Wednesday, September 13, 2006

svchost.exe Using 100% CPU

After much research in this subject I think I have finally found the culprit, at least on my computers. We had a bunch of Windows 2000 Pro machines would run extremely slow with the svchost.exe taking up 100% of the CPU. To answer everyone's first question, this is not a virus. SVCHOST.EXE is a windows core system file. There are viruses out there that use similar processes like "scvhost.exe" to trick you into thinking that the core system file is infected, so becareful with this.

Now to the root of the problem, What's causing the 100% CPU utilization. If you have researched this problem at all you know that in Windows XP you can run: "tasklist.exe /svc" and see that there are a bunch of services that use svchost.exe. The same goes for Win2k Pro but tasklist.exe is not part of Windows 2000. For me, the problem service was the Automatic Windows Update service. Our Win2k Pro stations were all updating from WSUS server. Even if we went to http://windowsupdate.microsoft.com, Internet Explorer would sit there for ever scanning for updates needed. As soon as I stopped the Automatic Update Service, the CPU would go back to almost 0% and the system would run at normal speeds. Unfortunately, turning the Automatic Update Service off, means no more automatic download of updates and if you rely on WSUS, then that won't work either.
From what I can tell at some point in time, Microsoft released an update to the update service that caused the problems because we didn't have these problems before.
A possible solution to this would be to find an older version of the update service and use the "/force" switch from the command line to install it and hope it replaces whatever files cause the problem. Of course, you'll have to make sure you don't ever update it again.
This probably won't be a solution for everyone, but the general troublshooting steps are to use "Tasklist.exe /svc" or something similar to see what services are using svchost.exe, then use the Services control panel to stop them one by one until you figure it out.

0 Comments:

Post a Comment

<< Home