Stop svchost.exe from stealing CPU cycles

Stop svchost.exe from stealing CPU cycles




Svchost.exe processes in Windows Task Manager.(Credit: CNET Networks)

The situation is familiar to countless Windows users: They're in a groove at
work, firing off e-mails, crafting documentation, and even blogging on their
personal site during breaktime, when suddenly, something takes over 99 percent
of the CPU, slowing it to a virtual standstill. A quick look at the invaluable
Process Explorer (or the standard Windows Task Manager)
indicates that a process called svchost.exe is using all that CPU. What's more, there's
one main CPU offender. Multiple versions of svchost.exe are running in the
background and hogging CPU cycles. What is it? Is it spyware? Hackers?
Terrorists?
Although there are historical cases of malware using svchost.exe, because of
its common presence, it's most likely just Windows being Windows. Svchost.exe is a generic process name for Windows services that run from Microsoft DLLs
(dynamically linked libraries). Each of those instances of svchost.exe in the
process lists actually represents a group of services that each process is
managing. With Process Explorer, it's easy to see which services each process
manages, and stop them one by one to see which is the CPU culprit.
In the spring of 2007, a major problem arose with a Windows update that
caused svchost.exe to use 100 percent of CPU because of an issue
with Automatic Updates. To correct that bug, be sure that Windows is fully
patched with the most recent updates.
The first thing to do is to determine which of the active svchost.exe
processes is causing the slowdown. Fire up Process Explorer, and click on the CPU column header to
sort the list of processes by processor usage. A list of processes, sorted from
most processor intensive to least intensive, is displayed. When the computer
stalls, switch over to Process Explorer and see which running process is causing
the crunch.
Once the offending version of svchost.exe is found, re-sort the processes to
keep it from moving up and down the list (because CPU usage changes constantly).
Usually, my busiest svchost.exe process will also use a very large chunk of
memory, so I usually sort by Private Bytes.

Hovering over an svchost.exe process in Process Explorer
will display all of the related Windows services.(Credit: CNET Networks)

Now that the specific svchost.exe process that's using up all of the CPU has
been identified, hover the cursor over its name in Process Explorer. A tooltip
window, that provides a list of all the Windows services associated with that
process, will pop up.
Users can then use that list to determine which, if any, of the Windows
services is killing their productivity. Launch the Services manager in XP by
launching the Control Panel, selecting Administrative Tools, and then
double-clicking the Services shortcut, or by typing "services.msc" into the
"Run" dialog in the Windows Start menu. From this Services manager
application,users can pause, stop, restart, or run any of their Windows
services.
Often users will see about 20 different services represented by one process
(see svchost.exe example in Process Manager above.) How are they supposed to
know which of those is causing my computer to slow down? Well, luckily I've
played around a bit with nearly all of the services in the list and found my
biggest problem: Task Scheduler.
Task Scheduler is a Windows service in the NT family of operating systems
that lets users schedule programs or automated jobs that can be performed at
specific times or regular intervals. Since I'm working on a CNET company PC,
there are a lot of corporate controls that I haven't manually configured. For
example, security scans are managed on a networkwide IT level.
While my IT team might not like to hear it, if I'm in a deadline crunch and
svchost.exe keeps slowing me down, I generally launch the Services manager and
temporarily stop the Task Scheduler and Automatic Updates. Both of these
services are critical to the health of my PC, of course, so I can't turn them
off indefinitely, but I can stop them for the hour that I need to get my
time-sensitive work done. I know that antivirus and antispyware protection is
critical, especially for a computer tied to a huge network. However, in my hour
of need, the applications that edit text files and images are much more critical
than my regularly scheduled virus scan.
Have you suffered performance problems because of an svchost.exe process
hogging your CPU? Have you found a solution for the problem? If you've got a
great fix for the issue, or a specific question about your computer let us know
in the comments.