Thanks to these awesome instructions I was finally (!) able to identify the services of the svchost.exe process which eats so much of my CPU on my Windows XP Professional SP3 (Version 2002):

Process                   PID    Services
========================= ====== =============================================
svchost.exe                 5516 BITS, EventSystem, Nla, RasMan, SENS,        
                                 ShellHWDetection, TapiSrv, W32Time, winmgmt, 


  1. Which of these services can potentially be the cause of the problem?
  2. Shall I now try to stop some of them?
  3. If yes, which of these services can be stopped safely and which is better not to stop at all? (Without destabilizing the system)
  4. How can I manage the services? Using services.msc? The problem with services.msc is that I have localized Windows and I see all of them translated. Is there any way I can match and stop/start the corresponding service with the english names provided above?

Thanks a lot!

PS: producing the above output to find the services of the greedy svchost.exe process was tricky on my localized Windows, since the /fi filtering on process name didn't work (the filter commands itself are translated to czech and it's not possible to enter them on the console due to charset issues!!! Braindamaged M$!!!). This is how I did it:

  1. tasklist /v > c:\tomas\file.txt
  2. Find the PID of the proper svchost process by memory usage.
  3. tasklist /svc /fi "PID eq 5516"

PS: this is not a duplicate of #995581 at all, it's not about data but CPU consumption, also svchost issues were so frequent that it deserves it's own specific question, which is also about specific services. That question wouldn't solve my problem at all.

  • 1
    Referring to your edit and my rollback: accepting an answer is enough indication the problem is solved. – Kamil Maciorowski Jun 11 '18 at 12:42
  • 11
    Just to say this again: Windows XP reached full end of life more than four years ago. For the past four years, with two notable exceptions it has not had any patches created... not even critical security updates, and not even when there are known security flaws discovered (and there are many of these!) It's dangerous and irresponsible to continue using this system. Upgrading to a supported OS should be job #1. – Joel Coehoorn Jun 11 '18 at 15:11
  • 1
    We appreciate your input, but as Kamil already said we do not label our questions as "finally solved" within the Super User community. We can easily see that by the fact that there is an accepted answer. More importantly, you really need to move to a more modern operating system than Windows XP. Using it is simply begging for a security incident. – Run5k Jun 11 '18 at 17:33
  • 1
    this is same like in windows 7, where WindowsUpdate causes the issue. With a lot of updates were released over the years, WU is slow to check which updates it really needs. – magicandre1981 Jun 11 '18 at 17:45
  • 4
    Should this be migrated to retrocomputing.stackexchange.com? – Heinzi Jun 12 '18 at 11:54

First of all: Don't use Windows XP. This is an accident waiting to happen.

That said, I am nearly certain, that wuauserv is the culprit: Windows Update is completely broken with Windows XP, and it no longer servers any purpose. Try net stop wuauserv to make sure.

  • 12
    It is the server component of automatic windows updates (wuauctrl is the client). As that it has to create the list of updates to install. Since some bright mind chose an O(e^n) algorithm to do so, this becomes uncontrollably slow with an increasing number of updates to consider. Since it is also responsible for running the installers, it might run an SR instance if interrupted while trying (and failing) to install an update. – Eugen Rieck Jun 11 '18 at 10:06
  • 3
    The install process for many windows updates starts with creating a system resore point as to have a known-working version of the system, if the update fails. If it does fail (e.g. by wuauservbeing killed) the system restore service will revert to this restore point, thus eliminating any unwanted side effects of the failed install attempt. – Eugen Rieck Jun 11 '18 at 10:14
  • 1
    It shouldn't take long - just to make it clear: The SR service will do real work just for a short period of time, but it will continue to exist until reboot. In fact, I am quite sure it already existed before, but was so low down the activity scale, you just didn't see it. – Eugen Rieck Jun 11 '18 at 10:25
  • 9
    @Tomas , Really should reiterate, do not use WinXP any more. If you need it for some odd backwards compatibility, your best bet is an isolated virtual machine. I would also ensure it is not connected to the internet. WinXP has so many unpatched remote code vulnerabilities at this point, along with little to no security updates for browsers... as Eugen said, it's an accident (complete compromise) waiting to happen. – Jarrod Christman Jun 11 '18 at 15:00
  • 7
    Don't just stop the service... mark it disabled, so it won't run again. Support for Windows XP was discontinued, so it's not even as if it could find a new update, and thus letting it run in the background serves not purpose. – Joel Coehoorn Jun 11 '18 at 15:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.