How to check what causes the system lockup, locate and resolve the problems?
While all that can be done in a one-pass way utilizing the desktop management techniques with some efforts applied we can try to handle this manually using command line tools, built-in windows tools, and surely the fix from Microsoft.

Fist of all, we need to trap the suspect process.
What we get from the users? Just the general info like "My PC is working like my Apple II two decades back". User reports that he just booted the computer and cannot start neither any of Office applications nor any other applications. Even the task bar gets screwed up if you will move the mouse pointer over it and release it to by clicking the icons in notification area or window tabs right on the taskbar. Everything hands and the computer itself behaves the way it was ages before. That's an example of the typical rant/compliant you can get from your mail or phone.

So what should be our fist steps?
As Windows is (in a very limited abstracted way of view) about subsystems, processes and threads we need to find the process that causes the system hang.
The quickest way to do what hangs our system is to fire up the Windows Task Manager. While there's a fully descriptive answer on how to use it the simplest way that works all the time is to use the keyboard combination and press Ctrl+Esc. Well, you can also press the standard Ctrl+Alt+Del, but as we know the button to start it can be removed from the logon screen widow using the Remove Task Manager policy. That's what is the first about the difference and the preferences. The second is that while Ctrl+Esc combination opens right the Windows Task Manager window itself, Ctrl+Alt+Del shortcut is far more general combination and is used actually to open Windows logon screen window.

A little tip: you can switch between different types of logon screen - logon window and welcome screen by following these steps. Don't mix it with Windows 2000 welcome sceen.

What to do if you don't see the Windows Task manager button on your logon window?

1. Log on to the system using your account that has administrative pribileges and is not restricted from opening MMC snap-ins
2. Click Start > Run and type rsop.msc to open the Resultant Set of Policy snap-in
3. In the left panel within the Resultant Set of Policy snap-in navigate to the folder User Configuration\Administrative Templates\System\Ctrl+Alt+Del Options and check whether you have the Remove Task Manager policy defined in the right panel
4. If you have and the policy contains Enabled in the State column that is the use of the Task Manager button was prevented on this machine

The Task Manager is opened. Now what?
Switch to the Performance tab to see the statistics showing you the general information about memory and CPU consumption. I bet you will see the CPU is taking 100% from the CPU Usage bar. If so, we need to know what gets all the system and CPU resources. To do that

1. Switch to the Processes tab
2. Click View > Select columns... and check CPU Usage and CPU Time, and PID (Proccess Identifier) checkboxes within the Select Columns dialog
3. Click OK to save the settings and close the window
4. Sort the CPU column by clicking on it twice to show the most CPU consuming process on top of the list
5. That should be the svchost.exe process that takes so much of CPU time

By the way, if you wish, you can get how much time it took from the overall amount of CPU time. From my experience, these locks are sometimes so long-term so they took from 15 minutes to an hour of processor time. Compare it with the time taken by your Word processor that you always claim for the slow work.

6. Now find what you have written in the PID column for the row with the faulty process and write it down somewhere we will need this info in our future steps

Some tricky info about the CPU Time
If you have multicore or hyperthreading processor, note that CPU time represents the summary for or your physical or virtual cores. Thus if you have 2 cores, you need to divide the CPU time you see in the CPU column by 2 to get the time for one. That's a very-very rough calculation as the core load is not equally distributed between the cores. That actually depends on how well written the applications is, how much threads it uses and if there were any multicore optimizations made by developer. But at least you will get why your second hand is running so fast.

I am almost 100% sure that you will see the svchost.exe process listed as the most CPU consuming one in the Image Name column in the task manager window

What does the svchost do?

Shortly speaking the process hosts (as it comes from the name) other system processes which in windows terminology are called as services. You can get more information about what is the reason to have this process running on the system from this article.

How to find which service is hosted by this process? There are ways to do that and two of them we will discuss later.

Com ele você pode controlar a velocidade e voltagem da sua CPU, controlar e monitorar o HD, e muito mais.

Fonte: ShellCity

Technorati : CPU Clock, CPU Load, Controlando, Notebook, Resfriá-lo

We can retrieve this information using the Service Controller (commonly known as SC) utility.

But before doing that we need to get a list of working services. This can be done by controlling the services using Services snap-in, using the mentioned SC.exe, using tasklist tool, or controlling it remotely by connecting to the affected computer from the remote place and managing the services on it in the real time.

How to retrieve service status using the Services snap-in
1. Click Start >> Control Panel >> Administrative Tools >> Services
2. In opened Services windows click twice on the Status column within the right panel
3. The snap-in will sort your services so that those ones that are currently working will appear on the top of the list

NOTE: The shortest way to open the services snap-in is to click Start >> Run and type services.msc

NOTE: If there's a lot of services running on your computer and you know the service name, and you know the name of the service you are searching within the list, you can just press the key on the keyboard with the letter that corresponds to the letter the name of the service starts with to rich the service position in the service list. Windows automatically sorts and scrolls the selection to the typed name. If you are quick enough in your typing you can type something like .NET Runtime Optimization Service v2.0.50727_X86 and navigate to the Microsoft .NET Framework NGEN service in a flash.

By the way, if you are unfamiliar with .net but want to know what the native image generator is, you can read info about it and more specific info in this brilliant article in MSDN magazine.

How to retrieve service status using the Service Controller
This is quite simple. Just
1. Open command window by typing %comspec% in the Run dialog or in Windows explorer window
2. In the command window type
SC query

NOTE: if output is big enough to fit your command window buffer, redirect SC output to the more command input using this command
sc query |more
Notice, there's a space after the sc argument but no spaces after the pipe symbol.
Useful tip: to force more command to display text splitting it in pages so that the output will be displayed in chunks filling one whole window at the time press Space bar when asked by more utility

Service controller outputs lot of information that's hard to find in the output on the display. To save our eyes we can redirect output from the console to the file by running this command
sc query>c:\servicequery.txt

What we want to get is the service status and, preferably the description. In that situation it's probably more handy to get the list by extracting the information from the Services snap-in window. To do that
1. Open Services snap-in as described above
2. Select Action >> Export List
3. Select the save file type (comma separated file preferably)

How to retrieve service status using the Task List utility
You may ask, why we need another utility when we already retrieved service status? The answer as easy. We retrieved the service status, and that's the major step forward, but we still have not retrieved the information that will stick two parts of our conversation in a single consistent one. I mean that we need to find the connection between the hosting process that harms our system performance that we located in previous sections on this page. Here's where we will use the process PID we wrote down.

1. Open command window by typing %comspec% in the Run dialog or in Windows explorer window
2. In the command window type
tasklist /svc
This command will list all services that are currently working on your computer. But besides the service name it will output the process, the image name, its PID and the whole list of services that are hosted by the process. That's what we need the PID for. Now locate the PID of a process that hangs the system and locate it in the list of the command output.

Very likely that will be that process that hosts the major part of services and has the several services listed in the Services column like
AudioSrv, Browser, CryptSvc, .... , Themes, TrkWks, W32Time, winmgmt, wuauserv, WZCSVC

As the system lockup occurs right when you connect to the internet, that's likely that this the service which searches for something when it gets the connection the one who is the source of all problems here. So we can drill thought all the list of services hosted by this process. But how we can get what is that wuauserv listed there? We need to get the service name.

How to get service name using the SC utility

1. Open command window by typing %comspec% in the Run dialog or in Windows explorer window
2. In the command window type
sc GetDisplayName wuauserv

it will return service name. In this example it will be
Name = Automatic Updates

NOTE: I use %comspec% environment variable instead of running the command window directly. It's the good way to avoid problems with running another image of cmd.exe. To check what image corresponds to the path selected when you use this vriable use set command.

Additional information about service control programs can be found in this section.

What to do if you are running out of ideas and need to fix service status?
If you see, everything goes wrong with your services and you have no clue what to do, don't panic. First try resetting service settings to the default state that they have right after installing the operating system. You can find the list with default settings for all services available in Windows by default on this page.

What to do next?

We localized the service name and what we should look for. It's the problem with Windows Automatic Updates service, that is described in the article KB 916089. But one of the solutions is hidden in the next article.

Here's what we can do to fix this issue

We will re-registed the Windows Update Components and then set the update patch from the KB 916089. To do that we need to stop all services that may interfere with the process, flush the SoftwareDistribution folder to eliminate problems connected with corruption of folder storage, register the Windows update libraries with regsvr32 COM registration utility and apply patch at the end of the procedure.
Here's the example of batch file that can be used to automate this task.

rem Here we stop the Automatic Updates service itself to unlock libraries
net stop wuauserv
rem Stopping Background Intelligent Transfer Service what's not necessary but better to do to avoid interfering with server-client transfers
net stop bits
rem Removing the Automatic Update service storage folder content out to the temporary storage
move %SystemRoot%\SoftwareDistribution %TEMP%\SoftwareDistribution
rem Registering Service components
regsvr32 /s wuapi.dll
regsvr32 /s wuaueng.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s atl.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups.dll
regsvr32 /s wups2.dll
regsvr32 /s wuweb.dll
rem Setting up the KB 927891 fix patch
rem Defining the storage where to look for the fix
set fix=c:\patches
rem Windows Automatic Updates SVCHOST 100% CPU Load patch for Windows XP X86
%fix%\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart

You can find another fixes on the KB page and add them to the end of batch file if you want to update Windows Server 2003 machines too.

Technorati: office update system hang 100% load snap-in manage tasks process identification control service process view CPU load svchost windows update desktop management service remote control PID microsoft update service status remote management tips&tricks

Best practice with working with services
Automatic Distribution of Patches Throughout the Active Directory Clients