How do I troubleshoot high 'svchost.exe' usage in Windows 7?

Question

I'm having a problem with Windows 7 64-bit. I thought it was slow and all then I saw that the CPU usage was always around 80% and started digging through Google.

There's two svchost.exe's consuming around 30% each and in the resources monitor there's a system interrupts consuming 45% all the time. I tried closing the applications but it makes no difference.

I tried some other things that I've found on Google like disable system updates but it didn't work.

I don't know if it will help but here's my specs:

Core 2 duo 4400
ATI radeon 4850
4GB DDR2 RAM

---

EDIT

I ran the suggested program and got this info; did I get it right?

---

EDIT

As you asked here it is, did I get it right now? The other TCP/IP there's nothing.

EDIT

I ran msconfig and took the services that one of the svchost.exe was using out of the startup and now my CPU is around 50%, but I still would like to improve it further. I can't lose that much CPU power just because of Windows...

---

EDIT

Yeah, there's nothing I can do here, going to install XP for a while, it's really weird...

Answer 1

Use a program like Process Explorer to determine which svchost.exe is consuming the resources. Is the svchost being run from services.exe? What are the commandline arguments for that particular svchost? There are several svchost run via Windows, you will need to isolate which one is consuming those resources. Process Explorer will display which services are associated with that process, as well as display which TCP/IP ports it is using.

Click on the Process tag so the processes show in a tree format to confirm it is being run via services.exe.

Although from looking at your Services tabs, they look legitimate.

First svchost looks like `svchost.exe -k LocalServiceNoNetwork`
Second svchost looks like `svchost.exe -k LocalServiceNetworkRestricted`

Do you have anything aggressively hitting your Windows Firewall? What do the TCP/IP and Threads tabs show? The threads tab will display CPU information for the threads within each process. Have you tried to restart the services specified or checked your eventlog to see a lot of errors?

Are you running any indexing of media files or have anything on your LAN attempting to access those media files?

That's a lot of EtwTraceMessageVa calls. Have you checked your eventlog? At the rate it's using CPU there has to be something in WMI writing to ETW. Better question, did this start recently and do you have a restore point before it happened?

Answer 2

I think you'll find Svchost Viewer to be useful.

You can use it to determine which program is doing most by viewing the amount of data written and such. It should help in some way to determine which process is doing what.

Answer 3

A number of viruses can run under the name of svchost, so it's best to check you've got decent anti-virus running and updated. It's just as likely to be a non virus-related Windows problem though.

Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs) and you can analyse what these particular svchost processes are using Svchost Process Analyzer

Answer 4

I just had one of the svchosts processes, out of nowhere, start to cripple my Win7 32bit PC for the last 2 days, with the (Dual Core) CPU stuck on 100%. This particular svchost process was responsible for over a dozen net services process threads, all of which appeared to be standard necessary network services.

Using a combination of new admin alerts in the EventVwr, Sys Internals Process Explorer and svchost analyser, I narrowed it down to the main culprit being:

Windows Live Mesh Remote Desktop service

Disabling this in services got me back about 60% of my CPU, and this particular svchost service then dropped off in task manager.

It was then replaced by another, utilising some 35 - 45%. By right clicking in Task Manager and going to the service, the only service attributed was Windows Defender.... (and we've all heard of that one before).

As many don't realise it's installed with Windows 7 by default (you can't see it in your programs list), this link show a nice tuorial on how to disable it.

http://www.simplehelp.net/2009/03/11/how-to-disable-windows-defender-in-windows-7/

Answer 5

I also have had an issue with svchost.exe causing 100% cpu usage. The services in question related to svchost are NLASvc, LanmanWorkstation, Dnscache, and CryptSvc. My problem ended up being Firefox. In the latest version they added plugin-container.exe which runs as a process separately from Firefox. The idea behind it is if a plugin crashes it wont crash Firefox or your browsing session. But it made surfing on my system unbearable.

The solution: Disable plugin container process.

Open Firefox web browser. Type about:config in the address bar and press Enter key. A warning will appear. Ignore it and press the “I’ll be careful, I promise!” button. In the Filter field type dom.ipc. Six preferences will appear for the filter dom.ipc. Ignore first and last preferences (dom.ipc.plugins.enabled and dom.ipc.plugins.timeoutSecs). Toggle (double-click) each of the four remaining preferences to change the value from “true” to “false“.

You are done, restart Firefox and open up Windows task manager to see that the plugin container process is disabled..

More info, The crash protection feature in Firefox 3.6 is enabled for certain plugins only. The four preferences that we modified here specifies four different out-of-process plugins. They are the the NPAPI test plugin, Adobe Flash, Apple QuickTime (Windows) and Microsoft Silverlight (Windows). These plugins are specified in a separate dom.ipc.plugins.enabled. preference by default is set to true. We can disable them by changing their value to false. And thus plugin-container.exe will not run. By default the preference dom.ipc.plugins.enabled is already set to “false”. So, no need to touch it. The dom.ipc.plugins.timeoutSecs is also not important here as other values are false.

Hope this helps somebody.

Answer 6

I had the same thing , killed Windows Defender and now i'm fine. Best of luck to you.

Answer 7

Use the Sysinternal's Process Explorer from http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Then, find which SVCHOST service is running without no parent. Because each svchost.exe must be loaded by services.exe. Kill all of them if you found. (You can figure out the Parent of a process by: Double Clicking on it >> "Image" Tab >> "Parent" Label.)

Additionally, if the virus you getting is the same one with me, you should do more following steps.

Check if there Watermark.exe under ..\Program Files\Microsoft folder. Then delete it. (You also better LOCK that folder by using Security tab of it.)

The Watermark.exe is injecting VBScripts codes into every .html files. Then these infected .html files are injecting into SVCHOST.EXE. So check a few .html files from different places by opening with some text editor. * Don't run * . If you find VBScript codes at the bottom of your file, the condition is worse then we hoped.

So if this happening too, you better clear all .html files (or) remove the codes away from each .html files.

After cleaning the .html files, for me at this situation, i surely REPLACED the SVCHOST.EXE from WINXP Installation CD, by using Recovery Console from boot.

Answer 8

I’m surprised about the advice that others have given on this issue (some even simply made guesses).

For Leonardo and others who find their way here, there are some teps that everybody else missed.

• Yes, start by getting a copy of Process Explorer.

• Yes, next look at the instances of SVCHOST.EXE that are running and double-click the one with the high CPU usage.

• Yes, look at the Services tab to find out what services are being hosted by that instance of svchost.

This is where everybody else stopped; that’s not enough. Now, you need to run Services.msc and stop each of the services that are hosted by the runaway instance of svchost in turn, making sure to wait and watch for a while after each to see if the CPU load drops. If it does, then the last one that you stopped was the culprit.

At this point, you know exactly what service was hogging the CPU and can then pursue finding out why that specific service would suck cycles.

Answer 9

From your screenshots, it seems like the audio service is involved.

There might be a connection with the problem described in win 7 high cpu usage on 2 services (see last answer).

Try to disable the integrated audio and see if this helps.

Answer 10

Could be the "Power" service run by one of the svchost processes causing high CPU usage. Try changing the Power saving mode from the Balance (default) to Performance and set the sleeping mode to "Never".