Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

execution service stopped working and was closed


  • This topic is locked This topic is locked
9 replies to this topic

#1 DBBBleeping

DBBBleeping

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:27 PM

Posted 30 September 2016 - 11:33 PM

"execution service stopped working and was closed"

 

This message has just started to pop up frequently (3-4 times a day?).  Seemingly, there is no outright problem associated with it, however I have noticed two other issues that may or may not be connected.  

 

One:  When I look at the Resource Monitor, the average CPU usage is about 55-60% but there is no "image" listed in the resource monitor that is using that CPU amount.  Always before, the percentages added up to the total shown and when nothing was going on, the percentage was near zero..  It shows 50-60% even when no programs are open.

 

Two:  I'm having problems with the audio.  When there is any sound, system or youtube, for example, the sound is erratic and stutters.  So much so that I cannot look at videos or use Skype.

 

Are these issues related?  Can anyone address any of the three?

 

I have used chkdsk.exe with no problems noted (there was one error in the event log that recommended running it).  Have also run Malwarebytes and SpyBot with no effect.

 

Thanks for any help you can give.

 

Doug



BC AdBot (Login to Remove)

 


#2 DBBBleeping

DBBBleeping
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:27 PM

Posted 01 October 2016 - 06:36 PM

Could it have something to do with the Opera Browser?  It seems like it happens when there is something weird going on with Opera.



#3 lmacri

lmacri

  • Members
  • 466 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:05:27 PM

Posted 01 October 2016 - 09:19 PM

One:  When I look at the Resource Monitor, the average CPU usage is about 55-60% but there is no "image" listed in the resource monitor that is using that CPU amount.  Always before, the percentages added up to the total shown and when nothing was going on, the percentage was near zero..  It shows 50-60% even when no programs are open.

 

Hi DBBBleeping:

 

When you view your installed updates at Control Panel | Programs and Features | View Installed Updates and sort by the date of installation, what is the last date that Windows Update was able to successfully install security updates for your Vista OS and IE9 browser (i.e., excluding virus definition updates for Microsoft security programs like Windows Defender, Microsoft Security Essentials, etc.).  Does it look like your Windows Update ran normally for the September 2016 Patch Tuesday updates on or around 13-Sep-2016?

 

Attached File  Vista SP2 Last Installed Updates Sep 2016.png   75.46KB   0 downloads
------------
32-bit Vista Home Premium SP2 * Firefox v49.0.1 * NIS v22.8.0.50 * MBAM Premium v2.2.1



#4 DBBBleeping

DBBBleeping
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:27 PM

Posted 02 October 2016 - 10:24 AM

 

 

 

 

Hi Imacri,

 

Thanks for responding.

 

I have installed on 9/17/16 as you referenced:

 

Sec Update K....644

Sec Update K....024

Sec Update K....186

Sec Update K....122

Sec Update K....319

 

I DO NOT have installed as you referenced:

 

Update for Windows KB3177723

 

 

ADDITIONALLY, I do have installed:

 

Sec Update KB3185911

Update for Windows KB3185662

Update for Windows KB3182203 Installed 9/23/16

 

 

Does that tell you anything??

 

Thanks again,

 

Doug



#5 lmacri

lmacri

  • Members
  • 466 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:05:27 PM

Posted 02 October 2016 - 12:26 PM

Hi DBBBleeping:

Many Vista SP2 users are currently affected by a problem with their Windows Updates where the initial "Checking for updates..." phase can hang for several hours - see CurtimusPrime's recent thread windows updates are not working [vista sp2 32bit].  One of the common symptoms of this problem is that the host process svchost.exe will completely saturate one core of the user's CPU (i.e., 50% consumption of CPU on a machine with a dual core CPU) for several hours, and Sysinternal's Process Explorer will show that all this CPU is consumed by the Windows Update service wuauserv, and more specifically by a thread for the Windows Update Agent (wuaueng.dll). See Kayla77's thread Processes in Task Manager During Updates for instructions on how you can use Process Explorer to find the specific process consuming your CPU.

 

Attached File  WU PE svchost wuauserv 14 Apr 2016.png   60KB   0 downloads

I'm not sure if your automatic Windows Updates are scheduled to check for available updates on a daily basis, but it sounds like your September 2016 Patch Tuesday updates that were released by Microsoft on 13-Sep-2016 eventually ran to completion around 17-Sep-2016.  Don't worry about KB3177723 - it's an odd patch related to a change in Daylights Saving Time (DST) for users located in Egypt.  This patch was originally posted as an Important update (no one is sure why) and Microsoft probably changed to an optional update by the time your updates ran on 17-Sep-2016.

If your Vista machine is affected by these slow Windows Updates, and that is the only issue currently affecting your machine, your CPU should have dropped back to normal once Windows Update was able to install your September 2016 Patch Tuesday updates - at least until the October 2016 Patch Tuesday updates are released on 11-Oct-2016 and the slow Windows Updates and high CPU activity returns.

Are you still seeing any of the symptoms you mentioned in your original post such as high CPU consumption, stuttering audio when you view videos, and intermittent warnings about "execution service stopped working and was closed"?  That last symptom in particular could indicate that you have some hidden malware or some lower-risk PUP (potentially unwanted program) on your system - perhaps a browser hijacker or adware that was added to your Opera browser after you ran a software installer bundled with an unwanted program.  You mentioned you scanned your system with Malwarebytes Anti-Malware and Spybot Search & Destroy, but do you have an antivirus program running in real-time protection mode on your computer that you can use to run a full system scan of your hard drive(s)?

If you've seen any unusual activity on your computer since 17-Sep-2016 I'd suggest that you start a new thread in the Virus, Trojan, Spyware, and Malware Removal Logs board and have a trained malware removal specialist work with you one-on-one to see if there is any malware on your system.  Just be sure to read their guidelines at Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help so that you know what information they need in your first post.

------------
32-bit Vista Home Premium SP2 * Firefox v49.0.1 * NIS v22.8.0.50 * MBAM Premium v2.2.1


Edited by lmacri, 02 October 2016 - 12:35 PM.


#6 lmacri

lmacri

  • Members
  • 466 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:05:27 PM

Posted 02 October 2016 - 02:16 PM

If your Vista machine is affected by these slow Windows Updates, and that is the only issue currently affecting your machine, your CPU should have dropped back to normal once Windows Update was able to install your September 2016 Patch Tuesday updates - at least until the October 2016 Patch Tuesday updates are released on 11-Oct-2016 and the slow Windows Updates and high CPU activity returns.

 

Hi DBBBleeping:

 

I should add that there's one simple way to see if Windows Update is responsible for your high CPU consumption.  Completely disable your automatic Windows Updates [Windows Update | Change settings | Important updates | Never check for updates (not recommended)], click OK, and re-boot a few times to terminate any Windows Update sessions currently running in the background on your system.  Then monitor your system for a few days, and if your CPU drops back to normal and your other symptoms disappear that's a good indication that Windows Update is at least part of the problem.

 

Attached File  Windows Update Never Check for Updates.png   30.84KB   0 downloads

------------
32-bit Vista Home Premium SP2 * Firefox v49.0.1 * NIS v22.8.0.50 * MBAM Premium v2.2.1


Edited by lmacri, 02 October 2016 - 06:05 PM.


#7 DBBBleeping

DBBBleeping
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:27 PM

Posted 03 October 2016 - 09:20 AM

Thanks Imacri for the thorough response.  There's a lot in there so I will take some time and get back to you with answers.  I do use AVG and will do a scan.



#8 DBBBleeping

DBBBleeping
  • Topic Starter

  • Members
  • 31 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:27 PM

Posted 03 October 2016 - 09:17 PM

Imacri,

 

Here's what I've done:

 

Ran a scan with AVG.  It found some trojan horses in my deleted emails but it's not clear if they were active on my computer or just in the attachments that I DIDN'T open.  In any case, the operation is the same as before they were quarantined.

 

I did disable Windows updates but have not restarted or monitored it yet - will do so in the coming days.

 

I went to the link about using Process Explorer ( http://www.vistax64.com/windows-updates/304546-processes-task-manager-during-updates.html#post1406928) and could not find any evidence of wuaueng.dll.  However, I noted that PE gave a different value for CPU usage than the Resource Monitor that I usually look at.  I have attached a screen shot of it - the Resource Monitor show 59% CPU usage and the System Information pane of the PE shows 17%.  Don't know if that is significant.  Also PE showed a 41% usage for System Idle Process - is that significant?  As you can see, as mentioned before, the resource Manager shows 59% CPU usage but the description only accounts for a total of 6%.  What's up with that?

 

I am still seeing  the symptoms I mentioned in my original post such as high CPU consumption, stuttering audio when you view videos, and intermittent warnings about "execution service stopped working and was closed" .   No change there.

 

Shall I start a new thread in the Virus, Trojan, Spyware, and Malware Removal Logs board?

 

BTW, I just noticed these anomalies in the last week - before that the computer was idle for a month while I was away.

 

Thanks again for your help.  

 

Doug

Attached Files



#9 lmacri

lmacri

  • Members
  • 466 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Canada
  • Local time:05:27 PM

Posted 04 October 2016 - 08:36 AM

Hi DBBBleeping:

I can't diagnose what, if anything, is wrong with your computer from the screenshot you've posted.  The fact that AVG detected and quarantined Trojans on your system would suggest to me that, yes, it would be a good idea to have a malware removal specialist check your system in the in the Virus, Trojan, Spyware, and Malware Removal Logs board.  It normally takes a few days for a specialist to be assigned to your case and review your diagnostic logs, and while you're waiting you can monitor your CPU consumption while automatic Windows Updates are disabled. Try not to make any major changes to you system after you've submitted your diagnostic logs for analysis.
_________________________

Just a few random observations:

I see your Resource Monitor and Process Explorer both showing 17% CPU consumption, with most of that activity consumed by a process called node.exe.  I can't tell if node.exe is associated with legitimate software or malware from the information in your screenshot (see my hint below about Process Explorer).  The 59% CPU consumption you're referring to was probably just a temporary spike in activity you captured in your screenshot.

 

Attached File  DBBBleeping CPU 17 Percent.png   19.25KB   0 downloads

When you look at your CPU consumption on the Processes tab of Task Manager, by default the list only displays the processes running under your own user account.  You must click the Show processes from all users button to see all the processes running on your computer, including those running under user SYSTEM (i.e., your Windows operating system) like the System Idle Process.  Your "missing" CPU could be consumed by the host process svchost.exe or some other process running under SYSTEM when Windows Update is running in the background.

Attached File  Vista Task Manager Show All Processes.png   12.11KB   0 downloads

See the Ask Leo article What is the System Idle Process and why is it using most of the CPU?  It's normal for this idle process to account for most of the CPU activity on your computer.  The CPU consumed by the System Idle Process is basically 100% minus the total CPU consumed by all other processes running on your computer (e.g., 100% - 59% CPU consumption = 41% allocated to the System Idle Process).

You had 140 processes running on your system that consumed 71% of your available memory (RAM) when your screenshot was captured.  The hardware specs shown in your user profile are very similar to my own machine, and just for comparison I normally have about 60 processes loaded into memory that consume about 50% of my 3 GB of RAM. A portion of your system resources might be consumed by malware or PUPS, but I'm guessing that you have quite a few legitimate (but unnecessary) programs that start automatically when you boot up your computer and degrade your system performance by consuming CPU and memory.  I'd suggest you review all your startup programs and see if there are any "optional" software programs loading into memory at boot-up that don't really need to be configured to always start with Windows.

 

One useful tip for Process Explorer (PE).  If you don't see a column in PE named VirusTotal, go to Options | VirusTotal.com and ensure Check VirusTotal.com is enabled. Then go to View | Select Columns... and ensure that VirusTotal is selected.  When VirusTotal integration is enabled, PE will submit the SHA-256 hash (digital fingerprint) of every process running on your computer to the VirusTotal.com website for analysis by approx. 50 different malware scanners (e.g., AVG, Kaspersky, Norton, McAfee, Malwarebytes, etc.).  A low detection rate (e.g., 0/56) means the file is safe, but a high detection rate (e.g., 5/56) means that the file is suspicious and could be associated with malware - see the Windows IT Pro article Process Explorer v16.0 Integrates VirusTotal.  Clicking the link in the VirusTotal column will take you to the full report for the process on the VirusTotal .com site - see the report <here>, for example, for the "safe" firefox.exe process for my Firefox browser.

 

Attached File  PE VirusTotal Integration.png   49.41KB   0 downloads

------------
32-bit Vista Home Premium SP2 * Firefox v49.0.1 * NIS v22.8.0.50 * MBAM Premium v2.2.1


Edited by lmacri, 04 October 2016 - 06:04 PM.


#10 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 35,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:03:27 PM

Posted 06 October 2016 - 03:19 PM

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/628798/execution-services-stopped-constant-high-usage-of-cpu-and-audio-issues/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic. Good luck with your log.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users