100% CPU - SvcHost

[JohnB]

I ran into this problem about 2 years ago and found the fix for it. But I
just ran into it again, and I don't find anything that works. I found this
link: http://support.microsoft.com/kb/927891/

But the 2 updates that are recommended don't install, saying the Agent is
already installed.

Does anyone know of the fix for this?

Thanks

 

[Bjarke Andersen]

I ran into this problem about 2 years ago and found the fix for it.
But I just ran into it again, and I don't find anything that works. I
found this link: http://support.microsoft.com/kb/927891/

Does anyone know of the fix for this?

USe Process Explorer to find out which file/service/dll who is responsible
for the 100% CPU usage.

AFAIK there was a problem with Automatic Updates and Microsoft Office
Updates. However I believe the hotfix for this was public released through
Windows Update a year ago.

 

[JohnB]

The 100% cpu utilization is with Svchost.

USe Process Explorer to find out which file/service/dll who is responsible
for the 100% CPU usage.

AFAIK there was a problem with Automatic Updates and Microsoft Office
Updates. However I believe the hotfix for this was public released through
Windows Update a year ago.

 

[Daave]

You need to follow these instructions:

"Use Process Explorer by Sysinternals. Just move your mouse over on top
of the svchost.exe and a balloon message will tell you the service
name."

From:
http://www.raymond.cc/blog/archives/2007/08/23/identify-loaded-svchostexe-in-windows-task-list/

Screenshot:
http://www.raymond.cc/images/process-explorer-svchost.png
Note the balloon message.

 

[PA Bear [MS MVP]]

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[JS]

From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
Also: http://support.microsoft.com/?kbid=314056

To find out more about Svchost.exe entries try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and 'Show Lower
Pane' options.
(This will provide some of the detailed info you may need)
Expand the Process tree until 'Services.exe' has been expanded.
Next move the mouse cursor over the Svchost.exe process that you are
interested in.
Or expand the Svchost entry if you see a + sign to the left of Svchost
entry.
(You should now see a pop up with a list of services associated with the
Svchost.exe you chose)
Next double click on the Svchost.exe process that you are interested in.
The 'Properties' Window should now be displayed with numerous tabs
available.

JS

 

[VanguardLH]

The 100% cpu utilization is with Svchost.

svchost is a container. Several NT services are rolled up within one
instance of svchost. You probably have more than one svchost running.
Process Explorer will let you see what services got rolled into a
particular instance of svchost.

 

[JohnB]

After much Googling I found a solution that worked:

1. Boot the machine with SRService disabled (Select Start / Control Panel /
Administrative Tools / Services. Double click System Restore Service, and
set Startup Type to Disabled, then click OK. Re-boot. You may have to
rename srsvc.dll, even in the DLL cache, to keep it from starting - it's
fairly persistent.)
2. You must grant access to the System Volume Information folder on C:
(Article 309531).
2a. Get a command prompt and type the following, including quotes:
cacls "C:\System Volume Information" /E /G username:F
2b. (To undo these permissions later when finished, type the follwing)
cacls "C:\System Volume Information" /E /R username
3. Move any system restore folders to a temporary location
4. reboot
5. Right click My Computer, and select Properties. This automatically
starts SRService and changes its startup from disabled to automatic
6. Click the System Restore tab
7. Select "Turn Off System Restore" and click apply.
8. Go back and uncheck “Turn Off System Restore” then click apply. Notice
the _restore… folder appears in the System Volume Information folder (No,
the previous restore points don’t re-appear.)