Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

For some time now I have been noticing that one of my svchost.exe was constantly taking 25% cpu time on my 4 core, Win7 Ultimate PC. This particular service host is hosting:

  1. Cryptographic Services (CryptSvc)
  2. Dns Client (DnsCache)
  3. Network Location Awareness (NlaSvc)
  4. Workstation (Lanman Workstation)

I suspected a virus but Windows Essential is up to date and reports nothing, and Autoruns doesn't show anything unusual.

Thanks for the help!

As per request the stack of the thread taking up 25% cpu:

ntkrnlpa.exe!KeSetEvent+0x2a1
ntkrnlpa.exe!KeDelayExecutionThread+0x5cc
ntkrnlpa.exe!KeWaitForMutexObject+0x393
ntkrnlpa.exe!KeQueryHighestNodeNumber+0x9fe
halmacpi.dll!KfRaiseIrql+0xcb
halmacpi.dll!KeRaiseIrqlToSynchLevel+0x8f
halmacpi.dll!HalEndSystemInterrupt+0x67
halmacpi.dll!HalInitializeProcessor+0xae8
ncsi.dll!NcsiIdentifyUserSpecificProxies+0x3a47
ncsi.dll+0x31f0
ncsi.dll!NcsiIdentifyUserSpecificProxies+0x4c92
ncsi.dll+0x1e93
ncsi.dll+0x20a2
ncsi.dll+0x1808
ncsi.dll+0x2240
ntdll.dll!RtlIsCriticalSectionLockedByThread+0x474
kernel32.dll!BaseThreadInitThunk+0x12
ntdll.dll!RtlInitializeExceptionChain+0x63
ntdll.dll!RtlInitializeExceptionChain+0x36

Looks like a problem with some kind of interrupts problem in the HAL? I'll try updating all my drivers and report back.

share|improve this question

4 Answers 4

Start Process Explorer (also from Microsoft Sysinternals) as administrator.

Look at the Threads tab of the svchost.exe that is consuming too much,
you can get the Stack of a very busy Thread to see what it is doing or copy the Stack here.

share|improve this answer
1  
I didn't think to check the stack and threads of the process, silly me :) –  Mikle Jul 25 '10 at 21:13
    
I updated the question, do you have further insight? –  Mikle Jul 26 '10 at 16:45

It's the DNS Client doing it. Stop the service and it'll quit. (The service isn't required anyway. It purports to speed up DNS lookups but I haven't noticed a difference since I set it to Manual.)

share|improve this answer
    
I updated the question, it's not the DNS client, but thanks for helping. –  Mikle Jul 26 '10 at 16:45
    
It does indeed sound like the DNS service, but it only happens if the HOSTS file is large and has many entries. Also, you cannot stop it once it has started pegging the CPU; you must kill the process. Then you must set it to disabled because simply killing it won’t help since it will immediately start the next time you do anything that requires looking up a domain name. And for the record, it definitely makes DNS lookups faster. Without it enabled, it takes ~3~7 seconds for any given web page to show up every time you start a new session. With it, they’ll show up in ~1 second. –  Synetech Apr 13 at 3:50

Whenever anyone finds themselves in a situation like this, the first step is to stop each of the hosted services one-by-one, waiting a few moments between each, and checking to see if the usage drops. Once you have narrowed down the problem to the specific service, then you can do a web-search to find out if others have experienced the same problem.

In this instance, it was likely indeed the DNS service (Mikle did not indicate why he thinks it is not, and his assumption about the HAL is specious).

Of the services indicated, the only one that is known to cause a 100% CPU load is the DNS service. (The only references to a high CPU load in regards to the other services is with Vista+ where they are sharing the same svchost instance as the DNS service. Sadly it often ends up going undiagnosed.[1][2]) That it would only have taken 25% of the CPU load makes sense because he said it was a four-core processor, so the DNS service was using 100% of the core it was using.

The problem occurs whenever the HOSTS file grows “too large”; for some reason, whenever the HOSTS file has too many entires, the DNS service goes into a tail-spin, starts pegging the CPU, and never recovers (no, leaving it a long time to eventually finish does not work because it never finishes, even after days).

What had likely happened in this case is that Mikle had downloaded and installed a large HOSTS file like those available from some MSMVPs or had used SpyBot’s immunization function.

Unfortunately the only option in this case is to either strip the HOSTS file down to only a few entries, or to disable the DNS service.

Note that once the DNS service flies off the handle, you will not likely be able to simply stop it like a normal service; you must actually kill the instance of svchost.exe that is hosting it. This isn’t so bad in XP because it usually gets its own copy, but in 7, it shares a copy with a few other services (though nothing critical, so you can simply re-start the other services once you have disabled the DNS service).

share|improve this answer

This is an NSA user monitor and reporting process. It summarizes user activity since last session by surveying your disk, then reports it to Virginia HQ. That's why spoolsv always floats to the top right after you kill this svchost; the summary report was in the queue.

This same process has been viro-jacked to mine bitcoins as well; it takes 10x more of your resources in that state. Just delete it, especially when it re-boots itself 3 times in a row (recent mod by the NSA to keep it running).

share|improve this answer
    
What are you talking about? Just delete what? What reboots itself three times in a row? What does the print spooler have to do with this? Can you site any sources to corroborate your claims? This “answer” sounds bogus. –  Synetech Apr 13 at 1:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.