Ask Leo! by Leo A. Notenboom

How do I fix this high CPU usage svchost virus or whatever it is?

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Windows » Windows Components

Summary: Many people are experiencing high CPU usage, often 100%, in svchost. Svchost is not a virus, but many people think it acts like one.

After I log in, my system slows to a crawl. Looking at task manager I see that my computer is experiencing high CPU usage. Looking more closely I see that something called "svchost" is taking 100% of my CPU time. If I kill the process suddenly other things stop working. Is svchost a virus? How do I fix this svchost problem?

Important: please see the update near the end of this article.

That's actually a composite question based on several reports I've been getting recently.

Svchost is not a virus. In fact it's a required system component. You'll often find several copies of svchost running.

Svchost, or more correctly "Service Host", is a program that is designed to run other programs and "hosts" many of the system services in Windows XP. Several copies of Svchost run more than one service, which is why when you kill an instance of svchost several things on your machine might stop working.

So why is one of the Svchosts taking all your CPU?

And what can you do about it?

From what I've heard and have been able to tell, this is nothing more than a bug. A serious and annoying bug, but a bug nonetheless.

The bug appears to be related to the Windows Update service - the service that you're supposed to keep running at all times so that updates will be automatically downloaded to your machine.

A quick way to tell if this is happening to you is to download Process Explorer and right click on the svchost instance that's taking 100% of your CPU and then click on the Services tab:

Svchost running the automatic updates service

You can see that this copy of svchost on my machine is running not only The Windows Update service, but is actually running 29 services all totaled. So if you were to kill this instance of svchost you'd be killing all of those services and many features and functionality of your system would fail.

One Temporary Solution

One approach to this problem is to stop and then disable the Windows Automatic Update service. If you have it open in Process Explorer, as shown above, with Automatic Updates selected in the list, then just click the Stop button. If your CPU usage then drops to more normal levels, you've identified the problem.

To prevent the Automatic Update service from starting again, right click on My Computer and click on Manage. Expand Services and Applications, and then underneath that click on Services. In the resulting list on the right, locate Automatic Updates:

Service Manager with Automatic Updates selected

Right click on Automatic Updates and click on Properties. Change the Startup type to Disabled:

Automatic Update Service Properties

"There are also rumors that Microsoft will be making the actual fix available in a future automatic update."

(You can also click Stop here if you didn't stop the service earlier.)

Click OK and Automatic Update service should be disabled.

IMPORTANT: since you won't be getting updates automatically, you should now plan on visiting the Windows Update web site periodically to make sure you keep your Windows up to date. As we'll see shortly, this will also become important to resolve this problem "for real".

Another Temporary Solution

Folks commenting on a previous svchost article have reported success by removing and reinstalling Windows Update.

Specifically a series of commands detailed at amset.info labeled Remove and Reinstall of Automatic Updates seems to resolve the issue for many people.

I haven't tried this solution since I've not experienced the problem, but as I said, several folks are reporting good results.

A Permanent Solution?

There isn't a permanent solution. Not yet anyway.

There are rumors that Microsoft actually has a fix, but that you need to call up and ask for it rather than getting it through normal channels. I'm not convinced that this fix is actually for this specific problem that so many people are experiencing.

There are also rumors that Microsoft will be making the actual fix available in a future automatic update. Ironic, since it's automatic update that you may have turned off in order to work around the problem. That's why I recommend making certain you regularly visit Windows Update and take the latest fixes to keep your system up to date, not only for this issue but for any other issues that may crop up over time.

Also, remember, once the problem is fixed, be sure to re-enable the Automatic Updates feature. It remains an important part of keeping your system safe and up to date.

Update!

23-May-2007

I woke to find this automatic update waiting to be installed on my machine this morning:

Automatic Update Install of KB927891

This is the update that's been frequently referenced as a resolution for this problem.

It's possible, perhaps even likely, that this issue will now get put to bed. It's your choice at this point: you should be able to visit Windows Update to take the fix, enabling Automatic Updates again should get the fix downloaded, or you can visit the knowledgebase article to get the fix.

Related:

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:


Why Subscribe?

Article C3020 - May 9, 2007

Recent Comments
136 Comments

I have not had any particular problems with SVChost blocking up my CPU. What I am curious about is my firewall frequently pops up with the question "svchost is trying to access the internet." (Or words to that effect)"Allow? Deny?" I always click "deny". My question is (a) why is it trying to access the internet and (b) am I correct to continue to deny it access?

Cheers Patrick

Posted by: Patrick at July 9, 2009 7:13 PM

OMG, I have spent endless amounts of time trying to fix this problem and thought I would have to reformat my hard drive. It was the HP Network Device Support for my HP Officejet Pro L7780. Thank you! It dropped it from 100% to 2-10% in a moment.

Posted by: Maria Jordan at August 19, 2009 10:59 AM

hi, i do a stupid thing he other night, i was playing but my cpu went to slow so i try to kill some processes. then i, piss off, kill a svchost.exe with a user name Network Services; It appears a message that my system have an error and it rebooted, i was more piss so i wait to shutdown, but instead of waiting to turn on the windows and shutdown properly i turn off the computer, then a couple of days later i turn on the windows partition and my network card appears with "Connection null or limited" or something like that, i was strange because in my linux partition i could navigate well. So i try to uninstall the controllers of the NIC, enter safe mode and try to navigate and nothing happens, the error still was there. I even repair and then format my windows partition with my cd of windows but neither of them work. i can understand why with a format, that obviously change all the windows archives, it didnt work. Do you know what happend and how can i repair it?? Thanks for answering

Posted by: Daniel at August 21, 2009 9:55 AM

Hi,
Just tried everything to fix this same problem - eventually discovered it was my Tom Tom Sat Nav programme which was running in the background that was causing the problem !
Just thought I'd mention it incase it helps others.
Thanks.

Posted by: Kevin Scott at August 26, 2009 10:15 AM

I had the same trouble - 100% usage. Tried registry cleaning, but no significant difference. Then I came across the above comments re HP. I was using an HP Deskjet F370 for its scanning feature. Hmm, I wonder?? Uninstalled it and the problem has disappeared completely. Looks like HP might have a basic problem in their software philosophy. I'm running XP Home SP3. I'll be looking for another scanner.
Thanks for this forum.
Tom C.

Posted by: Tom Chapman at August 30, 2009 11:16 PM

We have had a few problems of the same nature with NC 6220’s . I have again reloaded the notebook with latest Windows SP3 and all relevant patches. I have proven this about 10 times already. The notebook has SVCHOST high utilisation, and runs at 100% utilisation, with the charger plugged in. As soon as I disconnect the charger and the notebook runs under battery power it stabilizes and operates “normally”. Different chargers has been tested and the problem is the same. Which concludes that the problem lies in the hardware specifically whith the power supply. Causing some interference probably on the Motherboeard causing High utilisation.

As someone suggests:

Applying the patch for the KB927891 to your machine does not help.

To stop and then disable the Windows Automatic Update service dos not help.

Does anyone have the same issues, other suggestions or a solution?

Regards Christo

Posted by: Christo at September 2, 2009 11:40 PM

I simply renamed hpslpsvc32.dll into hpslpsvc32.dol (after booting Windows in safe mode) :) and am still able to print ....

Posted by: Ane at September 10, 2009 4:37 AM

I also have CPU 100% usage problem for
Vista 32-bit sp2 ultimate.
P4-3.06Ghz processor , 1.5Gb Ram , G-31 motherboard ,On-b 286Mb VGA(in xp 128Mb),500Gb HD .
In vista ratings my computer represent as 3.0
Please Help
thanks
Sorry about my English .....

Posted by: Sachinthaka at September 15, 2009 7:04 AM

I always format the windows drive and reinstall the windows. It works for a few days ! ;)
Norton Internet Security is the best for this issue !
Have a nice Time !

Posted by: Mohammad Salehi at September 17, 2009 2:16 PM

Thanks Leo. I wrote up a similar article with How-To's regarding svchost.exe and digging deep using Process Monitor.

http://www.groovypost.com/tiny/1911

Hopefully this helps your readers also!

Posted by: MrGroove at October 8, 2009 8:25 PM

Post a comment on "How do I fix this high CPU usage svchost virus or whatever it is?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!

(you may use HTML tags for style)

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

  • Read the article at the top of this page. If your comment shows you didn't, it'll be deleted and ignored.

  • Comment only on this article. Use the Google search box at the top of the page if you have a question about something else.

  • Don't include personal information in the comment. No email addresses. No phone numbers. No physical addresses.

  • Don't spam. Excessive links to unrelated sites within a comment or across multiple comments will cause all such comments to be removed.

  • Don't ask me to recover lost passwords or hacked accounts. I can't, and those comments will be deleted.

  • I can't respond to every comment. And I can't vouch for the accuracy of others who do.

Please wait. Your comment is being processed ...


Question? Ask Leo!