svchost.exe shows 100% CPU ntdll.dll on Windows 7

[abbase]

Recently i had installed Windows 7 on my machine. Now the problem is that my Explorer show 2 thread for svchost.exe with 100% CPU usage. In that first one shows as ntdll.dll!RtlIsCriticalSectionLockedByThread+0x9f0 (about 50% CPU), while the second shows as ntdll.dll!RtlRegisterThreadWithCsrss+0x197 (about another 50% CPU). On my system, the Process Explorer is been showed under SVCHost.exe. In order to speed up the computer I kill the thread but from then on programs do not load correctly when they attempt to run the same line of code. So, can any one tell me that why does svchost.exe shows 100% CPU ntdll.dll on Windows 7? Any one has any idea about it? Kindly help me out to resolve the above issue. Thanks.

[Hockson]

It looks like Windows Defender service causes the high CPU usage by svchost.exe in Windows 7 x64 in several hours of Windows usage. Its the Plug And Play that's causing it. umpnpmgr.dll with ntdll.dll!tppwaiterp thread that makes the CPU spike. Windows Update installed the Windows Defender.

[.:MUNDITO:.]

Did you ever run sfc /scannow? Open it up, double click on the offending svchost.exe and go to the 'Threads' tab. Go into msconfig and using selective startup, disable everything listed on the startup tab window, and run it that way long enough to see if the problem reappears. On your first time it'll throw up a warning about not having the debugging tools, but that's ok. Sort by CPU and you'll see which DLL is sucking up all the processor time. If it does, then you might have to consider other possibilities, like a system restore or repair install.

[Viceman]

Svchost.exe is a generic process working as a host for other processes turning from Dlls, there may be several entries for this process. The best way to diagonize the problem is to perform live debug of the machine for which you need to have the windbg installed on the source machine and then set your target ( problem machine ) and perform remote debugging either using custom ports or using serial cable. Symptoms like yours are generally the result of IE 3rd party add-on's. Disable IE add-on's and see if your problem doesn't disappear.

[SUpER CoP]

In Process Explorer, choose File->Show Details for All Processes. If you right click on the svchost.exe that is using the most CPU, click Properties then click Threads, Process Explorer will show the CPU usage for the .DLLs that are being run by svchost.exe.Then try to get at the stack. If you haven't configured symbols in Process Explorer, then you need to follow the instructions in procexp.chm.