svchost.exe taking 25% cpu

Question

For some time now I have been noticing that one of my svchost.exe was constantly taking 25% cpu time on my 4 core, Win7 Ultimate PC. This particular service host is hosting:

1. Cryptographic Services (CryptSvc)
2. Dns Client (DnsCache)
3. Network Location Awareness (NlaSvc)
4. Workstation (Lanman Workstation)

I suspected a virus but Windows Essential is up to date and reports nothing, and Autoruns doesn't show anything unusual.

Thanks for the help!

As per request the stack of the thread taking up 25% cpu:

ntkrnlpa.exe!KeSetEvent+0x2a1
ntkrnlpa.exe!KeDelayExecutionThread+0x5cc
ntkrnlpa.exe!KeWaitForMutexObject+0x393
ntkrnlpa.exe!KeQueryHighestNodeNumber+0x9fe
halmacpi.dll!KfRaiseIrql+0xcb
halmacpi.dll!KeRaiseIrqlToSynchLevel+0x8f
halmacpi.dll!HalEndSystemInterrupt+0x67
halmacpi.dll!HalInitializeProcessor+0xae8
ncsi.dll!NcsiIdentifyUserSpecificProxies+0x3a47
ncsi.dll+0x31f0
ncsi.dll!NcsiIdentifyUserSpecificProxies+0x4c92
ncsi.dll+0x1e93
ncsi.dll+0x20a2
ncsi.dll+0x1808
ncsi.dll+0x2240
ntdll.dll!RtlIsCriticalSectionLockedByThread+0x474
kernel32.dll!BaseThreadInitThunk+0x12
ntdll.dll!RtlInitializeExceptionChain+0x63
ntdll.dll!RtlInitializeExceptionChain+0x36

Looks like a problem with some kind of interrupts problem in the HAL? I'll try updating all my drivers and report back.

Answer 1

Start Process Explorer (also from Microsoft Sysinternals) as administrator.

Look at the Threads tab of the svchost.exe that is consuming too much,
you can get the Stack of a very busy Thread to see what it is doing or copy the Stack here.

Answer 2

It's the DNS Client doing it. Stop the service and it'll quit. (The service isn't required anyway. It purports to speed up DNS lookups but I haven't noticed a difference since I set it to Manual.)