# SVCHOST.EXE making cpu usage at 100% and slowing computer to a crawl



## gg1012a (Dec 30, 2010)

I'm new to tech forums because I can usually solve my problems from other peoples' posts but I have not been able to figure out this problem, so bear with me.

I noticed a couple days ago that my computer became extremely slow, so I opened up task manager and saw under Processes that one process called "svchost.exe" was taking up all the cpu. The cpu usuage was at a constant 100%. Now, Its my understanding that svchost.exe is a application that windows uses to execute .dll files. What I could not figure out how to do was see which .dll's this particular svchost was running. I tried right clicking on the process and going to "go to service(s)" but nothing is highlighted when it switched to the services tab (this goes for any process, though, any process i click "go to service" it does not highlight the service for some reason). However, it works the other way around, when I go to services and right click "go to process" it does work and show me the corresponding process. 

So, I sorted all the services and went through every single running service and right-clicked on "go to process" for each one but none of the services corresponded with the specific svchost.exe that was using all the cpu. Is it possible for svchost.exe to run without a visible service?

I'm thinking it is a virus, or somekind of spyware because its become extremely diffuicult to fix and I can't even figure out what it is. My AVG Antivirus found nothing. When I click "end process tree" it kills the process and the cpu usage returns to normal, but if I restart the computer it runs again. When I boot in safe mode, there's no problem. I also went to msconfig and unchecked everything on the startup menu I felt was not necessary but it did not help. 

Here is my computer info: Toshiba Satellite L505-S5965
Windows 7 Home Premium (free upgrade from vista)
processor: Amd Athlon X2 DUal-Core QL-65 2.10 ghz
System type: 32-bit

PLEASE HELP. Sorry for the lengthy post, but I figured I'd get all the info out there to start so we don't have to go back and forth 100 times. Let me know if you need anymore information. Thank you!!


----------



## jenae (Jun 17, 2008)

Hi, run the following .zip file then right click on the returned .Bat file select "run as administrator" Restart computer. Have you installed all windows updates? 

View attachment 84424


----------



## gg1012a (Dec 30, 2010)

Thank you for your timely response. Ok, so I did what you said, I unzipped the file and ran the .bat file- It opened up a command prompt and then scrolled down really fast and disappeared, but then I realized that when I did this the troublesome svchost was not running because I had killed its process tree so I could use the computer. So, I restarted the computer and at first it was fine but then about 5 minutes later the svchost popped up and made the cpu usage 100% again. So I ran the .bat file again and this time the command prompt took over 30 min to complete (going through what looked like different .dll files) and then disappeared. I restarted the computer again and same thing, fine for 5 minutes but then svchosts pops up and takes all the cpu.

Yes, I installed all major windows updates. There are 5 optional ones that I have not but they don't seem relavent and I don't think I need them. I know from other threads that windows update is a common problem taking up cpu, but during services-to-processes check the windows update service corresponded with a svchost.exe process but not the one that is causing the problem. 

I'm not sure what the .bat file did/was supposed to do...?

Please advise on what I should do next. Thank you.


----------



## reventon (Oct 16, 2009)

From what I can make out - the *.bat* file simply re-registers system DLLs that are a common cause of svchost problems. It also tidies up temp files - another common cause of svchost hangs.

So - now time to look a bit closer at the offending *svchost* process (as more than one runs on your system).

Download this program to the desktop - http://live.sysinternals.com/procexp.exe

Right-click on it and select *Run as Administrator*.

Sort by the CPU column and wait until the usage peaks. Then doubleclick on the *svchost.exe* process that is using the most. Go to the *Services* Tab and see exactly what services are being hosted (svchost = "Service Host"). Take a screenshot if you can.


----------



## gg1012a (Dec 30, 2010)

I actually have this program already cause I tried earlier to use it to try to figure this out but no luck. I couldn't take a screenshot because the computer just wont respond because of the cpu usage, so I'll try to paint you a picture with words:

Note: there is no "Services" tab. Instead of "Services" there is a "threads" tab. When I click on other, not troublesome, svchost.exe processes they DO have a services tab, but this one doesn't. So now i'll go through each tab and give you relvant information about this particular svchost process:

*Image Tab*: 
Version: n/a
time: n/a
path: Not Available
Command Line: (blank)
Current Directory: (blank)
Parent: services.exe (648)
User: <acess denied>

*Security Tab:*
User: <access denied>
(everything else is blank)

*Environment Tab:*
completely blank

*Strings Tab:*
all blank

*TCP/IP Tab:*
all blank

*Threads Tab:*
TID: 6080
CPU: (keeps changing but around 50)
Start Address: 0x0

-Thats it. Also, when I try to kill the process from Process Explorer it say access denied. I should point out that when that .bat file was running the cmd prompt some the files it tried to access said "access denied" too.


----------



## reventon (Oct 16, 2009)

That doesn't sound good.. 

In the *Image* tab - can you see a "Verify" button on the right hand side? Click it, and see if *(Verified)* shows near the top left of the tab.


----------



## gg1012a (Dec 30, 2010)

haha yeah I didn't think so...you can imagine how frustrating this is.

I see the "Verify" button but it is grayed out and not clickable. But I checked with some other processes and some of them the "Verify" button is grayed out as well. What's also concerning me is why it says "<access denied>" under User. It also says that under User for some other processes that run fine like winlogin.exe and my AVG antivirus...

Please advise further...


----------



## reventon (Oct 16, 2009)

You are running *procexp.exe* with elevated privileges (right-click -> Run As Admin) right?


----------



## gg1012a (Dec 30, 2010)

This might help:

So, after I killed the process tree so I could use my computer normally, I was just clicking on random svchost.exe processes running in the Process Explorer and I came across one that is identical on all the tabs as the troublesome one except that under the Threads tab it has 2 threads instead of one: the first one is the same as the other one with a Start Address of "0x0" BUT there's a second one that has a start address of "ntdll.dll!RtlUserThreadStart" and under "State" it says "Wait:WrQueue". This did not seem normal to me...
If I try to kill the thread using Process Explorer it says Access denied or Unable to Acess Thread. 

Hope that helps figure this out...


----------



## reventon (Oct 16, 2009)

gg1012a said:


> If I try to kill the thread using Process Explorer it says Access denied or Unable to Acess Thread.


Even when "elevated"?


----------



## gg1012a (Dec 30, 2010)

Wait, I don't think I was running it with elevated privelages because I was just double-clicking on the shortcut. Let me reboot so the svchost pops up again and I'll try running it your way.


----------



## gg1012a (Dec 30, 2010)

Ok so I am now running procexp.exe with elevated privelages and some things changed. Under User it now says NT AUTHORITY\SYSTEM. All those tabs that were empty are now filled in with a bunch of stuff. I was able to click "verify" and it DID say "verified" in the top left corner". I was now able to "suspend" the process, which returned my cpu levels to normal and allowed me to take screenshots of each of the tabs. I then "resumed" the thread and it instantly jumped my cpu level back to 100%. I tried to kill the process from the image tab but it still said access denied, but I was able to kill the individual thread (the 0x0 one) from the thread tabe, which returned my cpu levels to normal and highlighted the thread in red. Not really sure what this all means...

I have screenshots of all this but I can't figure out how to post them here...When I click insert image it asks me for a url which doesnt make sense. I put in the file location instead of the url but it didn't work. I can email them as an attachment if you want to provide me an email or help me post them here (there are 10 total).


----------



## reventon (Oct 16, 2009)

Upload the images to http://img709.imageshack.us/ or similar and then link them.


----------



## gg1012a (Dec 30, 2010)




----------



## gg1012a (Dec 30, 2010)

http://img52.imageshack.us/img52/2630/screenshot1rr.jpg


----------



## gg1012a (Dec 30, 2010)

http://img828.imageshack.us/img828/3420/screenshot2vz.jpg


----------



## gg1012a (Dec 30, 2010)

This might be easier:
[url]http://img52.imageshack.us/img52/2630/screenshot1rr.jpg[/URL]
[url]http://img828.imageshack.us/img828/3420/screenshot2vz.jpg[/URL]
[url]http://img151.imageshack.us/img151/2043/screenshot3qv.jpg[/URL]
[url]http://img411.imageshack.us/img411/7982/screenshot4ad.jpg[/URL]
[url]http://img59.imageshack.us/img59/6344/screenshot5l.jpg[/URL]
[url]http://img826.imageshack.us/img826/3088/screenshot6w.jpg[/URL]
[url]http://img259.imageshack.us/img259/9686/screenshot7lf.jpg[/URL]
[url]http://img256.imageshack.us/img256/1829/screenshot8mu.jpg[/URL]
[url]http://img35.imageshack.us/img35/7171/screenshot9gg.jpg[/URL]


----------



## gg1012a (Dec 30, 2010)

any suggestions?


----------



## reventon (Oct 16, 2009)

Hi,

I couldn't find anything out of place in those screenshots.

Please run these commands from an elevated (right-click -> run-as-admin) command prompt (you can right click to paste the lines in the command window).

```
[font=lucida console]
echo [PLAIN][code][/PLAIN] > 0 & tasklist /svc /fi "imagename eq svchost.exe" >> 0

tasklist /v >>0 & tasklist /m >> 0 & echo [PLAIN]
```
[/PLAIN] >> 0 & notepad 0
[/font][/code]

Then copy and paste all the text in the notepad in your next post.


----------

