Tech Support Forum banner
Status
Not open for further replies.

svchost.exe -k netsvc taking up 560+ threads

3.4K views 3 replies 2 participants last post by  writhziden  
#1 · (Edited)
Everytime I start my laptop up, svchost.exe (netsvc) immediately takes up 560+ threads and within 5 minutes, renders my laptop unusable when left unchecked and I have to shut it down manually with the power button. Furthermore, when I try to end the process, it starts itself up again, taking up the same number of threads. The only way to get my laptop to work is to open up the resource monitor the moment I get into the desktop (where I can sort processes by # of threads), and end the process everytime it uses the insane amount of threads until it finally restarts using around 70. While I am not exactly sure what threads do, I know that it's the source of the problem because: 1. svchost.exe (netsvc) doesn't increase cpu usage as far as I can tell and 2. my laptop runs fine when svchost.exe (netsvc) uses less threads. While my solution to the problem works, I would like to find a permanent solution.

Also, I used the Command Prompt to find out what services it was running using a command I found online:
AeLookupSvc, Appinfo, BITS, Browser, EapHost, IKEEXT, iphlpsvc, LanmanServer, MMCSS, ProfSvc, Schedule, SENS, ShellHWDetection, Themes, Winmgmt, wuauserv

I saw on another forum (can't seem to find it in my history) that someone with a problem that sounded the same stopped the iphlpsvc and it fixed the slowdown, but they didn't explain how they did it. On another forum (svchost.exe -k netsvcs Slowing Down Computer Solved - Windows 7 Help Forums), someone mentioned to try separating the services into different svchost.exe's using the Command Prompt and they gave an example, but when I did the same thing, it said that I didn't have authorization to do it, which is odd. It's also apparently now malware. Norton doesn't pick it up, and the .exe that's running it is in the System32 folder with all of the other svchost.exe's like it should be. I don't want to be trying anything that I may later regret so I'm hoping to get some help here.
 

Attachments

See less See more
Preview image for a collapsed post.
1
#2 ·
Does the same thing happen in Safe Mode and/or Safe Mode with Networking?

Access the Windows Advanced Boot Options:
Press F8 every second or every half second when your system first turns on or restarts. Some BIOS systems may not recognize the F8 being pressed unless it is pressed very rapidly. Others require the F8 key to be pressed with a longer interval in between. You may have to try different methods of pressing F8 after the Power On Self Test (POST) screen in order to reach the Advanced Boot Options screen. For reference: the POST screen generally has the name of your motherboard (ASUS, Gigabyte, MSI, etc.) or the name of your system's manufacturer (HP, DELL, Toshiba, etc.) as an image/logo or in text as it proceeds through the test, and it appears just prior to seeing the Windows logo for the Windows loading process.

Image


What about with a clean boot?


-----
 
#3 · (Edited)
The problem does not occur in safe mode, nor does it occur in safe mode with networking. I used the "run" program to input the command to check the processes for netsvc again (I didn't know whether or not normal "cmd" worked):

Safe Mode: ProfSvc, Winmgmt

with Networking: EapHost, IKEEXT, ProfSvc, Winmgmt

I also performed the clean boot which, even when all of the services are off, manages to only delay the problem. However, due to this delay, I was able to get into the "services" part of the Task Manager before it got locked up to see if I could stop the services, but when I try to shut any of them down (whether netsvc is hogging up threads or not), a window appears stating "The operation could not be completed. Access is denied." Again, this confuses me because I have administrator privileges.

Lastly, checking the services netsvc runs without it taking up a massive number of threads gives me this: Browser, EapHost, IKEEXT, iphlpsvc, LanmanServer, MMCSS, ProfSvc, SENS, Winmgmt

So while I now know that one of the missing services (AeLookupSvc, Appinfo, BITS, Schedule, ShellHWDetection, Themes, wuauserv) is causing the issue, I have no way to stop them due to the fact that Task Manager won't let me. I did find the administrator
"Services" list, where I can look for each of these by going through the properties of each one until I find all of them. I'll see if I can figure out something to do here.

Edit: As far as I can tell, it's the Background Intelligent Transfer Service (BITS) that's causing the problem because the moment I start it, the thread count on netsvc skyrockets. So now I would like to know if there is some way I can see which programs use BITS, and shut down whichever one causes the issue (this issue hasn't always been happening, only just a few days ago, although I haven't downloaded anything recently). Or, if I can keep that particular service turned off 24/7.
 
#4 ·
I wouldn't recommend changing services just yet. Use your workaround to end the process multiple times until you are able to stop the problem from happening. Then provide the following information:

System Health Report:
Please collect your system health report:

  1. Press the Start Button

  2. Type perfmon /report into the Search programs and files box.

  3. Press Enter

  4. Click File

  5. Click Save As...

  6. Choose HTML as the output and save it for upload here


MSINFO32 upload:
Please upload your msinfo32.nfo file. To get this:

  1. Click the Start Button

  2. Type msinfo32 into the Search programs and files box and press Enter

  3. When it opens, click File

  4. Click Save

  5. Save as msinfo32.nfo and save in a place you will remember

  6. Let it finish the process of gathering and saving the system info

  7. Right click the .nfo file

  8. Click Send to -> Compressed (zipped) folder

  9. Upload the .zip file here.


Administrative Logs:
Please provide us with your Event Viewer administrative logs by following these steps:
  1. Click the Start Button
  2. Type eventvwr.msc into Search programs and files (do not hit enter)
  3. Right click eventvwr.exe and click Run as administrator
  4. Expand Custom Views
  5. Click Administrative Events and give it time to load
  6. Right click Administrative Events
  7. Save all Events in Custom View As...
  8. Save them in a folder where you will remember which folder and save as Errors.evtx
  9. When asked, save the display information in English.
  10. Go to where you saved Errors.evtx
  11. Create a new folder by right clicking in a blank area within the folder Errors.evtx is saved in. You could also click New Folder at the top of the directory under the directory path box.
  12. Name the new folder Errors.
  13. Place Errors.evtx and the LocaleMetaData folder into the new Errors folder.
  14. Right click the Errors folder -> send to -> compressed (zipped) folder
  15. Upload the .zip file here.


Check Windows for Corruption:
Run a system file check to check Windows for corruption:
  1. Click Start Menu
  2. Click All Programs
  3. Click Accessories
  4. Right click Command Prompt
  5. Click Run as administrator
  6. Type
    Code:
    sfc /scannow
    and press Enter
  7. Once it is complete, make note of the message. If it says Windows Resource Protection did not find any integrity violations., restart your computer and post back
  8. If the message does not say Windows Resource Protection did not find any integrity violations., restart your computer and do steps 1-6 again.
  9. You may need to do steps 1-6 up to three times with a restart in between each run to resolve all corrupted files.
  10. If you still have corrupted files after a fourth run, post back here with the following:
    • Click Start Menu
    • Click Computer
    • Open your C: drive
    • Open Windows
    • Open Logs
    • Open CBS
    • Copy and paste CBS.log or CBS (it may not have the log extension) to a location you will remember.
    • Compress (zip) the CBS file and attach the .zip file to your next post.



-----
 
Status
Not open for further replies.
You have insufficient privileges to reply here.