How do I fix this high CPU usage svchost virus or whatever it is?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Before they sue for libel, let me say that I just spent a very frustrating 2.5 hours on the phone with Microsoft to obtain the following fix, so I'll throw caution to the wind and overtly suggest that the culprit is a recent windows update and they do not want to admit it.

Initial troubleshooting steps with tech - beware: He asked (and I refused) to uninstall my firewall (zonealarm) and antivirus (mcafee). Instead, I kept pointing him back to the previously-posted article ID 903737.

The tech finally relented and sent the requested email (only after getting permission from his mgr). I sincerely hope this fix works for you too:

1. Click Start, click Run, and then
type net stop wuauserv .
2. On the desktop, double-click My Computer, and then delete the drive :\WuTemp
folder.
3. Delete the drive:\Windows \System32\Catroot2 folder.
4. Open the drive:\Windows folder, and then rename the SoftwareDistribution folder
as SoftwareDistributionOLD.
5. Open the drive:\Windows \system32 folder, and then follow these steps: a.
Rename the Wuweb.dll file as Wuweb.dll.old.
b. Rename the Wuapi.dll file as Wuapi.dll.old.
c. Rename the Wuauclt.exe file as Wuauclt.exe.old.
d. Rename the Wuaucpl.cpl file as Wuaucpl.cpl.old.
e. Rename the Wuaueng1.dll file as Wuaueng1.dll.old.
f. Rename the Wuaueng.dll file as Wuaueng.dll.old.
g. Rename the Wuauserv.dll file as Wuauserv.dll.old.
h. Rename the Wucltui.dll file as Wucltui.dll.old.
i. Rename the Wups2.dll file as Wups2.dll.old.
j. Rename the Wups.dll file as Wups.dll.old.
6. Restart the computer.

Thank you to all those who posted the manual fixes on this site! Hoorah!
p.s. The MS tech I spoke with also mentioned that upcoming SP3 would be yet another way to fix the svchost problem.
Finally, I also received the tech's secondary solution, "WindowsUpdateAgent30-x86.exe".
If someone would tell me how to post it here, I'd gladly share.
Kind regards,
JGuest

It should be noted that svchost.exe isn't *always* a virus - there are a number of viruses that call themselves svchost.exe and run alongside the legit svchost.exe.

I've seen this svchost issue automatic updates on a number of machines. What has fixed it on every one of them is this batch file:

net stop wuauserv
net stop bits
net stop cryptsvc

deltree /Y %systemroot%\SoftwareDistribution_Old
ren %systemroot%\SoftwareDistribution SoftwareDistribution_Old

regedit /s "WSUSReset.reg"

REGSVR32 /s WUAUENG.DLL
REGSVR32 /s WUAUENG1.DLL
REGSVR32 /s ATL.DLL
REGSVR32 /s WUCLTUI.DLL
REGSVR32 /s WUPS.DLL
REGSVR32 /s WUPS2.DLL
REGSVR32 /s WUWEB.DLL

net start wuauserv
net start bits
net start cryptsvc

wuauclt.exe /resetauthorization /detectnow

where WSUSReset.reg contains:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate]
"AccountDomainSid"=-
"SusClientId"=-
"PingID"=-

Note this is for a corporate network environment running WSUS, but it should work exactly the same on a home PC (some of the steps are unnecessary on home PC's, but won't cause any harm).

Thank You!!!

After many frustrating days recently fighting this problem (including letting the laptop sit thre for 20-30 minutes waiting for the svchost to get done whatver it was doing., I found the simple step of disabling the Windows update service has worked like a charm. Shame on Microsoft for sitting on this fix (if it indeed a fix).

double shame on microsoft

Suddenly I started getting an infuriating situation where svchost was taking up 99% processor power - I knew this because as soon as I logged on I started task manager to see. I had to do a hard switch off to get out of the problem.
Then I read these hints, downloaded adaware and ran it, and there has been no problem since. Interestingly, adaware did not find any cookies that I would have thought were harmful, but it worked!
Well done, you saved me from a lot of work doing a restore.

A real nice solution I found was rather than turning off Windows Update, give it its own svchost.

Do this by typing in the cmd prompt:

sc config wuauserv type= own

If you notice in process explorer, one svchost has a bunch of things under it, including windows update.
This command will give the windows update service its own svchost, and allow it to function without killing your computer.
Open process explorer again, and see the windows update in its very own svchost.

Thank you Leo! I spent about a day pinpointing the problem and found that it was Windows Automatic Update service causing svchost.exe to eat up 100% of my laptop's CPU usage. I then spent another day googl'ing the web for solutions which none worked until I tried your suggestion to Remove and Reinstall Windows Update. I ran the script and the problem went away instantly. My laptop is healthy and happy. =) THANK YOU!!!

We had this problem on all the PC's at work - over 200, nearly all at the same time :S.. I called MS and got a patch/fix. Although even after running the fix it doesnt fix the problem every time. The only way we have been able to fix the computers is by logging in locally and then once the profile is loaded, restart the computer. Repeat this process until the windows update shield is showing and then select install updates and shutdown.
This is the only solution that has worked for us. We have tried everything mentioned in the previous comments and then some, to no avail.
Hopefully this helps someone!

A while ago I figured out that automatic updates was the culprit behind svchost using 99% cpu, so I turned it off. Since then I have been going to Windows Updates to check for updates. It has worked well until today when this also resulted in svchost hogging 99% of the cpu again. !%#&^. and other very bad words.

To post a comment on "How do I fix this high CPU usage svchost virus or whatever it is?", please return to that article's main page.