BleepingComputer.com: 50-90% Cpu Usage By Plugplay And Dcomlaunch

I just got a new laptop, Toshiba Portege R500 with Vista Business operating system about two weeks ago. I was in a hurry to get it up and running so I didn't really look at the task manager until about a week ago, when I noticed that it's fan was constantly running. The reason is that svchost.exe consistently uses about 50% of the CPU, and the processes associated with it are PlugPlay and Dcomlaunch, which it doesn't sound like I should stop even if I could. I tried uninstalling the printer and wireless devices, and it makes no difference. I tried booting in safe mode and the problem is gone, but I'm not sure what to do with that information. I'm not at all a system administrator, so I'm at a loss for what to do next. I did try system restore to the point before I had installed anything except the windows updates that immediately were installed and SP1, but it didn't work for some unknown reason. I've googled this problem and some people suggested disabling the enhancements on the speakers, which I did, but it didn't change anything.

any advice would be much appreciated. My system is Vista Business SP1, 1.33 GHz core 2 Duo, 2 GB RAM, 32 bit operating system.

regards,

juanita

I would check to see what threads are running underneath that particular svchost.exe process with this free utility: http://www.microsoft.com/technet/sysintern...ssExplorer.mspx

Once you run it, first check to see if there's another process listed beneath it that may be causing this. Then, just right click on the offending process and select "Properties", then select the "Threads" tab. The listing there may give you some clues as to what's using the most of that process.

thanks, I did that, and there is one process under the svchost.exe, which is called igfxsrvc.exe, but it's only taking about 0-0.75 % of the CPU. The threads listed under that process are:
TID 5284 Start address igfxsrvc.exe+0x13292
TID 5300 Start address igfxsrvc.exe+0x6850
TID 1872 start address RPCRT4.dll!|_PpcSend+0x18f
TID 4296 Start address RPCRT4.dll!|_RPCSend+0x18f

When I look at the properties of the svchost.exe itself, under the service tab it again lists PlugPlay and DcomLaunch. The threads taking the CPU% are both ntdll.dll!Rt|UserThreadStart. There are about 8 or so thread IDs with that same address, but only two take up any CPU%. I also noticed that the start time of both of these threads is about the same as the current time, or a few minutes prior.

I'd suggest uninstalling your Intel graphics drivers and downloading the latest version from the Intel website (and installing it). The igfxsrvc.exe is related to your Intel Graphics Adapter software.

I will try that, but why do you think that is the problem given that igfxsrvc is showing such low cpu usage?

Because the igfxsrvc.exe process isn't malfunctioning - but it's likely that some other part of that program is. The threads view is a simplified listing of what's going on - and I'm guessing that it's related to the graphics drivers. If this doesn't fix it, then we've got other stuff to try.

I found an updated driver for my chipset on Intel's site (checked the device manager and it's Mobile Intel ® 945GM Express chipset family)--it is a newer version than the one on my computer (15.8.3.1504 vs 7.14.10.1244) However when I downloaded and tried to update the driver, it said the one I have now is up to date. Then when I clicked on the .exe that I downloaded, it said "the driver being installed is not validated for this computer, please cobtain the appropriate driver from the computer's manufacturer". Should I go ahead and uninstall the driver I have and reinstall the one I downloaded? I checked very carefully and the updated one is supposed to be for this chipset.

Just looked at the readme file on Intel site, it says the driver revision is for graphics and HDMI Audio, and my audio driver is Realtek High Definition Audio with EC--is this the problem?

That's a new warning in my experience. I'd suggest visiting the Toshiba website here: http://www.csd.toshiba.com/cgi-bin/tais/su/su_sc_modSel.jsp and entering the exact model of your Portege in order to get the Toshiba driver.

Even though the driver may be the most up to date - it may still be corrupted. That's why I suggested removing the old one first, and installing the freshly downloaded one.

I found the driver on Toshiba's website, it's from April 4 2007, version 7.14.10.1244 (the one on my laptop currently). Sorry for the stupid question, but do I need to uninstall and then reinstall, or can I just reinstall over the current version? If I uninstall the graphics driver, will I be able to see anything to reinstall?

Yes, uninstall in case the currently installed driver is corrupted. This will give you a "new" driver that's the same update level as the one that's on your system - but the uninstall will remove most of the old driver's files and the reinstall will install fresh copies of them (that, presumably, aren't corrupted).

OK, so I uninstalled fully, deleting the drivers, then reinstalled/restarted (using the drivers I downloaded from toshiba). No change in cpu usage by svchost, and the igfxsrvc still showed up in process explorer. So then I unistalled and restarted, w/o installing any graphics drivers. the system had that funny safe mode appearance, but no change in cpu usage by svchost (still ~50%) and no igfxsrvc showed up underneath it in process explorer.

so does that rule out the graphics drivers?

That should rule out the graphics drivers as the cause. That only leaves the RPCRT4.dll as an issue - which is a part of the Windows operating system and is used by many different programs.

The next thing to check would be your startup programs - stopping each one of them and then rebooting to see if it fixes it. You can use MSCONFIG for this, but I prefer disabling things in Vista through the Windows Defender → Tools → Software Explorer interface.

I checked out Windows Defender-software explorer, but on the startup programs, the buttons to disable or enable are greyed out. If I just stop a service, it starts back up when i restart. How do disable things for the next startup? thanks

Try right clicking on Windows Defender and selecting "Run as Administrator"
Another way to stop these is by using this free program: http://www.microsoft.com/technet/sysintern...s/Autoruns.mspx