SVCHOST.EXE (netsvcs) causing cpu running at 100%


at the start of my computer ranging anywhere from 10min-3 hours( and reoccurs sometimes), both my cpus stay at 100%, and when i looked at performance monitor, it showed that SVCHOST.EXE (netsvcs) was using 40-50 percent of the cpu. The high cpu usage also messes up any type of audio(causing crackles and pops).

Sponsored Links:



Hello all,

Receiving very little help on this on other forums I frequent, I thought I'd try here. I hope all of this information does not overwhelm.

Here it goes:
Hello,

The past couple days I've noticed SVCHOST.EXE start going +50 CPU. For the most part it is sustained. I have linked a screenshot of the services that are running under this instance. I am running Win 7 RC. Right now it's not at a 'sustained' 50 CPU like it was last night, but every 3 or 4 seconds, it pops back up to 50 and then down again a few second later, and iterates like that.

I just did a full Avira AntiVir scan with updated signatures, nothing found. I also run Comodo Firewall with Defense+.

I am looking at the "threads" of the svhost.exe, and it appears that the culprit is ntdll.dll!RtlValidateHeap+0x110 (there are 12 instances, each of which well have over 200,000,000,000 cycles after about 10 minutes of booting up; SCREENIE BELOW).
The stack for one of these threads is this:
ntoskrnl.exe!KeRemoveQueueEx+0x9da
ntoskrnl.exe!KeWaitForMutexObject+0x7c9
ntoskrnl.exe!KeWaitForMutexObject+0x19f
ntoskrnl.exe!PoStartNextPowerIrp+0x3a4
ntoskrnl.exe!IoGetSfioStreamIdentifier+0x7ad
ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25
ntoskrnl.exe!IoGetConfigurationInformation+0x32b57

Here's the stack of another of the threads:
ntoskrnl.exe!KeRemoveQueueEx+0x9da
ntoskrnl.exe!memset+0x60e
ntoskrnl.exe!CcScheduleReadAhead+0x710
ntoskrnl.exe!RtlEnumerateEntryHashTable+0x311
ntdll.dll!NtOpenKeyEx+0xa
kernel32.dll!LocalAlloc+0x222
kernel32.dll!RegOpenKeyExW+0x153
kernel32.dll!RegOpenKeyExW+0x1d
ADVAPI32.dll!RegOpenKeyExW+0x13

I've tried a Google, but couldn't find anything conclusive. Curious if anyone may know what's up off the top of their head.

Thanks!




I have a second computer (which is why I am able to post this) - a laptop running XP-SP2 and Zone Alarm suite that connects to the network with wireless. Today, out of the blue, it ground almost to a stop. I did some checking in Task Manager and discovered that an instance of svchost.exe (a 146 Mb instance, usename SYSTEM) was hogging the CPU - bouncing between 87 and 100%. Running a virus scan is impossible - in fact running just about anything is pretty near impossible. I took the wireless card out (in case it was bust sending stuff) and bounced the computer several times. Each time, towards the end of the startup, svchost.exe grabbed the CPU and that was all she wrote. I have a few other instances of svchost running but all are much smaller.

The computer is really unusable as it is. Any advice out there from you who know about these sorets of things? I have hit my limited knowledge limit.

Any help will be very much appreciated.




My CPU is always at 100%, and the task manager reveals nothing that is taking up any of my cpu, yet it remains at 100%, idling or not. My system was running great for months with virus software running until it randomly started doing this. No updates were installed, nothing has been installed in over a week. If anyone can give me any idea why this is happening I would very much appreciate it.
Thanks




Probably an odd question, however, i'd like to know the answer. It's to do with that svchost.exe thing that's running. When I typed svchost.exe in a search engine sometimes it'll say something like 'svchost.exe -k netsvcs' what is the meaning of '-k'?

I like to know these things! lol!

Syex




I had a problem connecting to the internet (high speed connection). I noticed in Windows Task Manager - Processes that svchost.exe - Network Service was running at 98%. Of course my PC's performance was crawling. I terminated the process and ran Adware as I suspected spyware was trhe cause. I found 47 cases of spyware and eliminated them all. My PC performance was fine and I could connect to the internet.. Next day, I had the same problem ... couldn't connect to the internet and svchost.exe - Network Service was running at 98%. I ran Adware again and it found 106 cases of spyware. I removed them and decided to try a trail version of Spy-Cop. It found nothing. Does anyone have any ideas as to the cause of this problem? Your help will be grealty appreciated.




I had a problem with my registry and had to have XP Pro completely reloaded. I have been reloading all of my applications the last few days, including Norton 2004 AntiVirus. I am now getting the following error on shutdown:
Svchost.exe - Application error

The instruction at "...." referenced memory at ".....". The memory cannot be "read". Click on OK to terminate the program. Click on Cancel to debug the program.

I tried running the MS Blaster removal tool and have not had any luck. Can anyone please help??? I don't want to have to go thru this entire process again.

Thanks.




My CPU runs at 100% most of the time, even when the Task Manager shows only 3 or 4 processes using CPU and then totaling only 8-10%. I suspect that closed applications are not completely shutting down and getting out of the queue. Short of doing a clean install and then having to also install all of my apps, is there a way to clean out the cobwebs?




Hi all, I back again with another problem. I have been trying to download and install Mother Board Monitor 5 and seem to be running into a problem with it. I have gone to the sites listed in Google and download MBM 5. Then installed it. But when it appears next to the time in the lower right of my desktop I get two small black boxes with the temp of the CPU in one of them in red and in the other black box there is nothing where it is supposed to be reading the case temp. I checked my mother board assuming that one of the sensors was bad by installing the mother board monitor that came with the mother board and that tells me everything is being monitored. I would keep the mother board monitor that came with my board but would rather not because it makes the CPU run at 100% all the time. I have un-installed Mother Board Monitor 5 and re-installed it over and over again with the same results. I know what it should look like when it is right because I had it in my PC before I reformatted. Can someone help me with this problem? Please reply.




Almost every day I have problems with svchost.exe on my computer. I realize something is wrong when:
A) Instead of loading a webpage, it simply says "resolving host" for several minutes without making progress
B) Microsoft Word (2003) opens up, but immediately stops responding, and will not close even when I attempt to close to program from the task manager. Sometimes it takes up to 5 minutes.
C) My computer just starts running extremely slowly.

Whenever this happens, I check what processes are running, and invariably svchost.exe is taking up 50% of the CPU. When I end the process, it restarts within 5-10 seconds. Sometimes it is so bad that I have end the process every single time I go to a new website, or it won't load at all. I have run virus scans, with Windows Defender, Spybot Search and Destroy, Ad-Adware, AVG, none of them find anything. Any help would be appreciated.

I'm running 32-bit Windows 7 Home Premium, on a Dell Inspiron 15, with a Pentium(R) Dual-Core CPU T4200 @ 2.00GHz 2.00GHz, with 3 GB of RAM

A sidenote, I wonder if the reason svchost.exe is taking 50% of the CPU and not 100% is because it's a dual-core, and it's only running on one? Any help would be appreciated.




Fixes an issue in which both the Svchost.exe process and the Lsass.exe process consume lots of CPU resources. This issues occurs after you remotely connect to a computer that is running Windows 7 or Windows Server 2008 R2.

More...




Hallo, this is the problem I have: at every Windows start, when I try to launch eMule it doesn't appear, but emule.exe starts and I can see it in Task Manager. Such situation may last even 2-3 hours.

I notice a svchost.exe [PID 1896, but it can be 1900 or other] blocked on 23-25% of CPU usage: if I terminate this process, eMule appears in a few seconds, but audio doesn't work anymore (I can hear only Windows sounds, not audio files like mp3s and waves; I can watch Avi files but not hear any sound).

I prompted TASKLIST /SVC and these are the Services running under PID 1896:

AudioSrv, BITS, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, HidServ, LanmanServer, lanmanworkstation, Netman, Nla, RasAuto, RasMan, Schedule, seclogon, SENS, SharedAccess, ShellHWDetection, srservice, TapiSrv, Themes, TrkWks, W32Time, winmgmt, wscsvc, wuauserv, wzcsvc

Is there a way to kill these services one by one, so I can identify the problem without killing the entire Svchost?

Greetings from Italy ;-)

On Monday, March 05, 2007 3:07 PM Dma wrote:

Hi, does anyone have a fix or troubleshooting option for the svchost.exe
application? It sometimes goes crazy on some systems and takes up the CPU's
resources, both network and system can keep the processor maxed. This
application appears to have something to do with IE.
--
Thanks,
D-man

On Monday, March 05, 2007 3:21 PM Ron Martell wrote:

D-man wrote:

SVCHOST is a Windows system component that acts as the "host" for
running a large number of services. It is normal to have 5 or 6
instances of it running.

It is possible that some malware item has infested your computer and
is running as a service under SVCHOST. In order to diagnose this
further you need to do some investigation:

1. If you are running XP Home edition then you need to download the
TASKLIST utility from
http://www.xmission.com/~comphope/download/winxp.htm
and install it. TASKLIST is included with XP Pro.

2. Bring up the Windows Task Manager (Ctrl+Shift+Esc) and go to the
processes tab. Identify the PID number of the SVCHOST instance that
has the high CPU usage and make note of it. If you click twice on the
CPU column header the list will sorted based on CPU usage with the
highest usage at the top.

3. Open a Command Prompt window and enter the following command:

TASKLIST /SVC

Locate the problem instance of SVCHOST by its PID number and make note
of the names of the individual services that are running under that
specific instance of SVCHOST. Post those names back here.

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

On Monday, March 05, 2007 3:38 PM Dma wrote:

Hi, Ron, I assume that the steps are different for XP Professional?
--
Thanks,
D-man

"Ron Martell" wrote:

On Monday, March 05, 2007 3:43 PM Dma wrote:

Nevermind, ha ha, I read your email again. Good things. Thanks, Ron.
--
Thanks,
D-man

"Ron Martell" wrote:

On Monday, March 05, 2007 3:49 PM Dma wrote:

svchost.exe [PID]1900: httpfilter
--
Thanks,
D-man

"Ron Martell" wrote:

On Monday, March 05, 2007 4:19 PM Jack (MVP-Networking). wrote:

Hi
Microsoft provides am excellent Free utility that shows extensive info.
about all the processes that run in memory (including svchost).
See this page for a link and explanations, http://www.ezlan.net/svchost.html
Screen Shot, http://www.ezlan.net/example/ProcessExplor.jpg
Jack (MVP-Networking).

"D-man" wrote in message
...

On Monday, March 05, 2007 4:54 PM Ron Martell wrote:

D-man wrote:

HTTPFILTER is a legitimate Windows component. However there are known
viruses/trojans/spyware items which infect or replace this file,
causing problems such as you are experiencing.

Go to one of the following free online scanning sites and check your
system for possible infestations:
Bit Defender http://www.bitdefender.com/scan8/ie.html
Trend Micro http://housecall.trendmicro.com
Kaspersky Online Scanner http://www.kaspersky.com/virusscanner
Panda ActiveScan http://www.pandasoftware.com/activescan
WindowSecurity.com TrojanScan http://windowssecurity.com/trojanscan
Webroot http://www.webroot.com/

Good luck

Ron Martell Duncan B.C. Canada
--
Microsoft MVP (1997 - 2006)
On-Line Help Computer Service
http://onlinehelp.bc.ca
Syberfix Remote Computer Repair

"Anyone who thinks that they are too small to make a difference
has never been in bed with a mosquito."

On Monday, March 05, 2007 6:13 PM Dma wrote:

Very cool! thanks much.
--
Thanks,
D-man

"Jack (MVP-Networking)." wrote:

On Monday, March 05, 2007 6:34 PM Dma wrote:

Jack, I noticed that you have a screen shot of what appears to be a program
you loaded that shows you what each application does. I was not able to find
how to load this tools on the site provided. Do you happen to have the link?
--
Thanks,
D-man

"Jack (MVP-Networking)." wrote:

On Monday, March 05, 2007 7:33 PM Jack (MVP-Networking). wrote:

Hi
Take a look at your hard drive if you clicked on the link that is on my page
you probably already downloaded it.
Look for a file, ProcessExplorer.zip unzip it and run the exe file.
Otherwise, here you go,
http://www.microsoft.com/technet/sys...sExplorer.mspx
Jack (MVP-Networking).

"D-man" wrote in message
...




Hello everyone,

I have a vexing problem. I am attempting to help a friend with his Dell Inspiron E1505 laptop. He hadn't used it in awhile, and when he tried to boot up it gave him the IRQL Not Less Or Equal BSOD. I searched around the 'net and found a few articles, but nothing conclusive. In safe mode the computer is now working fine, and I was able to uninstall some questionable software from there, but other software won't remove because accessing the Windows installer is not possible in safe mode. Now we can boot into Windows proper, BUT his CPU is being used 100% (99% in the task list) by services.exe. I have been able to reboot into diagnostic mode using msconfig from safe mode, but NOTHING I can do will eliminate the 100% CPU usage! I have tried to do a malware check using SuperAntiSpywares portable version, but unfortunately my usb key is not recognized immediately by Windows. I can't even get it to boot from the Dell restoration CD even after having pressed F12 during bootup, AND choosing to boot from the cd/dvd drive as per the Dell website! I don't believe it is a virus, because I have found only three services.exe files, one in the c:windowssystem32 folder, one in c:i386, and one in c:windowsServicePackFilesi386. The one in system32 is dated 2/6/2009 and weighs in at 108kb, whereas the other two are dated 8/4/2004 @ 106kb in i386 and the same size with a date of 4/13/2008 in ServicePackFilesi386. There is a "hotfix" available for just such an issue at Microsoft's site but is not for XP.

While I was writing this I even tried renaming the newest services.exe to services.new, and then copying the 2008 version over to the system32 folder and then rebooting, still in diagnostic mode, and no luck, still running at 100%. I have a feeling it has something to do with a networking component because I had the same issue in Safe Mode with Networking Support.

ARGH!

Hopefully someone here will have already faced this issue and found a solution of some sort that I haven't already tried.

Thanks in advance.




I am in the process of trying to solve a hot-running problem on a laptop (HP dv2535ea), to the point the PC shuts down protectively. While the fan and the disk are possible culprits, I have noticed the CPU will run at 65 – 100% for considerable periods without any applications running. It may then revert to about 10-15% usage for a while, before starting up at 55+% again. This behaviour is continuous, with the heavy running going for a good half of the time. Since that puts the chip frequency up to max, it could very well be the cause of my problem.

Running Resource Monitor, I can see the processes that are active, but they give no indication of the culprit. The CPU users are svchost (the main one – but I cannot see which dll is calling it), wmiprvse, lsass (all windows components) and Forcefield (Zonealarm, presumably caused by the original activity) – all of which leaves me no real clues as to the ultimate cause of the activity.

I know it is something to do with my set-up, since when started in safe mode CPU usage is minimal. I am running Vista SP2, fully patched, with Zonealarm Internet Security. I have done a full virus scan which came up clean, and there is no internet activity and only minimal disk activity when the CPU is churning.

Before I start the laborious process of shutting off processes in msconfig (there are about 85 in total, vs 24 in safe mode), does anyone know a way of finding out which dll is calling svchost, or is anyone aware of a known “criminal” in terms of massive cpu usage?

Chris




I've been trying to troubleshoot a very sluggish Windows 7 install for a couple days, and need help finding the cause.

The culprit according Process Explorer is that the System Process runs at 100% CPU usage, and when I view the threads, it's actually dxgmms1.sys that's doing it. Does anyone know what that file is (guessing something DirectX related) or how I might be able to fix it?

I've tried 3 versions of the nVidia drivers (182.50, 185.81, 185.85) and even tried the Vista drivers. All with the same outcome.
This is a Dual-Core Xeon, 4GB RAM, Windows 7 64-bit; nVidia Quadro FX 3400/4400.

Thanks in advance!




System performance is abysmal.

"Resource and Performance Monitor" says:
CPU
Busy 100 % High CPU load. Investigate Top Processes.
Resource Monitor says:

Image PID Description Status Threads CPU Average CPU
System Interrupts - Deferred Procedure Calls and Interrupt Svce... Running - 63 52.80%
System 4 NT Kernel & System Running 106 26 28.33%

the various other images are




Nick--

You may get some additional information at Event Viewer, but odds are it
will be similar and possibly some hex errors or errors written in "Hungarian
notation" not to be confused with the language from Hungary, or some other
language used and I doubt it in this case.

It would be helpful to know what OS (build of XP--SP1 SP2 ect.) you're
running and what application you're trying to update. You didn't say. If
you have Windows XP then upgrading to at least SP1 might help.

*A good first response to any error like this in XP* besides trying to
track the errors down with google or a search engine is to run System File
Checker and try to replace .dlls or files that are damaged with intact files
that are stored as replacements. That might help.

Running SFC would be the first thing I would try given your situation. No
downside and it might restore a missing file or files you need.

http://tinyurl.com/lc0l
Description of the Windows File Protection Feature

Introduction to using scannow sfc (system file checker)
http://www.updatexp.com/scannow-sfc.html
(One of the best articles I have on SFC)

This KB does not name your error messages, but it has more than one way you
might repair your installer. I have not drilled the Install Shield site's
KB because you indicated you have done this.

http://support.microsoft.com/default.aspx?scid=kb;[LN];315346
"Error 1719. The Windows Installer service could not be accessed" error
message when you try to add or remove a program

This has *ways to repair your MSI* although you did not get Error 1719--I
used it in a situation described below when I was gettting different setup
errors for Office.

You may try using this if previous updates of your application are listed to
get rid of files that might not have installed correctly in relation to that
application (previous updates for that particular app is what I mean here).

Windows Installer Cleanup Utility
http://support.microsoft.com/default...b;en-us;290301

__________________________________________________ _________________

There are KBs close to your topic:

http://support.microsoft.com/?id=818234
"Error 1311: Cannot Locate Source File" Error Message During Office
Installation

http://tinyurl.com/5j7an
on Error Code 1603

http://www.rz.fh-ulm.de/rz/docs/msierror.htm
MSI Error Codes

http://support.microsoft.com/default...b;EN-US;229683
List of Error Codes Including 1603

http://www.jsiinc.com/SUBP/tip7700/rh7732.htm
JSI Tip on 1603

The last 1603 error I had to contend with was an Office installation error
because I used an app I picked up from the net to get rid of wisptis.exe
which MSFT ridiculously default installs with every Office or Office related
app as does Adobe with their reader. It's to facilitate the pen in a tablet,
and to my knowledge not every Office user is working with a tablet
today--I'd safely say the vast majority of Office deployments, One Note
deployments, Front Page Deployments aren't on boxes using a tablet pen.

Why isn't wisptis.exe an optional install at the MSFT Office site? Good
question.
Why did I want to remove wisptis.exe in the first place--it mimes spyware
and can cause systained CPU runs of 100% which manifest with the symptom of
a freeze for varying amounts of time for a number of users.

hth,

Chad Harris
__________________________________________________ __________________________________________________ _____

"nick" wrote in message
...
I can no longer install software of update software
allready installed. first is error 1311 source file not
found: D:data1.com verify file exist and you can access
it.
After cancelling
error 1603 Fatal error durring installation Consult
Windows Installer help (Msi.chm) or MSDN for more
information.

contacted the software manufacture (Mapsource)
they sent me to www.installshield.com
installed latest engine (for setup greater than 7.01)
no change
Dell help has been useless

I get the same problem when My Adobe 6.0 trys to update. I
have the disk for each and they both install on other
computers fine.

Dell inspirion 8600
Window XP udated to the latest version




I'm helping a friend with his brand new computer, but all of a sudden it started running awfuly slow. So I closed all apps and then found the following processes chewing up nearly all the CPU time:

SYSTEM about 50%
Services.exe about 23%
guard.exe about 20%

So those three total to nearly 100%. I have no idea what these processes are, where they come from, or how to fix it.




I have a 1.5GHz CPU pinned at 100% while printing (spooler to printer) color to an HP DeskJet 1220c under Windows XP SP1 (otherwise current in critical patches). I cannot figure out why.

I am using the most recent HP drivers for Win XP. The printer is connected through an ECP parallel port with DMA disabled. There are gobs of disk and 768MB RAM. Perfmon shows the CPU utilization pinned, no paging, and little disk activity. Task Manager shows SYSTEM running at 90+% CPU, SPOOLSV.exe sometimes hitting 2 digits, and nothing else contributing much. This is definitely when the spooler is pumping the data out to the printer, I queued up the file before setting the instrumentation. When it is printing 3 pages of text/photo from Acrobat, the CPU is flat at 100% except during form feeds. When it is printing 2 pages of B/W text from MS Word, the CPU sawtooths between 90% and 100% except for the form feed.

This is not a suddenly appearing symptom that I can associate with some event. It is more that the user printed more and more and finally got annoyed enough to complain.

I am guessing that the spooler is unhappy about something, but I cannot figure out what. I have heard of HP's software gobbling up CPU, but I would have thought that some of the hpXXXXXX tasks would be showing more CPU it that were happening.

Any ideas would be greatly appreciated?

Joe M




Just installed WinXP Pro over W2K. WinXP is running at 100% cpu, and some things are failing saying I don't have enough memory. I'm on 1.1gz AMD, 640meg. Found an entry in MS Knowedge base saying there was problem with USB Scanners (which I have) polling. I put on the suggested change (I increased the polling timeout to 100,000 (the default is 700ms) but no change. There was a spelling error in the Article, so I'm not sure if the registry key they gave me is 100% correct. I showed up with 3 entries (as I was warned about) for my scanner, as USB devices tend to move around if you unplug em and replug em in a different place. I looked at the Registry for SVCHOST and I have 4 entries, all unfamiliar to me. Is there anyway of finding out who SVCHOST is doing the work on behalf of? I also have a WebCam plugged into a USB port as well as a cord for my Digital Camera, if USB polling could be the problem. Still early in the WinXP Pro arena, I suspect there will be more entries in Knowledge base, so not too surprised I don't see my problem there yet. Any help would be appreciated. Thx... Michael