The computer always crashes and gets stuck!

Nine possibilities of high CPU occupancy rate

1. Anti-virus software causes failure.

As the new versions of KV, Jinshan and Rising all add random monitoring of web pages, plug-ins and emails, the system burden will undoubtedly increase. Treatment: There is basically no reasonable treatment. Use as few monitoring services as possible, or upgrade your hardware.

2. The driver is not certified, resulting in CPU resource occupation 100%.

The proliferation of a large number of beta drivers on the Internet has caused failures that are difficult to find. Handling: Pay special attention to the driver of the graphics card. It is recommended to use drivers certified by Microsoft or officially released, and strictly check the model and version.

3, caused by viruses and Trojans

A large number of worms replicate rapidly in the system, resulting in high CPU utilization. Solution: Clean the system memory and local hard disk thoroughly with reliable antivirus software, and open the system setup software to see if there is any abnormal startup program. Update and upgrade anti-virus software and firewall regularly, strengthen anti-virus awareness and master correct anti-virus knowledge.

4. Click the right mouse button on the control panel-Management Tools-Services-Rising Real-time Monitoring Service to change it to manual.

5. Start-> Run-> msconfig-& gt； Start, close unnecessary startup items, and restart.

6. Check the "svchost" process.

Svchost。 Exe is a core process of Windows XP system. Svchost.exe not only appears in Window s XP, but also exists in Window s S system using NT kernel. Generally, in Windows 2000, the number of svchost.exe processes is 2, while in Windows XP, the number of svchost.exe processes rises to 4 or more.

7. Check the network connection. Mainly network cards.

8, check the network connection

When a computer with Windows XP installed as a server receives a connection request on port 445, it will allocate memory and a small amount of CPU resources to serve these connections. When the load is too heavy, the CPU utilization may be too high, because there is an inherent trade-off between the number of work items and the responsiveness. You need to determine the appropriate MaxWorkItems settings to improve the system responsiveness. If the setting value is incorrect, the response of the server may be affected, or the user monopolizes too many system resources.

To solve this problem, we can solve it by modifying the registry: expand the branch of [HKEY _ local _ machine \ system \ current control set \ service \ lanmanserver] in the registry editor, and create a new DWORD value named "maxworkitems" in the right window. Then double-click the value, type the following value in the window that opens, and save to exit:

If the memory of the computer exceeds 5 12MB, please type "1024"; If the computer memory is less than 5 12 MB, please type "256".

9. See if using the right mouse button in Windows XP leads to CPU usage of 100%.

Not long ago, it was reported that using the right mouse button in the resource manager would lead to 100% CPU resource occupation. Let's see what is going on.

Logo:

In Explorer, when you right-click a directory or file, you may encounter the following problems:

Any file copying operation may stop at that time.

The network connection speed will be significantly reduced.

All streaming input/output operations, such as listening to music with Windows Media Player, may cause music distortion:

When you right-click a file or directory in the Explorer to display the shortcut menu, the CPU utilization will increase to 100%, and when you close the shortcut menu, it will return to the normal level.

Solution:

Method 1: Turn off "Use Transition Effects on Menus and Tooltips"

1. Click Start-Control Panel.

2. Double-click Display in the control panel.

3. Click the Appearance tab in the Display property.

4. Click "Effect" in the "Appearance" tab.

5. In the Effects dialog box, clear the check box before Use transitional effects for menus and tooltips, and click the OK button twice.

Method 2: When clicking a file or directory with the right mouse button, first select your target file or directory with the left mouse button. Then use the right mouse button to pop up the shortcut menu.

Solution of CPU occupancy 100%

Under normal circumstances, if the CPU accounts for 100%, our computer will always slow down. In many cases, we can solve it without asking those prawns.

When the machine slows down, the first thing we think of is of course the task manager. Let's see which program accounts for a large proportion. If it's a big show, you can forgive it. After closing the program, as long as the CPU is normal, there is no problem. If not, then you need to see what program it is. When you can't find out what this process is, go to google or Baidu to search. Sometimes it's no use just finishing. Under xp, we can merge the startup items in msconfig and close some unused items. You can go to the next winpatrol in 2000.

Some commonly used software, such as browser, takes up a lot of CPU, so it is necessary to upgrade the software or simply replace it with other similar software. Sometimes software and systems are a bit incompatible. Of course, we can try the compatibility items given to us under xp system, and right click. Exe file to select compatibility.

Svchost.exe is sometimes a headache. When you see that your svchost.exe takes up a lot of CPU, you can go to the next aports or fport to check its corresponding program path, that is, something is using this svchost.exe. If it is not under c:\Windows\ system32 (xp) or c:\winnt\system32(2000), it is suspicious. Upgrade antivirus software to kill virus.

Right-clicking the file will lead to 100% CPU utilization, and we will also encounter this situation. Sometimes right-clicking and pausing can be the problem. Official explanation: first click the left button to choose, and then click the right button (I don't quite understand). Unofficial: Cancel "Use the following excessive effects for menus and tooltips" by right-clicking Desktop-Properties-Appearance-Effects. There are also some anti-virus software that will affect file monitoring, and file monitoring of anti-virus software can be turned off; The same is true for monitoring web pages, plug-ins and emails.

This phenomenon may sometimes appear in some drivers. It is best to choose a driver certified by Microsoft or officially released. Sometimes the driver can be upgraded appropriately, but remember that the latest one is not the best.

CPU cooling software, because the software will use all the CPU idle time to cool down when running, but Windows can't distinguish the difference between ordinary CPU occupation and cooling instructions of cooling software, so the CPU always displays 100%, so don't worry about this, and it won't affect the normal operation of the system.

When dealing with large word files, the CPU will be very tired because of the spelling and grammar check of word. Just open the word-Options- Spelling and Grammar tool and check "Check Spelling and Grammar".

After clicking the avi video file, the CPU utilization rate is high because the system has to scan the file first, check all parts of the file and establish an index. Solution: Right-click the folder where the video file is saved-Properties-General-Advanced, and uncheck the box that allows the indexing service to index the folder for quick search.

Case analysis of CPU occupancy 100%

1, dllhost process leads to CPU utilization 100%.

Features: The normal CPU consumption of the server should be below 75%, and the CPU consumption fluctuates up and down. The CPU of the server with this problem will suddenly stay at the level of 100% and will not drop. Looking at the task manager, we can find that DLLHOST.EXE consumes all the CPU idle time. In this case, the administrator must restart the IIS service. Strangely, everything was fine after restarting IIS service, but after a while, the problem appeared again.

Direct cause:

One or more ACCESS databases were damaged during multiple reads and writes. When Microsoft's MDAC system writes this damaged access file, the ASP thread is blocked. Therefore, other threads have to wait, IIS is deadlocked, and all CPU time is consumed in DLLHOST.

Solution:

Install the "first-level information monitoring and interception system" and use the "Chief Document Inspector IIS Health Inspector" software.

Enable Find Deadlock Module and set:

-wblock = Yes

Monitored directory, please specify the directory where your host files are located:

- wblockdir=d:\test

The file storage location of the log generated by monitoring is in the log directory of the installation directory, and the file name is logblock.htm.

Stop IIS, then start the Chief Document Checker IIS Health Checker, and then start IIS. IIS Health Inspector, the chief document inspector, will record the last written access file in logblock.htm.

After a while, problems came out. For example, the CPU will always be at the level of 100%. You can stop IIS and check the last ten files recorded by logblock.htm. Note that the most problematic file is usually an access file similar to a counter, such as "**COUNT". MDB "and" * * count. ASP”。 You can put the last ten files or suspicious ones in first. We believe that after careful search, you will definitely find this file that has worried you for some time.

After finding this file, you can delete it, or download it and repair it with ACCESS2000, and the problem will be solved.

2.svchost.exe occupies 100% of the CPU usage.

In win.ini file, under [Windows], "run=" and "load=" are possible ways to load Trojan horse programs, so we must pay close attention to them. Generally speaking, there is nothing after their equal sign. If you find that the path and file name behind them are not familiar startup files, your computer may be a Trojan horse. Of course, you have to look carefully, because many "Trojans", such as "AOL Trojans", disguise themselves as command.exe files. If you don't pay attention, you may not find that it is not a real system startup file.

In the system.ini file, there is a "shell= file name" under [BOOT]. The correct file name should be explorer.exe. If it is not "explorer.exe" but "shell = explorer.exe program name", then the latter program is "Trojan Horse" program, which means you have already won the Trojan Horse.

The situation in the registry is the most complicated. Open the registry editor through the regedit command, and click the directory "HKEY-local-machine \ software \ Microsoft \ Windows \ currentversion \ run" to check whether there is an unfamiliar autostart file with the extension of EXE in the key value. Remember here: some files generated by Trojan horse programs are very similar to the system's own files, and they want to get away with it through disguise, such as "acid battery v 1.0 Trojan horse", and the registry "HKEY-local-machine \ software \ Microsoft \ Windows \ current version \ The key value of Explorer under "Run" is changed to "Explorer =" c: \ Windows \ explorer.exe ",and the Trojan horse is only different from the real explorer by" I "and" L ". Of course, there are many places where Trojan horse programs can be hidden, such as "HKEY- current-user \ software \ Microsoft \ Windows \ current version \ running", "HKEY- user \ * * \ software \ Microsoft \ Windows \ current version \ running", and the best way is in "HKEY- local" This virus is also called "Code Red II" virus, which is a bit contrary to the popular "Red Team" virus in the western English system, and is called VirtualRoot internationally. The worm spreads to other web servers through port 80 by exploiting the overflow vulnerability known by Microsoft. Hackers can run scripts/root.exe of the infected machine through the request of Http Get, thus gaining complete control of the infected machine.

After successfully infecting a server, if the infected machine is a Chinese system, the program will sleep for 2 days, and other machines will sleep 1 day. When the sleep time is up, the worm program will restart the machine. The worm will also check whether the month of the machine is 10 or the year is 2002. If so, the infected server will restart. When the Windows NT system is started, the NT system will automatically search the file explorer.exe in the root directory of drive C, and the file explorer.exe on the server infected by the network worm program is the network worm program itself. The file size is 8 192 bytes, and the VirtualRoot network worm program is executed through this program. At the same time, the VirtualRoot network worm program also copied cmd.exe's files from the system directory of Windows NT to other directories, which opened the door for hackers to invade. It also modifies the system's registry keys. By modifying the registry key, the worm program can create a virtual directory C or D from which the virus name comes. It is worth mentioning that, except for the file explorer.exe, other operations of this network worm program are not based on files, but are directly infected and spread in memory, which brings great difficulty to catch.

"The file name of the program, and then search in the entire registry.

Let's first look at how Microsoft describes svchost.exe. Svchost.exe described in Microsoft Knowledge Base 3 14056 as follows: svchost.exe is the universal host process name of the service running from the dynamic link library (DLL).

In fact, svchost.exe is a core process of Windows XP system. Svchost.exe not only appears in Windows XP, but also exists in Windows systems using NT kernel. Generally, in Windows 2000, the number of svchost.exe processes is 2, while in Windows XP, the number of svchost.exe processes rises to 4 or more. So don't worry too much when you see several svchost.exe in the process list of the system.

What exactly does svchost.exe do?

First of all, we should understand that there are two kinds of processes in Windows system: independent processes and * * * enjoyment processes. Because there are more and more services in Windows system, in order to save limited system resources, Microsoft makes many system services into * * * sharing mode. What role does svchost.exe play in it?

Svchost.exe's job is to host these services, which means that svchost.exe will start them. Svchost.exe is only responsible for providing the starting conditions for these services, and cannot realize the functions of any services by itself, nor can it provide any services for users. Svchost.exe starts the system services by calling the dynamic link libraries (DLLs) of these system services.

Svchost.exe is a virus. How did this statement come from?

Since svchost.exe can be used as the host of the service to start the service, the writers of viruses and Trojans also try their best to use this feature of svchost.exe to confuse users and achieve the purpose of invading and destroying computers.

How can we distinguish between normal svchost.exe process and virus process?

The key value of svchost.exe is "HKEY _ local _ machine \ software \ Microsoft \ Windows NT \ currentversion \ svchost", as shown in figure 1. Each key value in 438+0 in Figure 65 represents an independent svchost.exe group.

Microsoft also provides us with a way to view the running services of the system in the svchost.exe list. Take Windows XP as an example: enter: cmd while running, and then enter: tasklist /svc in command line mode. The system lists the services as shown in Figure 2. The area enclosed by the red box in Figure 2 is the list of services started by svchost.exe. If you are using Windows 2000 system, just replace the previous "tasklist /svc" command with "tlist -s". If you suspect that the computer may be infected by a virus, and the service in svchost.exe is abnormal, you can find the abnormal situation by searching the files in svchost.exe. Generally, only one svchost.exe program can be found in the directory "C:\Windows\System32". If you find the svchost.exe program in other directories, it may be poisoned.

Another way to confirm whether svchost.exe is poisoned is to look at the execution path of the process in the task manager. However, because the task manager that comes with Windows system cannot view the process path, it is necessary to use a third-party process viewing tool.

The above is a brief introduction to the svchost.exe Process. In a word, svchost.exe is the core process of a system, not a virus process. However, due to the particularity of the svchost.exe process, the virus will try its best to invade svchost.exe. Whether it is poisoned or not can be confirmed by looking at the execution path of svchost.exe process.

3.Services.exe occupies 100% of the CPU usage.

symptom

On a computer based on Windows 2000, Services.exe's CPU utilization may intermittently reach 100%, and the computer may stop responding (hang up). When this problem occurs, the user connected to this computer (if it is a file server or a domain controller) will be disconnected. You may also need to restart your computer. This symptom can occur if Esent.dll mishandles the way files are refreshed to disk.

solution

Service package information

To solve this problem, please obtain the latest Microsoft Windows 2000 service pack. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

2609 10 how to get the latest Windows 2000 Service Pack?

Maintenance plan information

Microsoft has provided a supported patch, but this program is only to solve the problem described in this article. You should apply this patch only if your computer encounters specific problems mentioned in this article. This patch may be subject to other tests. Therefore, if this problem does not seriously affect you, Microsoft recommends that you wait for the next Windows 2000 Service Pack that contains this patch.

To resolve this problem immediately, contact Microsoft product support services to obtain this patch. For a complete list of Microsoft product support service phone numbers and support fee information, please visit the Microsoft website:

Note: Under special circumstances, if a Microsoft support professional determines that a specific update can solve your problem, you can waive the usual telephone support service fee. For other support problems that cannot be solved by a specific update program, the support fee will be charged normally.

The following table lists the file properties (or later properties) of the global version of this patch. The dates and times of these files are listed in Coordinated Universal Time (UTC). When viewing file information, it will be converted to local time. To understand the time difference between UTC and local time, please use the time zone tab in the date and time tool in the control panel.

situation

Microsoft has confirmed that this is a problem with the Microsoft products listed at the beginning of this article. This problem was originally corrected in Microsoft Windows 2000 Service Pack 4.

4. Normal software accounts for 100% of CPU utilization.

First of all, if this happens from startup to shutdown. Then it may be caused by some software that logs in to the system at the same time. You can open the system utility configuration tool by running the input "msconfig" and enter the start tab. Next, uncheck the suspicious option in turn, and then restart the computer. Repeat the test until you find the software that caused the failure. Or it can be realized by some optimization software such as "optimization master". In addition, if the keys in the keyboard are stuck, it may also cause the above problems when the keyboard is turned on.

If there is a problem in the process of using the computer, you can call up the task manager (WINXP CTRL+ALT+DELWIN 2000 CTRL+SHIFT "ESC"), enter the "process" tab, and look at the "CPU" column, from which you can find programs that occupy more resources (where the idle process of the system is normal, its value is generally high, and its function is to tell you how many CPU resources are available at present, so you can upgrade.

5. Viruses, Trojans and spyware account for 100% of CPU utilization.

The failure of CPU utilization 100% is often caused by virus trojans, such as shock wave virus. We should update the virus database and scan the whole computer first. Then, use anti-spyware advertising awareness to check whether there is spyware. Many friends on the forum have encountered the situation that svchost.exe occupies 0/00% of CPU/kloc, which is often a sign of poisoning.

System services in svchost.exe Windows are implemented in the form of dynamic link libraries (dlls), and some of them will point executable programs to svchost.exe, who will call the DLL of the corresponding service and add corresponding parameters to start the service. It is precisely because of its particularity and importance that it is easier to become the host of some virus Trojans.

CPU utilization caused by 6.explorer.exe process accounts for 100%.

In the system.ini file, there is a "shell= file name" under [BOOT]. The correct file name should be explorer.exe. If it is not "explorer.exe" but "shell = explorer.exe program name", then the latter program is "Trojan Horse" program, which means you have already won the Trojan Horse.

The situation in the registry is the most complicated. Open the registry editor through the regedit command, and click the directory "HKEY-local-machine \ software \ Microsoft \ Windows \ currentversion \ run" to check whether there is an unfamiliar autostart file with the extension of EXE in the key value. Remember here: some files generated by Trojan horse programs are very similar to the files that come with the system, and they want to get away with it by disguising, such as "acid battery v 1.0 Trojan horse", and download files from the registry "HKEY-local-machine \ software \ Microsoft \ Windows \ current version \ run".

The key value of Explorer is changed to Explorer = "C: \ Windows \ Explorer. Exe ",and Trojan horse program and real Explorer only have the difference between" I "and" L ". Of course, there are many places where Trojan horse programs can be hidden, such as "HKEY- current-user \ software \ Microsoft \ Windows \ current version \ running" and "HKEY- user \ * * \ software \ Microsoft \ Windows \ current version \ running". The best way is to run in "HKEY-

7. Hyper-threading causes CPU utilization to reach 100%.

The reason for this failure is also the use of P4 CPU with hyper-threading function. I looked up some information, but there was no clear explanation. Some netizens reported that hyperthreading seems to conflict with Skynet firewall, which can be solved by uninstalling Skynet and installing other firewalls, or turning off the hyperthreading function in BIOS.

8.AVI video files occupy 100% of CPU resources.

In Windows XP, after clicking a large AVI video file, the system may appear suspended animation, and the utilization rate of exploere.exe process is 100%. This is because the system must first scan the file, check all parts of the file and build an index. If the file is large, it will take a long time, and the CPU utilization rate is 100%. Solution:->-Click the folder where the video file is saved and select Properties->; General-> Advanced ",Delete" For quick search, allow indexing service to index this folder, just select the check box in front of it.

9. The CPU utilization rate of antivirus software accounts for 100%.

Nowadays, anti-virus software generally increases the function of real-time monitoring of web pages, emails and personal privacy, which will undoubtedly increase the burden on the system. For example, when playing games, it will be very slow. Turning off antivirus software is the most direct solution.

10, CPU usage is too high when processing large Word files.

The above problems usually lead to computer suspended animation, which is caused by the spelling and grammar check of WORD. Just open the Tools-Options in WORD, enter the Spelling and Grammar tab, and remove the check boxes in front of "Check spelling while typing" and "Check grammar while typing".

1 1, network connection leads to CPU utilization 100%.

When your Windows2000/xp is used as a server, after receiving a connection request from port 445, the system will allocate memory and a small amount of CPU resources to serve these connections. This happens when the load is too heavy. To solve this problem, you can modify the registry, open the registry, find HKEY-local-machine \ system \ currentcontrolset \ services \ lanmanserver, and create a new one named "; maxworkitems "； DWORD value Then double-click the value. If the memory of the computer exceeds 5 12, please set it to "; 1024"; If it is less than 5 12, set it to 256.

Some imperfect drivers will also cause high CPU utilization.

Frequent use of standby function will also cause the system to automatically turn off the hard disk DMA mode. This will not only greatly reduce the system performance and slow down the system startup speed, but also make the CPU utilization rate reach 100% when the system runs some large-scale software and games, resulting in suspension.