service host at 100%

[amyb]

My husband's dell latitude is running very slowly. He see that service host is running at 100%. What can he do to alleviate this? Thanks

[NooNoo]

Hi Amy

I guess you are talking about one of the myriad of svchost.exe running? First thing to do is to check whether this is a genuine svchost.exe running... check the spelling AND the capitlisation. Start, run, msconfig - is svchost shown in there? It shouldn't be!

No. 1 suspect is a masquerading malware.
Other causes are things like telephony gone screwy, but it takes a while to track these things down. Start with a full virus/spyware check and run hijack this and put it through www.hijackthis.de

[amyb]

Yes, that's what I mean. If it's not capitalized does that mean it's a malware/virus? He did run a virus scan which revealed no virus.

[Ferrit]

Make sure he runs an online virus and malware scan
www.bitdefender.com
www.ewido.com
Bottom left corner Scan Now

[NooNoo]

svchost should be all lower case

[G Man]

herro. I'm having the same trouble. However mine is a lil different, mine seems to only do it when outlook is open, and it does a send/receive.

Ending the process fixes it for a while, but the problem will resurface later.

THe PID for svchost.exe is 996.

I'm running those tests myself right now to see what it might be :)

[amyb]

He did the M$ update and it hasn't occurred since then (but he went through the same last week). I urged him to do the online scan just to be on the safe side.

[scott]

Have seen this on a few computers with auto updates on. Had to turn it off and do updates manually.

[davelar3212]

This has been the best solution that worked for me.


Follow these steps:
APPLIES TO
1. Click Start, click Run, type REGSVR32 WUAPI.DLL, and then press ENTER.
2. When you receive the "DllRegisterServer in WUAPI.DLL succeeded" message, click OK.
3. Type the following commands in the Open box, one after the other, and then press ENTER after
each command:
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL
1. Click Start, click Run, type cmd, and then press ENTER.
2. At the command prompt, type net stop Wuauserv, and then press ENTER.
3. Click Start, click Run, type %windir%, and then press ENTER.
4. In the folder that opens, locate and rename the SoftwareDistribution folder to SDold.
5. At the command prompt, type net start Wuauserv, and then press ENTER to start the
Automatic Updates service.

[WebHead]

Check out this thread:
http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=1536012&SiteID=2

Oh, btw... if you don't feel like reading that, just try disabling your automatic updates and see if that fixes.

And for further info, here is the definition of svchost:
http://support.microsoft.com/kb/314056

Also, from here:
http://support.microsoft.com/kb/916089/


When you run Microsoft Windows Update to scan for updates or to apply updates to any applications that use Microsoft Windows Installer (MSI) 3.1 together with Windows Update, CPU utilization may reach 100 percent for prolonged periods. Additionally, you may receive the following error message in Event Viewer on a Microsoft Windows XP-based computer:

[G Man]

Hey again guys. Back at work now (thats the computer the problem is on).

Am hesitant to try fixes re: windows update being the problem, coz I am able to end process the svchost causing the problems and all is good.

I have discovered however, that its the.... server? service? Or the workstation? Whichever allows me to browse shares on the network, coz I tried browsing to the server computer here with the \\'s and so on and it popped up with an error saying the service wasn't started.

So my problem is different then? Me confused.

[NooNoo]

Exactly which service did it say wasn't started?

[G Man]

Well, I just checked and it's definetely the server service doing it. It only does it once each time I boot up, once outlook checks the server, I close the svchost instance, then the server service is no longer started and I have no more problems. Weird, hey?

[NooNoo]

You might want to try this hot fix (http://support.microsoft.com/kb/894391) While you don't get the actual error, it is tied to outlook and 100% cpu with svchost.

Otherwise you need to investigate with sysinternals tools what that svchost is actually controlling.

Edit link fixed.

[G Man]

That link no good for me, NooNoo. It just send me back here :(

[NooNoo]

ewps I meant this one (http://support.microsoft.com/kb/894391)

[G Man]

Dang. Still doing it. Installed update OK, in fact it's doing it right now, as I did a reboot this morning. I will have to end process it, so I'll bring up the server service in services.msc, and see what happens to it when i end process so i can see if that's the culprit... Yup, thats the one. As soon as I ended process, it said STOPPED.

?

EDIT: Decided to check the event viewer. Fruitful. When it happened, the following two entries.

-- The Background Intelligent Transfer Service service was successfully sent a start control.

-- The Background Intelligent Transfer Service service entered the running state.

And, now the update manager is running in the systray. Should I try turning off auto-updates? I will.

[NooNoo]

This is all connected, so yes try turning off autoupdates for a while. Make sure the services are disabled in services.msc

[PuterGeekGirl]

Possibly this?

http://support.microsoft.com/kb/936301

[WebHead]

Yeah, so for me, I've been turning off Windows Automatic Updates on every computer I use and never have that 100% cpu usage problem ever anymore. But that's fine, when I am ready to do updates, I just enable the service, do the udpates and then disable it again. So easy. My laptop is so much faster now. I do leave BITS enabled. It's fine to leave it enabled because it won't do anything if Automatic Updates is disabled. BITS only purpose is to service traffic between the host and the WU server.

A few other services that can safely be stopped/disabled to speed up peformance (some of these are already disabled by default, but I'll include them anyway):
- Alerter
- Application Layer Gateway Service (if you need to share your internet connection, then leave it enabled, otherwise disable it)
- BITS
- ClipBook (remote access to clipboard,.. when you disable it, you'll never notice)
- Error Reporting Service (This is that service that asks you if you want to sent your crash dump information to Microsoft. If you like sending them that, then leave it enabled, otherwise disable it).
- Help and Support (You can leave it on, but it just uses resources needlessly. I always use the internet to find answers anyway. I rarely ever use the Windows help feature).
- Messenger
- Netmeeting Remote Desktop Sharing (you might want to read up on this to see if it's something you use. You can still use the remote connection program even with this disabled)

Also, as long as you are tweaking for performance, might as well adjust your pagefile size. System Propertie>Advanced tab>Advanced tab again from Performance Options>Change button>Set initial and max to 3X your physical ram>click the set button>Ok>Ok>Ok. Then reboot. And if you really want to do a clean job of it, defrag your pagefile with this: http://www.microsoft.com/technet/sysinternals/FileAndDisk/PageDefrag.mspx

[G Man]

Ok, updates off, unnecessary services off, BITS off, lets see how this goes. So far so good.

[G Man]

Ok, that seems to have done the trick! Thanks guys!

Now to slither over to the next section for my next problem :-P