How do I fix this high CPU usage svchost virus or whatever it is?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

a task like this (windows update) which consumes much cpu, but isn't time critical, should run at a low priority in the background, only running when there aren't other tasks ready.

Excellent information, can't wait to get home and fix my wifes computer with what you have posted here Leo, thanks so much! This problem sucked several worthless hours out of my life just last night, hopefully tonight it ends.

This may also help, released 5/14/2007 describing a memory leak in WMI. If WMI uses svchost, this may be the missing link:
http://support.microsoft.com/kb/838884

Here's a step by step we used, that uses some of the above info:

1 - Stop Windows automatic updates service, and disable the service. (100% cpu should drop.)

2 - Install hotfix patch for XP pro:

http://www.microsoft.com/downloads/details.aspx?familyid=7A81B0CD-A0B9-497E-8A89-404327772E5A&displaylang=en

3 - After patch install and before restart, change automatic updates service, back to automatic.

4 - Restart computer.

5 - After restart, login and copy the text below in to a new notepad document and save it as: reset.cmd

(Double click on the file to run it.)

net stop "Automatic Updates"
del /f /s /q %windir%\SoftwareDistribution\*.*
net start "Automatic Updates"
wuauclt.exe /detectnow

5a - What does it do?
The file stops the Automatic Update service, then flushes out the contents of the folder "Software Distribution". It then restarts the Automatic Update service again before forcing an update cycle to start.

6 - Run windows update from explorer, to verify it works, and cpu stays at normal levels. *Important*

Should be good to go now, CPU will be "normal".

This is the FIX - period.

http://support.microsoft.com/kb/927891/

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

*** IMPORTANT ***

Everyone please read the "Update" I just added to the article. It appears that
Microsoft has pushed the fix for this out tough (ironically) automatic updates.

Leo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (MingW32)

iD8DBQFGVHLcCMEe9B/8oqERAlUbAJ43QxE8M01JQx9ulkGrhEgZD7QN0gCcCpyg
ZMJeH/oz3IgsMUCE/dUgmng=
=KbGr
-----END PGP SIGNATURE-----

Small correction: After disabling the Automatic Updates service, you can't get any updates. Even if you visit the Windows Update website and manually try to get patches, it will fail until the service is enabled. In fact, just starting the service is not sufficient, it must be set to an Automatic startup.

If you are suffering from this problem, you can download Process Explorer on another computer and run it on the problematic machine without installing it. That is, PE runs just fine from a thumb/flash drive. Right click on the offending instance of svchost and lower its priority. It may still burn all the cpu, but when you use the system, you should have a higher priority so the system should run at a reasonable speed.

Task Manager can also lower the priority of a process, but it can't pinpoint the services running inside each instance.

9279891 did not work for me after two tries. The "remove and reinstall" does work. I think it is because (as mentioned in previous comments) auto updates is scanning the logging info for its internal use and takes a lot of time especially when the log is big due to a lot of pervious auto updates (and also the scanning algorithm might have just been changed after recent update ignorant to this fact). Remove and reinstall clears the long log so it becomes faster. I just wonder it might come back after many new updates. But who cares? I will just do the same again instead of digging out MS's fix that does not really work for everybody. Thanks for the posts here.

My svchost.exe appears to be sending information to a fake windows update site. Using netstat I found the server's name to be download.windowsupdate.com.c.footprint.net(8.255.64.254). Doing a whois, this does not appear to be a microsoft server. I am not able to recieve any windows updates via automatic or windows update site. When I try to update the svchost connects to footprint and eats my CPU. Could this be an svchost virus? Maybe svchost has been modified so that it loads an infected dll or something.

Great article, thanks. The good news? Process explorer is great. I quickly confirmed that it was windows update eating eating my CPU. The bad news? KB927891 didn't do a thing. So, I've turned off automatic update until MS fixes the problem. (Not that I'm sure how I'll know when that happens.)

Thanks,
Ed

On my computer the svchost problem was related to the DNS Client service. By disabling the DNS Client I was able to solve the problem. Each time I tried to access the internet the svchost.exe file would take up 100% of my cpu resources. The following svchost process was causing the problem.

svchost.exe 980 Dnscache

By typing services.msc into the run box and stopping/disabling the DNS Client everything went back to normal. I also disabled Automatic Updates and Windows Firewall (since I use a different firewall there's no reason to run both of them and it can also cause conflicts to occur) just in case either of those services might cause problems as well.

To post a comment on "How do I fix this high CPU usage svchost virus or whatever it is?", please return to that article's main page.