svchost cpu 100% usage

[cism]

ey guys
have any of you encountered this problem?
I scanned using in depth analysis but still unable to find any viruses or spyware.
searched google but still no definite answer, people are still guessing on what causes it.

currently, the only way for me to use the workstation properly is to end the process. Also searched through the msconfig>startup and all seems in order. Might it be starting up as a service? sigh

[ctrlaltdelete]

U could try a very handy program; Process Explorer for detailed information.

U can fid it here; http://www.sysinternals.com/Utilities/ProcessExplorer.html

[ctrlaltdelete]

182573

[cism]

ok i used the program
The service that hogs is
C:\WINDOWS\System32\svchost.exe -k netsvcs

[NOD32 user]

-{ Quote: "ok i used the program
The service that hogs is
C:\WINDOWS\System32\svchost.exe -k netsvcs" }-A bit of general info for svchost.exe -k netsvcs:
This is normally used to launch many dll based services on your PC in one process and itself being located at C:\WINDOWS\System32\ should be the normal part of your Windows. Some of these normal windows services use network connectivity to function properly. Aparently one of the dll based services is choking.

Of the many possible causes for this I would suggest first checking that your software firewall (if you have one) permits internal traffic for this service ie. you haven't got svchost.exe completely blocked, since at a minimum internal communication is necessary for the proper operation of windows.

Then I would suggest repairing IMON and winsock as detailed by Blaskpear in post #81 here (http://www.wilderssecurity.com/showthread.php?p=462132#post462132).

Please let us know what difference that makes if any and we may look at some other things after that if needed.

EDIT: If you're running on a Server OS then IMON should be completely disabled by default with the IMON icon grey in colour.

Cheers :)

[haxrnick]

Hello everyone, this is my first post here! I had the same problem too. I came to find out it ate all my system resources when I have automatic updates enabled. No more than 10 seconds after turning the automatic updates off my pc was at top speed. Hope this helps.

[cism]

come to think of it. the 2 workstations have the same problem after deleting some spyware or trojan.
Is it normal for nod32 to miss some? but when I used in depth analysis the viruses were found. I am also using the blackspear settings.

I have already repaired the winsock, and currently monitoring it. I also disabled system restore. The problem seems to occur when restarting the system.

nod32 user, won't the server be susceptible to attacks if imon is disabled?

[NOD32 user]

-{ Quote: "...but when I used in depth analysis the viruses were found. I am also using the blackspear settings." }-With Blackspears extra settings even something dormant should get picked up during the scheduled weekly scan. The only difference I can think of between that and the maxed out configuration of AMON that Blackspears settings also covers is that some of the advanced detection options are only implemented for newly created or modified files as pictured here (http://www.wilderssecurity.com/showpost.php?p=201881&postcount=16) since pausing the OS like that may result in severe compatability issues.-{ Quote: "I have already repaired the winsock, and currently monitoring it. I also disabled system restore. The problem seems to occur when restarting the system." }-still sounds like it could be IMON used on a server...-{ Quote: "nod32 user, won't the server be susceptible to attacks if imon is disabled?" }-IMON will not be present in v3 when it is released and it is expected to be replaced by something far better. For the time being it provides a valuable first defence against infiltrations for individual PC's and workstations but it is not designed to be used on a server OS (or a workstation running server applications or services) due to the nature of the internal traffic these type of applications generate and use. For a secon opinion you may find this (http://www.wilderssecurity.com/showpost.php?p=824405&postcount=8) recent post useful.
That said I have seen elsewhere here somewhere I think a thread where one user reported with configuration they were able to use it, but it is not supported in this case.
Just test first by temporarily disabling IMON so that they icon is grey (not red) and then reboot. See if your problem is gone then and let us know.

Otherwise we'll check something else.

Cheers :)

[mmartinez]

svchost high CPU occurs when svchost is processing Windows update related tasks, such as checking your computer for updates, downloading updates from microsoft. Give it a couple minutes to complete what it's doing, and it'll be back to normal.

Michael

[Stephanos G.]

What helped me was disabling automatic Windows update - there is a bug which causes a high CPU load:
http://support.microsoft.com/kb/916089/en-us