Windows 7 has High CPU Usage and slow performance

Thanks for the pointers. The log has 1691 errors since 12/9/10. The vast majority are

7000 and 7009; one of each is pasted below. There are also several occurrences of 10016, also pasted below.

==============================================================

Log Name:      System

Source:        Service Control Manager

Date:          7/6/2011 12:29:20 PM

Event ID:      7000

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Phyllis-PC

Description:

The Windows Search service failed to start due to the following error:

The service did not respond to the start or control request in a timely fashion.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7000</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2011-07-06T17:29:20.722208400Z" />

    <EventRecordID>236617</EventRecordID>

    <Correlation />

    <Execution ProcessID="516" ThreadID="612" />

    <Channel>System</Channel>

    <Computer>Phyllis-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">Windows Search</Data>

    <Data Name="param2">%%1053</Data>

  </EventData>

</Event>

==============================================================

Log Name:      System

Source:        Service Control Manager

Date:          7/6/2011 12:29:20 PM

Event ID:      7009

Task Category: None

Level:         Error

Keywords:      Classic

User:          N/A

Computer:      Phyllis-PC

Description:

A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />

    <EventID Qualifiers="49152">7009</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8080000000000000</Keywords>

    <TimeCreated SystemTime="2011-07-06T17:29:20.644208300Z" />

    <EventRecordID>236614</EventRecordID>

    <Correlation />

    <Execution ProcessID="516" ThreadID="612" />

    <Channel>System</Channel>

    <Computer>Phyllis-PC</Computer>

    <Security />

  </System>

  <EventData>

    <Data Name="param1">30000</Data>

    <Data Name="param2">Windows Search</Data>

  </EventData>

</Event>

==============================================================

Log Name:      System

Source:        Microsoft-Windows-DistributedCOM

Date:          7/8/2011 11:06:14 AM

Event ID:      10016

Task Category: None

Level:         Error

Keywords:      Classic

User:          Phyllis-PC\Don

Computer:      Phyllis-PC

Description:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{0C0A3666-30C9-11D0-8F20-00805F2CD064}

 and APPID

{9209B1A6-964A-11D0-9372-00A0C9034910}

 to the user Phyllis-PC\Don SID (S-1-5-21-246660048-2740790885-2295934497-1001) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

  <System>

    <Provider Name="Microsoft-Windows-DistributedCOM" Guid="{1B562E86-B7AA-4131-BADC-B6F3A001407E}" EventSourceName="DCOM" />

    <EventID Qualifiers="49152">10016</EventID>

    <Version>0</Version>

    <Level>2</Level>

    <Task>0</Task>

    <Opcode>0</Opcode>

    <Keywords>0x80000000000000</Keywords>

    <TimeCreated SystemTime="2011-07-08T16:06:14.000000000Z" />

    <EventRecordID>236924</EventRecordID>

    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />

    <Channel>System</Channel>

    <Computer>Phyllis-PC</Computer>

    <Security UserID="S-1-5-21-246660048-2740790885-2295934497-1001" />

  </System>

  <EventData>

    <Data Name="param1">application-specific</Data>

    <Data Name="param2">Local</Data>

    <Data Name="param3">Activation</Data>

    <Data Name="param4">{0C0A3666-30C9-11D0-8F20-00805F2CD064}</Data>

    <Data Name="param5">{9209B1A6-964A-11D0-9372-00A0C9034910}</Data>

    <Data Name="param6">Phyllis-PC</Data>

    <Data Name="param7">Don</Data>

    <Data Name="param8">S-1-5-21-246660048-2740790885-2295934497-1001</Data>

    <Data Name="param9">LocalHost (Using LRPC)</Data>

  </EventData>

</Event>

What is your computer make and model?

What is your anti-virus software?

Have you installed any registry cleaners or optimisers? If not do not be tempted to do so.

Is your computer free from error? It concerns me that the actions taken by you to date could have introduced error.

Event Viewer Reports

1. Normally when an error occurs on your computer looking in Event Viewer should be your starting point for finding a solution. Most system related errors are logged and getting an exact copy of the relevant report is important. Unfortunately understanding the reports is not easy and most computer users need help with their interpretation. I have more to say later on interpretation.
2. Event Viewer comprises three main Windows logs. These are Application, Security and System. For troubleshooting purposes System is by far the most important.
3. To access the System log select Start, Control Panel, Administrative Tools, Event Viewer, from the list in the left side of the window select Windows Logs and System. Place the cursor on System, right click and select Filter Current Log. Check the box before Error and click on OK and you see only Error reports. Click on the Date and Time Column Header to sort. You may need to click a second time to see the latest Report at the top.
4. A tip for posting copies of Error Reports! Run Event Viewer and double click on the error you want to copy. Click on the Copy button to place a copy on your Clipboard and close Event Viewer. Now start your message and paste into the body of the message. Make sure this is the first paste after exiting from Event Viewer.
5. There are three types of Report, being Information, Warning and Error reports. In most situations it is Error Reports that offer the best information but occasionally Warning Reports provide useful clues.
6. All reports have date and time stamps and when troubleshooting it is important to concentrate on more recent reports. Study reports since the point when the computer was last booted and then check whether a similar report appeared in the previous session. If errors do not repeat investigation as to why they occurred is wasted effort.
7. Within individual reports the more important information is Event ID and Source as these help when looking for help on the internet. The description is equally important and copying the exact text for use as the search criteria greatly helps getting better results when using Google. Do not paraphrase descriptions when asking others for help.

I tried most of the suggestions above - disabled media player, updated drivers, massive search for malware, etc. Nothing helped.

My problem was (is) that when the OS comes out of hibernate mode the hardware abstraction layer service goes nuts - it and the deferred procedure call service begin using 100% of cpu, and stay that way until a reboot.  i was able to replicate this behavior several times by letting the system go to sleep with resource monitor running, and see the trace leap from 2% to 100% when I woke it back up. I disabled the energy saving features for sleep or hibernate and hav not had the problem since (several weeks of uptime).

To see if this is what's killing yours, launch task manager, go to "performance", launch resource Monitor, and click the CPU column to sort active processes by CPU usage.

Don C.

It is always sensible in this situation to run a check for malware.

Boot the computer to safe mode with networking and download and install Malwarebytes (freeware version for home users only), update definitions and run in safe mode. Disable other security software whilst you are doing scans.

http://www.precisesecurity.com/how-to/ht-smodewnet.htm

http://www.malwarebytes.org/products/malwarebytes_free

Download and run SuperAntiSpyware (Free Edition)

http://www.superantispyware.com/download.html

Some malware is now installing proxy server entries redirecting internet connections. If you encounter this problem see Step 2 in the link which follows:

http://www.myantispyware.com/2011/02/21/how-to-remove-internet-security-essentials-virus/

At this time these are a good combination which seems to detect most malware but it can miss malware as all security software can do.

http://windowslivehelp.com/thread.aspx?postid=6e2ae14a-2876-4d9e-b311-4f6fb4878a9d#6e2ae14a-2876-4d9e-b311-4f6fb4878a9d