SVCHost using 100% CPU in Windows 7

Question

I am having a problem with Windows 7. When I boot up, the CPU jumps to 100% execution for about 10-15 minutes. During this time, it is really slow, and if I play any music, the songs play slowly and sound distorted.

I tried to scan my computer with different antivirus programs, I used Spybot, HijackThis, and CCleaner, but I didn’t find anything of note.

I watched the process list in Task Manager and saw that there are two processes that are to blame. There are two copies of svchost.exe, one using ~48% CPU, the second (under the Network Service account) using ~37%. For the first 15 minutes, the CPU runs at about 70-80%, then eventually drops to 30-40%.

I don’t know what to do. I could not find a way to stop the services, and if I try to kill them, sometimes the system crashes.

Solution

You are on the right track with your investigation. The problem is that you got stuck at svchost.exe. The catch is that svchost is a generic process that hosts multiple services. What you need to do is to figure out which service that it is hosting is sucking cycles.

1. Get Process Explorer (and run it; of course)
   1. Right-click on the column header and select Select Columns…
   2. Under the Process Performance tab, make sure that CPU and CPU History are selected
2. For each instance of svchost.exe with high CPU usage,
   1. Double-click it
   2. Switch to the Services tab
   3. Click one of the services and click Stop
   4. Look at that CPU graph of that instance of svchost to see if it has gone down
   5. Goto 2.3 until you see a statistically significant drop in CPU usage for that instance
   6. Note down what the last service you stopped was
3. Examine the service(s) that were causing high CPU usage to see if they can be disabled, updated, removed, etc.
4. Figure out why the system idles at 30-40% CPU usage

Comments

[soandos]

possible duplicate of svchost consuming more than 50% CPU all the time in windows 7

[Synthoras]

i think it's not the same, because in my case, kill the PID don't work, the process svchost restart with a new PID an take again the 50% of cpu, but i can try the solution for the music (also if i think it's not the solution if svchost don't stop to use 50% of cpu)

[Bibhas]

Sounds like virus infection to me. Did you scan in safe mode? Try malwarebyte in safe mode. Something is bothering svchost.

[Psycogeek]

Svchost on my machine are all tagged in the resource monitor now. You know one is classed "Svchosts (network services)" , but you did not identify the other ones "service" ? I do not see any Loose "svchosts" on my machine that do not have the (service type) shown in the resource monitor (specific). If you have one that does not have this sub identification, I would want to search for the location and size of all "svchosts" using search, just to check if there is something strange with that. IF it has a sub tag , please identify it.

[Breakthrough]

Did you disable any Windows services before this happened? There's a few essential network services that can cause this behaviour. Also, I've known a few viruses to suppress the action of further scans being run from under the infected host. Remove the drive and scan it externally from another computer.