchost running so much is an indication of conflicts that will prevent proper operation of Windows. 

Did you check to make sure there are not instances of svchost located outside of the Windows directory? That is an indication of Malware on your system. And that can really bog down your system by design.