Generic Host Process for Win32 Services -- 100% CPU usage

[wal]

WinXP Home SP2
(Using Process Explorer, not Task Manager)

svchost.exe = Generic Host Process for Win32 Services has recently
started causing "CPU usage" to hit 100.00%, thus causing programs to
slow down if not hang completely. The PID of this item varies from
reboot to reboot (1008, 1000, 768, etc.). However, it's the
svchost.exe with the very long list of services, including Automatic
Updates, Computer Browser, Error Reporting Service, etc.

I clicked on the properties of this line item and then the Threads
tab. The specific item causing the CPU usage is entitled:

ntdll.dll!RtlAllocateHeap+018c

(For some reason there are two subitems with this label, but only one
is causing the problem.) When I Suspend this subitem, the CPU usage
goes down to the single digits. When I Resume the subitem, it goes
back up to 97%-100%.

The only thing about my computer that is different from recently is
that I downloaded an update of McAffee SecurityCenter (with virus and
firewall protection). This comes as part of my DSL package from
Verizon.

Any ideas on how to rectify this? Can I just keep the subitem
Suspended?

Thanks.

 

[Newbie Coder]

Wal,

The RtlAllocateHeap is a function used for memory

The PID changes each time because most processes are given an individual
handles by the OS, but System Idle... have static PID's.

The service host you mention seems to be genuine... but the memory leakage
is the problem

What other updates are hogging processor time?

 

[Joe Grover]

Have you tried using Process Explorer to see which particular process
svchost.exe is running that's eating you up?

http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/ProcessExplorer.mspx

If it's wuauclt.exe:

http://support.microsoft.com/kb/916089

Joe

 

[wal]

I'm using Process Explorer, and it shows a particular svchost.exe.
Are you saying there's a way to narrow it down further to a
subprocess? If so, how? Thanks.

 

[MowGreen [MVP]]

On the Menu Bar click View > Lower Pane View > click on DLLs
Click on the svchost instance that is consuming the CPU cycles and then
look in the lower pane
IF wuaueng.dll is listed, then the cause is related to the Windows
Update Agent. See:
http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071

Try the steps listed that were posted May 4th at the top of the article.
IF the svchost instance is not related to the Windows Update Agent, then
try another instance and click on the Image tab to determine the Command
line of that instance.
Post back with the specific Command line of the svchost instance that is
consuming the CPU and someone may be able to assist you.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

 

[Guest]

Hi, I had exactly the same problem that wal described. My problem was
cropping up right after I boot/reboot. Process Explorer reported

ntdll.dll!RtlAllocateHeap+0x18c

as the culprit.

I tried the Windows Update fix, and it worked like a charm!

On the Menu Bar click View > Lower Pane View > click on DLLs
Click on the svchost instance that is consuming the CPU cycles and then
look in the lower pane
IF wuaueng.dll is listed, then the cause is related to the Windows
Update Agent. See:
http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071

Try the steps listed that were posted May 4th at the top of the article.
IF the svchost instance is not related to the Windows Update Agent, then
try another instance and click on the Image tab to determine the Command
line of that instance.
Post back with the specific Command line of the svchost instance that is
consuming the CPU and someone may be able to assist you.

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============

I'm using Process Explorer, and it shows a particular svchost.exe.
Are you saying there's a way to narrow it down further to a
subprocess? If so, how? Thanks.