High CPU usage by 'svchost.exe' and 'coreServiceShell.exe'

Question

I am having a laptop running on Windows 7 Ultimate 32-bit. Since past few days, my laptop is facing a serious problem. Whenever I connect to Internet, either svchost.exe or coreServiceShell.exe or both hog the CPU. The coreServiceShell.exe consumes a lot of RAM also.

Going into the details, I found that high CPU usage of svchost.exe is caused by Network Location Awareness service.

And the high CPU usage of coreServiceShell.exe is caused by Trend Micro Titanium Internet Security 2012.

That kind'a makes me think that Trend Micro may be the root of the problem.

After further testing, I found that if I use IE or Firefox to browse the Internet, immediately after connecting to Internet, things are normal. See

and

But if I use Google Chrome, the coreServiceShell.exe hogs both CPU and RAM.

At this point, if I disconnect the Internet, the CPU and RAM usage by coreServiceShell.exe continues to be high till I close the Chrome. Also, when I close the Chrome, while Internet is connected, svchost.exe continues to hog CPU but coreServiceShell.exe leaves the race.

That makes think that Chrome is the root of the problem, but again, tracing coreServiceShell.exe takes me back to Trend Micro Internet Security. Stopping the Protection by the Trend Micro Internet Security doesn't help either (I am not able to stop its services though).

I have updated the Chrome, but no help.

I just can't figure out who is the culprit. I can't do without the Google Chrome (of course, by not using it) because of its immensely useful and indispensable features both during browsing and development. Secondly, I can't uninstall the Trend Micro Internet security Suite since it still has few months before it expires and is proving me reliable protection.

What could be the cause of the problem and what can I do to resolve this?

Thanks in advance

Solution

On researching further, I found somewhere that that culprit may be the hosts file in Windows/System32/drivers/etc directory. I opened the hosts file and found that its size was about 1.2 MB with few thousand entries, instead of just about 1KB file. Whenever I connected to Internet, the servicehost.exe process looked up the file, which was unusually large. I removed all the entries in hosts below the default ones, and amazingly, the problem was solved.

Another thing that I found was that such entries are written to the file by Spybot SnD. And in fact, I had scanned my laptop several times in a month or so to remove frequent Spyware infections, which used to block the Internet on the laptop. That justifies the point.

That eventually leads to the conclusion that both the anti-viruses I had installed were not doing enough to stop the Spyware. Then I switch to Norton Internet Security, removed Spybot SnD. Now, I am not having any problem since about two-and-a-half months.

Conclusion, when suffering from such a problem, clear your hosts file and use some "Reliable" Internet Security suite.

Comments

[pneumatics]

Chrome is notorious for leaking memory especially with some newer builds. In your search bar, try running the Canary build of Chrome, searching "canary" should bring it up. Test your RAM levels against this, if it isn't leaking like your current chrome stable build, you should be fine, the newer version will take care of the bug once it goes live(usually every week). If it is the same however, then you can discount chrome being the culprit, even though its entirely possible that the particular bug you're referring to may not have been fixed, though unlikely.

[Kumar Kush]

@AlanTuring: I have read documentation about Canary build. They say it is highly unsafe to use. What is the current status of build? Is is safe to use?

[pneumatics]

I don't understand what you mean by highly unsafe. It is just the beta version of chrome, a version ahead of the one you currently use. Regardless, the point is to check if Canary has the same memory leak problem.

[Kumar Kush]

@AlanTuring Thanks. Canary built isn't causing any memory leaks. BTW, sorry for being late. The regular Chrome version is still taking toll of my laptop resources.

[pneumatics]

alright well, it could be any number of things, i would just use canary build since google's documentation of bugs can be kind of painstaking to weed out. If you're absolutely adamant about using your current version of chrome, then maybe we can run some tests

[pneumatics]

Fair enough, well there is only one other real test apart from using the task manager, that is here : nesj.net/blog/2012/04/javascript-memory-leaks . Get some what familiar with the Heap Profiler and track it, maybe you can weed out the specific process that is causing the memory leak within chrome.

[Scott Chamberlain]

Spybot does not remove viruses, only spyware, you should either run two programs or something that does both (like Norton Internet Secruity)

[Darpan]

Kush, I have been facing same issue, And my 'hosts' file located at C:\Windows\System32\Drivers\etc\hosts, is of 1Kb only. Want to see how you dubugged and traced the roots of your problem. It could help me as well..

[Kumar Kush]

@Darpan: Could you please send a screenshot of the Task Manager sorted CPU usage-wise and RAM usage-wise. And also which OS and which Anti-virus / Anti-malware you are using. If you can, drop me a mail at [email protected]. I am not into such tech things for over 3 years, but I will try helping you.