svchost.exe running @ 100%

[nawbus]

On my rather elderly HP laptop, I'm having a problem with svchost.exe running at nearly 100%. This, of course, means that everything else grinds to a halt.

I've only recently wiped it and freshly installed everything. It's running XP Home SP2.

Any suggestions?

[ajbritton]

SVCHOST.EXE is used to host certain services. Get SysInternals Process Explorer. This will show you which services the SVCHOST.EXE is hosting. That might give some clues.

[altecsole]

I had a similar problem and found that it was linked to Windows Update. The machine was fine for the first couple of minutes after startup, but then svchost maxed out the CPU for ages.

 

I think (as far as I can remember) that I'd changed the default behaviour of windows update to not download updates, but it was spending ages looking for them. Try changing the settings and see if it helps.

[nawbus]

Seem like it was something to do with Microsoft Update. Roll back to Windows Update and everything's fine! Most odd.......

[Geoff]

Reseting the Windows Update cache usually fixes that.

[eejit]

Reseting the Windows Update cache usually fixes that.

 

How do you do that, Geoff? I am suffering from this problem at the mo.

Cheers

[HodgeHi]

I also had a problem with this svchost.exe and upon reading this thread have probably just found the reason why. My problem was the svchost was crashing constantly throughout the day. It would suggest that it is due to the WSUS i have just implemented if these issues are Windows update related since i didn't have this problem previously.

[Geoff]

1. Stop the Automatic Updates Service

2. Delete the C:\Windows\SoftwareDistribution Folder

3. Start the Automatic Updates Service.

 

Also have a look at these knowledge base articles.

 

http://support.microsoft.com/kb/916089/

http://support.microsoft.com/kb/927891/

[Geoff]

Ah, and here's the hotfix.

 

http://www.microsoft.com/downloads/details.aspx?familyid=7a81b0cd-a0b9-497e-8a89-404327772e5a&displaylang=en&tm

[eejit]

Thanks for all that Geoff.

I'll apply the hotfix right now and update this thread.

[rdhawkins]

You can use tasklist.exe to see what services are running in a svchost.exe.

 

Type tasklist.exe /svc in a command prompt.

 

Might help see which service is misbehaving

[eejit]

@rdhawkins - unfortunately that is not ideal when it's a svchost process as many processes may be using that.

 

Initial returns on the Hotfix are not good

 

I'll try the manual emptying of the softwaredistribution folder next.

[DMcCoy]

The hotfix doesn't itself stop the update process from using all the CPU, it just stops it from crashing. After reading the KBs again I realised that this cpu usage is still the expected behaviour from MS.

 

Then only way I found to fix it is to reinstall my wsus server without updates for any *office* products.

[eejit]

If you just remove the office updates and re-sync do you think it'll fix the problem?

I'll give it a shot

[contink]

The hotfix doesn't itself stop the update process from using all the CPU, it just stops it from crashing. After reading the KBs again I realised that this cpu usage is still the expected behaviour from MS.

 

Then only way I found to fix it is to reinstall my wsus server without updates for any *office* products.

Just out of interest has anyone applied the patch, retained the office products and noted if the situation with the svchost process continues after the initial burst of detection.

 

It'd be interesting to find out if it keeps on happening.

[DMcCoy]

Yes, it still uses all the cpu for around 3 minutes.

[contink]

Yes, it still uses all the cpu for around 3 minutes.

Can you indicate if this happens again after every reboot, tomorrow, next week...

 

Just wondering if this is related to reboots, goes away after the Winupdate routine or just keeps on repeating.

[DMcCoy]

I think it was every reboot and every 22 hours (the schedule I set for WU to check)

[Stefletch]

Same problem here.

 

Use Process Explorer to check what is running beneath svchost.exe (and just disable that service not the whole process):

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

 

I found that for some reason an update wasn't being installed on a client becasue svchost.exe and the Windows Update Agent were at 100% CPU usage crippling the machine.. Running the Windows update through Internet Explorer directly with Microsoft, downloading the update and installing that partcular patch this way, fixed the problem.

 

Hope this helps.

 

Stephen

[eejit]

Same problem here.

 

Use Process Explorer to check what is running beneath svchost.exe (and just disable that service not the whole process):

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

 

I found that for some reason an update wasn't being installed on a client becasue svchost.exe and the Windows Update Agent were at 100% CPU usage crippling the machine.. Running the Windows update through Internet Explorer directly with Microsoft, downloading the update and installing that partcular patch this way, fixed the problem.

 

Thanks for the post, but that won't be much use on a domain unfortunately. Someone earlier mentioned process explorer too and it is a pretty cool tool - but it doesn't give you the root cause of the problem either. It just lists the 22 processes that are running under it at the time. It would be nice if there was some tool that would should you the CPU share of each of those processes. Anyway, from looking at those processes I think it is safe tp assume that wuauserv.dll is the guilty party.

 

I may just disable Windows updates for now (lowering the priority made no difference)

[altecsole]

We got fed up with svchost hogging all the cpu so we've disabled Windows updates on all our curriculum machines (we have our own WSUS server that still updates laptops and office machines).

 

We disabled updates via Group Policy. We then have the option to apply another group policy at half-term to re-enable updates, allow updates to install, and then disable them again.

[eejit]

Yep, that's what we are thinking too altesole.

[jlm1955]

1. Stop the Automatic Updates Service

2. Delete the C:\Windows\SoftwareDistribution Folder

3. Start the Automatic Updates Service.

 

Also have a look at these knowledge base articles.

 

http://support.microsoft.com/kb/916089/

http://support.microsoft.com/kb/927891/

 

Thanks, I am cautiously optimistic that this fixed my mythical 100% CPU usage by svchost. The other symptom I had, windows defender would not update and windows update would not complete.