User’s computer exhibited the following symptoms today:
- System would boot fine, and work without any problems when offline
- As soon as you connected it to the internet you would see a drastic spike in CPU usage, mainly caused by the svchost.exe process.
- The CPU usage would spike up to 100% and stay there making the machine unbearably slow
- Scanning with Symantec NIS 2007, Spybot and Windows Defender did not find any viruses or spyware
- Examining the running processes with Sysinternals Process Explorer and HijackThis did not show any suspicious behavior
Apparently this is a very common issue and few people have a solution for it. Because so many different services are dependent on svchost.exe there is no catch-all solutions. But I did find “a solution”.
In my case this seemed to be a combination of Microsoft Update being funky and possibly having somewhat corrupted DataStore folder. Here is what you do:
Switch Microsoft Update back to Windows Update
First step is to make sure you are using the standard Windows Update – not the Microsoft Update. If you are using the wrong one simply go to Windows Update website, click “Change Settings” on the sidebar, and then check the box labeled: “Disable Microsoft Update software and let me use Windows Update only” and hit apply.
Flush the DataStore Folder
Stop the Automatic Update service and delete or rename the DataStore folder located in %WINDIR%\SoftwareDistribution. There are two ways to do it. First, there is the geeky way:
net stop wuauserv
rmdir /Q /S %WINDIR%\SoftwareDistribution\DataStore
net start wuauserv
Then there is the long way:
- Press Windows+R and type in services.msc
- Stop Automatic Updates service
- Press Windows+R and type in %WINDIR%\SoftwareDistribution
- Delete or rename the DataStore folder
- Go back and start the Automatic Updates again
If you can’t delete the folder, it means that the update service is still running. You may want to reboot after doing all of this for a good measure.
After doing all of this I did not experience any more CPU usage spikes. I was able to connect to the internet normally, and to run Windows update as normal.
[tags]svchost, svchost.exe, 100% cpu usage, svchost 100% cpu usage, windows[/tags]
Do you know if the automatic updates still work after doing this? Otherwise it would be simpler to just disable them.
Besides, I don’t believe that the folder is really corrupt. I recently reinstalled my PC because of this and after installation, I had the same problem (even worse, because it had to install a lot of updates again).
Now it seems that once in a while, it starts looking for updates and drives the CPU to 100% while doing so. After a few minutes, everything goes back to normal. Probably, if you have installed and uninstalled lots of software, it will take more than a few minutes.
There is a third way – just start switching users computers to linux.
I know you made a joke but that’s not an option if it’s a pure and simple switch, Pit.
I’m expression myself about this because I’m very skeptic when people comes with the classic “windows is bad, let’s move to linux” as if linux were the solution of all problems!
Ideologies and business usually do not mix well together and I think people should be more rational about OS switches.
Sorry to bring this up Luke but I’ve been through some serious problems before because of poor planning of the OS switch.
[quote comment=”4342″]There is a third way – just start switching users computers to linux.[/quote]
I switched myself. Does that count?
As Ricardo said though, it’s not an option and I can give you several reasons for it:
1. Hardware – most of my users are in the field 90% of the time. They all use Dell and HP laptops and tabletops. They also use a myriad of pocket-PC’s, blackberries, smart phones, planners and etc. There is a lot of funky, proprietary hardware floating around that won’t work out of the box with linux and would be major pain in the ass to support and troubleshoot.
2. Software – my users work with many template documents created for MS office. These include embedded objects, advanced macros and etc. I don’t think these documents would work properly in OpenOffice.org
We also use 2 or 3 proprietary packages that are specific to the asset based lending field that may or may not work under Wine. As far as I know there are no open source alternatives to some of these.
3. Wifi – my users travel a lot. They use wifi all the time. Most of our laptops have internal g or a/g cards installed. But sometimes they go to a place where they have an a or b network. So they often get handed a PCIMCIA card and a CD by the IT on site.
You and me both know it – wifi support is flaky on linux.
Now if I was for example running a web based shop, an ISP, or a business that does not involve using proprietary software to access client data I would probably switch to linux in a heartbeat. The clerical staff would just have to learn to cope with book keeping on open source software.
But since my users visit client locations which are mostly windows shops, and use their documents, templates, software and network resources this is not an option.
[quote comment=”4343″]I know you made a joke but that’s not an option if it’s a pure and simple switch, Pit.[/quote]
Yes, that was a joke.
Yes, sometimes that`s not an option.
[quote comment=”4344″]
As Ricardo said though, it’s not an option and I can give you several reasons for it:
[/quote]
I realy know that, because I have the same problems with my users everyday.
And one more thing – I`m not radical Linux fan, but sometimes Redmond`s softwere just makes me sick.
[quote comment=”4345″]And one more thing – I`m not radical Linux fan, but sometimes Redmond`s softwere just makes me sick.[/quote]
Personally, I’m a big fan of Ubuntu, but I will be the first person to say that Linux is not for everyone. Administering a Linux system simply requires a different set of skills and a different mindset than managing a windows box. People who hate to write shell scripts, edit config files and compile stuff from time to time will be miserable when forced to manage linux.
That said, if you just need a workstation for email, myspace and some word processing with no root/admin privileges it doesn’t really matter which OS you use.
[quote comment=”4341″]Do you know if the automatic updates still work after doing this?[/quote]
I can confirm that the auto-updates worked as normal after doing this.
Once again – the spike it might be caused by many factors. This seems to be one of them. Also, my problem did not go away. It would stay at 100% for hours. For example to open IE you would wait 20 minutes, and then wait another hour before it loaded a page.
It all was fixed once I did this. Of course the issue might return. I will post an update if it does.
Thanks for the good tips, but regarding Microsoft, I am very dissatisfied.
What a waste of time (and productivity)
By fixing the problems MS have caused they break something else and you gotta run around in circles.
I wonder why there has never been a problem with WPA (Windows Product Activation)
Perhaps, where the money counts, things gets done right the first time.
Here’s what we have been doing and it works like a charm:
“From: James Schwar
We have started to see quite a few machine running into a problem with “svchost –k netsvc” eating up 100% of the CPU and making the machine seem frozen.
The WSUS team posted some information about this on their blog: http://blogs.technet.com/wsus/archive/2007/04/28/update-on.aspx . Previously I had believed that you would only need the fix from KB927891 (http://support.microsoft.com/?kbid=927891) to resolve the problem. It did solve the problem slightly on a few machines, but apparently you also need the Windows Update Agent version 3 (http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/ WindowsUpdateAgent30-x86.exe)
After installing both of these on a system, updates still seem to take up 100% of the processor, but the change lies in the way that svchost behaves when other processes are trying to execute their code. SVCHOST will now back off a bit when launching other applications so you might not feel as much of the freeze affect.”
Seriously, sometimes I think this is intentional. From what I noticed, most lusers reason in the following way:
1. New computor! Yay!
2. Oh noes. My computor is slow. :(
3. It iz so slo! I don’t kno wut 2 do! :O
4. Tiem for new computor that iz not slow. :3
5. Goto 1.
See the pattern? Windows sells more copies this way, and hardware vendors are happy to sell more machines. :mrgreen:
And yes, lusers use goto because they didn’t read Dijkstra. ;P
LOL!!
Pingback: How to solve the svchost.exe 100% CPU usage problem « One Post At a Time
[quote comment=”4355″]Here’s what we have been doing and it works like a charm[/quote]
Nice. Will try that next time!
I have had this as a problem for some time now and in the past could find no solution. I have done what you said and it seems to be working just fine.
Thank you kindly.
Hey thanks for posting this with step by step instructions, worked first time.
A useful Microsoft article
http://support.microsoft.com/kb/932494
That did the trick, thanks :)
Cheers for that dude, worked a treat. Been looking for a solution since it wasn’t the first time I’ve had this problem.
Jamie.
I found that the svchost process that was causing me 100% just after boot, was keeping the NTP (network time protocol) ports occupied (see netstat -a). I think the offending svchost process therefore has something with the Windows Time Service.
[quote comment=”4730″]I found that the svchost process that was causing me 100% just after boot, was keeping the NTP (network time protocol) ports occupied (see netstat -a). I think the offending svchost process therefore has something with the Windows Time Service.[/quote]
It could very well be. The problem with svchost is that many windows services use it for various network related tasks. At any given time you might have 2 or 3 instances of it running in the background.
It’s hellishly difficult to troubleshoot a thing like that. My solution only covers the Microsoft Update issue, but other things may cause svchost usage to spike up as well.
Long, but worth it. Svchost.exe has plaqued all of us at some point. I’ve personally tried many program. It seems update windows is a big step forward to fixing the problem. But appearently there is a different form of Svchost.exe… it’s sCVhost.exe where the “vc” in svchost.exe is switched around. It’s a virus.
Tried it just as stated. Still didn’t fix my problem. Went right back up to 100% CPU.
I had similar problems on an XP Home SP3 machine. When booting up, the hard disc would thrash for about 15 minutes before I could do anything else and Task Manager showed that wuauclt.exe and svchost.exe were using lots of memory and page files. After 15 minutes this stopped and it behaved fine. I never experienced the 100% cpu symptom. I worked out that it was Automatic Update (wuauclt.exe) that was causing the problem but couldn’t find any advice on how to fix it until I found this article. I followed the instructions, changing from Microsoft Update to Windows Update and the problem seems to be fixed – it now boots up like new. Thanks for the tip.
@ Jan:
you should try this : http://abopc.blogspot.com/2016/05/windows-update-memory-leaksolved.htm l .it solved it for me.actually the problem was a bug in windows update .ms fixed it in march 2016.