Abnormally high CPU usage from svchost.exe [SOLVED]

Anonymous

Occasionally after windows automatically updates, my laptop will restart with abnormally high CPU usage. I checked my processes and found that "svchost.exe*32 - SYSTEM - winrscmde" appeared to be using most of the CPU.

When attempting to "Go to Service(s)" no service was highlighted.

As a last ditch effort in a long list of fixes I tried(including scanning my pc with multiple malware and virus detection programs, restarting the computer again and trying a manual fix I found in a forum somewhere else)

I simply chose svchost.exe*32, then clicked "Open file location" and double clicked the svchost application, opening a new svchost.exe*32 and

ending the old process and it seems to have solved my problem for the time being, but I can't help but wonder what caused this problem in the

first place?

[EDIT]: I fixed my problem another way, apparently somehow a rootkit was causing the problem?

It started out as a problem with all regular google sites, ads and services not being able to be displayed on my browser.

I searched the web for answers and found that someone else had the exact same problem and used a combination of Rkill and TDSKill executable programs to stop malware processes and remove rootkits. I never thought of this before because i had no idea what a rootkit was.

After rebooting google worked fine and i found that the particular service host.exe file that had been causing me so much trouble was gone and not running, also my computer runs smoother than ever!

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

I fixed my problem another way, apparently somehow a rootkit was causing the problem? It started out as a problem with all regular google sites, ads and services not being able to be displayed on my browser. I searched the web for answers and found that someone else had the exact same problem and used a combination of Rkill and TDSKill executable programs to stop malware processes and remove rootkits.I never thought of this before because i had no idea what a rootkit was. After rebooting google worked fine and i found that the particular service host.exe file that had been causing me so much trouble was gone and not running, also my computer runs smoother than ever!

0 comments

Answer accepted by question author

Anonymous

Hello Leah, yes svchost.exe isn't always associated with viruses, it is a windows feature responsible for loading shared dll's for other applications to use.

There are ways to find out which services are hogging the resources. Take a look at the guide below...

**What is svchost.exe And Why Is It Running?**

You are no doubt reading this article because you are wondering why on earth there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, and you don’t remember starting them… so what are they?

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.

The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.

If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box:

Checking From the Command Line (Vista or XP Pro)

If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.

tasklist /SVC

The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.

Checking in Task Manager in Vista

You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.

This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:

The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don’t want it running.

Using Process Explorer in Vista or XP

You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.

Hovering your mouse over one of the processes will show you a popup list of all the services:

Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.

Disabling Services

Open up Services from the administrative tools section of Control Panel, or typeservices.msc into the start menu search or run box.

Find the service in the list that you’d like to disable, and either double-click on it or right-click and choose Properties.

Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.

You could also use the command prompt to disable the service if you choose. In this command “trkwks” is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you’ll notice you can find it there as well.

sc config trkwks start= disabled

Source: http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

0 comments

108 additional answers

Anonymous

2016-07-26T19:51:39+00:00

Dessert Storm of Chocolate, as the post says, there's a link posted earlier (on previous page, at 5/24/2016). Outside links are not always included by Moderators in threads, so I embedded it in the orig post and again, below. Or you might just click the first link you see below search results of a google search for "Identify McciCMService.exe related errors".

5/24/2016 repost:

Googled Alcatel-Lucentand got quite the eyeful for unnecessary add-on processes in Task Manager. Went to file-dot-net / processes and read all about **Identify McciCMService.exe related errors.** Mega mktg firm's multi-files added into pc's during most installs. Hope that helps others' systems performance, as it did in decluttering and increasing performance proficiency.
Was this answer helpful?

0 comments No comments
Anonymous

2016-08-02T17:01:43+00:00

For months, my (Vista) system has also been grinding away at 50% CPU, constantly spinning in svchost. The CPU cooling fan would be on full time and I worried that the heat may shorten the system's life, and it was slow (apparently leaving only one of my two CPU cores for my tasks). The auto updates had ceased and running update manually caused it to just "spin" in looking for updates forever and ever.

As usual, looking for a reasonable answer or resolution had proven to be impossible to find, as always:

     Too many answers are over complicated and seem to just be venues for the technical prigs to shout their hubris over the net. This especially applies to some who seem to be labeled as moderators. We don't want to get into command mode - or whatever it's called. We don't want to send screen shots. We would like a simple, summary explanation of what is going on and how to fix it.

     Searching for a solution comes up with an excessive quantity of choices to look at, including all the marketers and keyword induced spammers. But even the microsoft sites seem to scatter the related responses far and wide with no good context for deciding where to go for the best answer. Slight changes to search keywords will bring up different results (along with the trash results) - even within "forums".

     It almost seems as if, in order to avoid taking any responsibilty for faulty design or software (and let's face it, having a process just sit there and spin forever is faulty), the forums become a place to obfuscate and muck up and muddy the waters. I did not see, in all the forums, one example of microsoft admitting that they simply screwed up, and here is a simple solution. Maybe they should pay for any burnt-out CPU's.

Anyway, that being said, my problem is fixed. There is a pleasant Youtube tutorial by a Chris Waite https://www.youtube.com/watch?v=0HBBuBbf4Ws

that works.

I followed his method (including restarting after each download). As of the end of July 2016, the referenced site ( http://wu.krelay.de/en/ ) had five patches for my 32 bit Vista (To see what bit system you have, go to Control Panel, then System.), though three of them were deemed "does not apply" for my system. The only worry was that one of the "shutting down" screens got stuck in that mode, so I had to power down (In my case, hold the power button in, then wait a moment, then power back up.) Over the years I've seen this a few times. All = OK after. When (following the tutorial procedure) I turned back on the auto updates, it took about 10 minutes of "looking" for updates during which "Trusted Install" was busy at about 50% CPU, then about one minute of svchost (If you haven't yet, get familiar with the easy Windows Task Manager), then VOILA! 11 updates available. Installations took about an hour to do their thing (the malicious removal tool probably looks at everything, so it alone takes a long time). One more restart and now my CPU is sitting there mostly cool and idle, fan not needed.

Hope this helped. Wish there were an easy way to direct the frustrated and lost souls here.

*****************************************************

I wrote the above 8/2/16. The following is an edit of 8/10/16:

Today (after having not been on the computer for three days) the same svchost high ~50% CPU problem came back. The windows update screen indicates that it had checked for updates on 8/7, but I don't recall any sign of such. I suspect that that is what triggered the event. So I went through the same process as above again. What differed is that the two previously applicable updates that were used, this time, each comes back as "does not apply" (the same as the three (of five) mentioned above which I totally neglected this time around). But, also different was that our "krelay friend" had added a new update (KB3177725) which downloaded and installed OK. After turning on the auto update function, it took about 11 minutes to find four "important" updates which took about 17 minutes to download and install and all is quiet on the CPU front again. FYI - I didn't even try to search for updates this time, assuming that it would just get stuck and go on forever as happened previously.

     What a time consuming pain in the butt. Shame on microsoft for forcing us to go through and put up with this time and time and over and over again. Do they want everyone to migrate to Apple products and software? Are they truly incapable of fixing this problem? Is it purposeful to force us to buy new hardware and software? From their (lack of) actions, you'd have to answer: Yes, Yes, and Yes.

******************************************************************************

The following is an edit of 9/21/16:

So, as expected, the 50% CPU reared its head again ~9/15, again apparently coinciding with the auto update's looking for updates. But, I now expect this, and thanks to our friends krelay and Chris Waite, there's a process that works.

But this time microsoft threw another roadblock in the way. After downloading the fix update (this month's one new update is KB3185911), the microsoft window with the option to Save or Run (pop up box) simply never shows up. I tried it over and over and could never save the download into my system. I think that this is part of a more and more often occuring problem due to the Vista - IE9 combination getting more and more incompatible with today's web pages and coding. There have been many incidents of non functioning processes including: Not being able to pay a Verizon bill without a http 404 error, all Angie's list pages are all white, some legal forms needing filling out simply don't show. Even one of my local supermarket flyers will not appear. Some sites only return a dialog box saying that the browser is out of date and they will not even give their home page. Many almost beg me to update the browser. (Remember - with Vista, the highest permissible IE version is IE9. You are not allowed to upgrade to a newer version.) microsoft wants you to spend money for a new operating system which then will allow a newer browser version. After all, the Gates are only worth $90 billion.

So, lets get to the point. After resisting it for fear of screwing everything up (ala dealing with microsoft), I downloaded and installed Mozilla Firefox and now EVERYTHING WORKS! Listen to me!!!! It was the easiest, most harmless thing to do. It literally took about one minute. Everything that didn't work before now works. Keep IE9 on the system if you want and choose between the two as the mood strikes. I then was able to fix the svchost CPU problem and then completed the other tasks that had been piling up. You could spend a lifetime in those bloated, useless microsoft forums, looking for the above Firefox solution to solve the non appearing Run or Save boxes or all the other problems..

p.s. If you suffer from high CPU svchost condition, keep in mind that you can simply go to windows update > change settings > Important updates and scroll down to and choose never check for updates. Click OK, then restart. This won't get you the updates, but will stop the CPU from cranking away.
Was this answer helpful?

0 comments No comments
Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more