svchost takes up to 99% of cpu

[jreamy4]

my girlfriends machine is a 1.3 pentium 3, 512 ram, xp home system

it work fine and then all of a sudden the scvhost will shoot up to 99% cpu usage and cause the system to slow to a crawl.

i have scanned for a virus, a trojan, both spybot and adaware and all have come up clean.

i did the decombobulater, changed the rpc permissions to "restart the service".

here is a copy of the hijack log:

Logfile of HijackThis v1.97.7
Scan saved at 10:10:48 PM, on 12/6/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Jim\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\system32\svchost.exe

F1 - win.ini: load=???
??? ???
?
???
F1 - win.ini: run=???
??? ???
?
???
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: axscanner - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: axscannerruntime - http://www.pestscan.com/scanner/axscannerruntime.cab
O16 - DPF: First Class Solitaire by pogo - http://temp38.pogo.com/applet/solitaire2/solitaire2-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://gin.pogo.com/applet/gin/gin-ob-assets.cab
O16 - DPF: mscomctl - http://www.pestscan.com/scanner/mscomctl.cab
O16 - DPF: msvcp71 - http://download.pestpatrol.com/Downloads/Components/msvcp71.cab
O16 - DPF: msvcr71 - http://download.pestpatrol.com/Downloads/Components/msvcr71.cab
O16 - DPF: Payday FreeCell by pogo - http://freecell.pogo.com/applet/freecell/freecell-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://popfu.pogo.com/applet/popfu/popfu-ob-assets.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Spades by pogo - http://spades12.pogo.com/applet/spades/spades-ob-assets.cab
O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet/squelchies/squelchies-ob-assets.cab
O16 - DPF: Sweet Tooth TM by pogo - http://temp83fe.pogo.com/applet/sweettooth/sweettooth-ob-assets.cab
O16 - DPF: Tumble Bees by pogo - http://jumbee.pogo.com/applet/jumbee/jumbee-ob-assets.cab
O16 - DPF: Turbo 21 TM by pogo - http://turbo12.pogo.com/applet/turbo21/turbo21-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://whackdown.pogo.com/applet/whackdown/whackdown-ob-assets.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://www.otxresearch.com/OTXMedia/OTXMedia.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37941.6139930556
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

any help would REALLY be appreciated! i'm ready to toss this box on the street!

[caperjack]

I don't see anything really strange in the log ,but I am just learning what it all means , check the highjackthis fourm for more help
http://forums.spywareinfo.com/index.php?showforum=11

[JENS5468]

Re: svchost takes up to 99% - %100 of cpu

i HAD THE SME PROB.

dON'T THINK IT'S A VIRUS

it's funny how different things work for different people/computers. Here's how I solved it.

First I tried the suggestions mentioned by others and got nowhere.

For xp pro

First-- open task manager control/alt/delete keep it open
(note which services are using memory and cpu.)
(some you don't even need like p2p networking - this come installed with kazaa but kazaa does't need it to work- you can uninstall at cotroll panel add/remove programs) and so on.

Second--open control panel/admin tools/services (not component services just plain services.

NOW arrange both windows so you can see them.

now go down the list of services and turn them off and back on while monitering the taskmanager until you see the culprit that is hogging your cpu usage.

note: my culprit happended to be "ssd discovery services" which was indicating it was "stopping" where the others read started.

HOPE THIS HELPS

[j-lo]

common problem with xp - applications not starting correctly, then taking up 99% cpu usage. my experiences show it happens with iexplore.exe, help centre, some virus scanners, etc.. it's quite random, and microsoft have not yet released a fix for it. i'm told it's partially due to corrupt/damaged system files. this fix should work for all versions of xp, but BACK UP ALL YOUR IMPORTANT FILES FIRST!

Place XP CD in cd drive with windows running.
Quit out of the menu that pops up.
Go to START>Run
Type "sfc /scannow" then press OK.

This will check and restore if corrupt all your sytem files. It can corrupt other files, hence the warning to back up other files.

Hope it helps

[TallCool1]

my girlfriends machine is a 1.3 pentium 3, 512 ram, xp home system. it work fine and then all of a sudden the scvhost will shoot up to 99% cpu usage and cause the system to slow to a crawl.

I just noticed that you seem to be running two antivirus programs -- Norton and RAV. This can cause no end of problems, including what you are experiencing.

[dnallias]

Hi,
I have the problem on our server running IIS and a web site with a page containing the control mscomctl.cab.
In your list, i have noticed:
O16 - DPF: mscomctl - http://www.pestscan.com/scanner/mscomctl.cab

You have to know that for queries wich need to return an important amount of data (records), the server hangs till a time out. During the process the cpu goes up to 100%. The server has 1Gb of Ram.

If you have designed the site with this control, i would be glad to know if you foind a solution to this prob.

Cheers

[hstokar]

I just noticed that you seem to be running two antivirus programs -- Norton and RAV. This can cause no end of problems, including what you are experiencing.

I have the same problem and am running NAV 2004. Happens even when diabled. See the following that I found at Microsoft Website
http://support.microsoft.com/default.aspx?scid=kb;en-us;833228&Product=winxp

[TravisO]

MS has finally fixed ALL the bugs relating to SVCHOST. The patch can be found at:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q927891

It's an update to the same patch released a month before, which actually didn't work for me. After installing this new patch it's fixed this problem which I've been having for a year now and has prevented me from using Microsoft Update and would randomly lockup up the PC about 3 times a day!

[Boa2K6]

Well, if this helps anyone....I'm glad. If not, well, that's my two cents. :mrgreen:

Stop or Disable Automatic Updates.....this did the job for me. With Task Manager and Services both open, stopping Automatic Updates immediatley stops 99% CPU usage for PID 1160 svchost.exe. Confirmed 3 of 3 restarts.

Windows XP Pro SP2

[ferchl]

Well, if this helps anyone....I'm glad. If not, well, that's my two cents. :mrgreen:

Stop or Disable Automatic Updates.....this did the job for me. With Task Manager and Services both open, stopping Automatic Updates immediatley stops 99% CPU usage for PID 1160 svchost.exe. Confirmed 3 of 3 restarts.

Windows XP Pro SP2

On the one machine where I had this issue, I also found that stopping Automatic Updates solved the problem. However, I also found that I could keep Automatic Updates enabled once I disabled Microsoft Update returning to basic Windows Update. This is done by going to the Microsoft Update page, clicking Change Settings and then scrolling down and selecting "Disable Microsoft Update software and let me use Windows Update only" and then click Apply changes now.

The only machine that I've seen with this issue had a Celeron processor. I'd like to hear from others to see if a Celeron is a common factor.

[mark5282]

In response to the Celeron question above, I have been trying to solve the 99% cpu problem and also have a Celeron CPU in a Compaq Presario Laptop.

[ferchl]

In response to the Celeron question above, I have been trying to solve the 99% cpu problem and also have a Celeron CPU in a Compaq Presario Laptop.

Thanks. Anybody else?

[gholtean]

The only machine that I've seen with this issue had a Celeron processor. I'd like to hear from others to see if a Celeron is a common factor.

I had the same issue on one of my computers at home (a HP Pavilion 514n with a Celeron CPU @ 2.2 GHz). Disabling return of Microsoft Update to basic Windows Update did the trick.
Thanks a lot :)

[perland]

The only machine that I've seen with this issue had a Celeron processor. I'd like to hear from others to see if a Celeron is a common factor.

Many thanks for the suggested solution, turning off automatic updates also worked on my Dell Inspiron I6000. This laptop uses the Intel Pentium M Processor (1.60 GHz). However, the device handler doesn't report "Celeron", but maybe it's the case.

[jbennet]

it happens on pentium III 1ghz as well

[bakerstacy]

found that I could keep Automatic Updates enabled once I disabled Microsoft Update returning to basic Windows Update.

I love you. A lot. That fixed it on my ancient compaq deskpro en (1ghz Pent III with a whopping 512 ram) at work. You've saved my sanity.

[jbennet]

Ive also noticed that one of the hotfixes in the Unnoficial XP SP3 circulating the net seems to fix this...

[Mavni]

Amazing guys!!
I'm a computer technitian,
I've had this problem with a couple of PC's lately and didn't know why
I used to format them...
disabling automatic upadates or reverting to Windows Update totaly solved the issue!!
This is an AMD Athlon64 3500 w/ 1Gb RAM...
It was completly usless while this svhost.exe was hogging the resources...
This is not a Celeron issue but I think it is surely more noticable...

Great job, guys
Thank you very much
and thank god for the Internet!
as Homer Simpson once said about alcohol;
"Here's to the cause, and solution to all of man's problems"

Keep up the good work!
Mavni

[jbennet]

Yeah, there is actually a hotfix on microsofts site for this. Check the KB

[Steely]

Just signed up to say:

Disable automatic updates

Restart your pc

SVCHOST shouldnt use 100% cpu

Enable Automatic updates

Restart your pc

After a bit it will use 100% cpu again.

It seems to just be something you have to let run for a while. Im sure some clever clogs can use this information for a fix.

If this dosnt work then check for spyware or viruses.

EDIT: GD Dammit!!! Its taken me like 3 days to sign up to this site and someone else has come along and stolen my thunder !!!! Damn you cruel worllldddddddd.....

[dbosell]

I stopped the Automatic updates and this has taken care of the problem!!! I am so glad that I found this fix. I couldn't figure what was hijacking my processor. My machine also has the Celeron processor. Thanks again.

On the one machine where I had this issue, I also found that stopping Automatic Updates solved the problem. However, I also found that I could keep Automatic Updates enabled once I disabled Microsoft Update returning to basic Windows Update. This is done by going to the Microsoft Update page, clicking Change Settings and then scrolling down and selecting "Disable Microsoft Update software and let me use Windows Update only" and then click Apply changes now.

The only machine that I've seen with this issue had a Celeron processor. I'd like to hear from others to see if a Celeron is a common factor.

[jkdas]

its the automatic updates. You can change it to the notify version. In some cases you may need to rename the softwaredistribution folder too with it.

[Olivier75]

I have posted the full solution (in french) here :
http://www.lautre-monde.fr/lautre_monde/2007/05/svchost_99.html

It is basically just about applying a windows patch and reinstalling the windows update client.

[jbennet]

english translation anyone?

[Olivier75]

english translation anyone?

Just follow the two links into the web site, it is basically about applying a patch and reinstalling a S/W component from MS.