SVCHOST using 100% CPU time on XP home

wombat6926wombat6926
edited November 2006 in Science & Tech
I have been having the problem where svchost has been eating up all my CPU time whenever I use IE or outlook. I have been doing a lot of research on this and it looks like Microsoft has a Problem report on this but no other info on the MS site.

I have seen many posts on different sites about this problem but I have not seen a fix for it yet.

My system is clean. Win XP home with SP2 and all the latest updates.
Norton AV and Windows Defender.

On one site I got a program called process explorer that allows you to look at all the processes and threads. I found that the instance of svchost that is causing all the problems is calling:

ntdll.dll!rtAllocateHeap+0x18c all the time and this is eating up the cputime.

This seems to be associated with the windows update "WuAuclt" process.

There is NO network traffic while this is happening, Taskmanager shows no packets in or out so it is not a virus or worm.

I am thinking this is a memory problem??? My ex had a computer that was running real slow... on XP I never figured out what was causing it but
I upgraded her memory it ran a hell of a lot faster! My system has only 256MB and my Motherboard won't allow me to add any more (old system 256mb max).

I have a P3 550mhz and upgraded to XP home because 98 was being discontinued for support.

Any other suggestions would be greatly appreciated

Wombat aka Mark

Comments

  • ThraxThrax 🐌 Austin, TX Icrontian
    edited November 2006
    It's a cheap workaround, but if you disable the Automatic Update service, it'll kill WuAuclt from loading/running.
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited November 2006
    Thrax, I believe you, but would really enjoy an explanation of why Automatic Updates might demand so much power from the CPU. And also, why does it not demand so much on other machines? Why just some computers?
  • QCHQCH Ancient Guru Chicago Area - USA Icrontian
    edited November 2006
    I would check to make sure you SVHOST is really doing what you think it is...

    >START>RUN> type "tasklist /svc >c:\svhost.txt"

    This will create a file on your C-Drive called "svchost.txt" with a list of all the processes running inside all the instances of svchost. There maybe something else that is causing the system to stall....

    {I am not sure how technical you are so excuse if this is too basic or if you have already done it}
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited November 2006
    Leonardo wrote:
    Thrax, I believe you, but would really enjoy an explanation of why Automatic Updates might demand so much power from the CPU. And also, why does it not demand so much on other machines? Why just some computers?

    It's the old "Windows is like a car..." analogy, 99% of the time. You take good care of it, you do all the right things, and one morning you go to start the bugger up and it drives like hell.

    Windows just breaks.

    Now, could it be a virus? Yes, but it's pretty unlikely in this case.
  • wombat6926wombat6926
    edited November 2006
    Well folks I have confirmed it is the Auto Update program! After disableing it my computer us running twice as fast!!!! SVCHOST is now only using 8 Megs of memory and not 60 to 80 megs and is NOT using any signifigant CPU time.

    With Auto update enabled it seems like the first time you access the internet the problem is triggered. Maybe the wuauclt thread under scvhost has a memory leak or is just hogging too much memory???

    I have been using a program called "process explorer" that I downloaded from another tech site to watch and track processes and threads. I will try to get some screen captures of the problem to post here so you can all see your self.

    My reasearch has shown there are many others having this same problem but not all XP systems seem to do this. My system didnt have a problem until recently and I am not sure what the trigger was.

    I Have a service call into Microsoft about this now. But it looks like I will have to jump thru a lot of hoops to convince them the problem is with their ****!

    I am Positive this problem is not caused my a virus or a worm, as I have gone to great lenghts to make sure my machine is clean.

    hope this info helps
  • wombat6926wombat6926
    edited November 2006
    Heres the link for process exporler, check it out ... It seems pretty usefull and gives lots of info about whats going on.

    http://www.sysinternals.com/Utilities/ProcessExplorer.html
  • wombat6926wombat6926
    edited November 2006
    Now that was intresting... As soon as I re-enabeld Auto Updates in automatic mode .. within 30 seconds the problem appeared again.

    As soon as I can figure out how to post a screen shot of PE I will.
  • wombat6926wombat6926
    edited November 2006
    I have also noticed that windows defender is calling wuauclt.exe for updates... and somethng else is... randomly it seems.

    every time wuauclt.exe is run my computer becomes a slug!

    I am trying to talk to microsoft about this but they keep telling me to do a clean boot... etc .etc. etc. they are just giving me the run around.

    mark.
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited November 2006
    Several programs, including Windows Defender, Automatic Updates and newer versions of Office automatically use wuauclt.exe to check for updates.
  • newmanmrnewmanmr
    edited November 2006
    I'm having this same issue. Every time I turn on Automatic Updates (via Properties on My Computer) my CPU spins up, mem usage start getting really high on an SVCHOST.EXE process. Eventually the mem gets so high that the computer freezes. If I turn Automatic Updates off, the mem usage stops growing and the CPU goes back to idle.

    Here's the process that's causing the problem:
    svchost.exe
    AudioSrv, BITS, Browser, CryptSvc, Dhcp,
    dmserver, ERSvc, EventSystem,
    FastUserSwitchingCompatibility, helpsvc,
    HidServ, lanmanserver, lanmanworkstation,
    Netman, Nla, RasMan, RemoteAccess, Schedule,
    seclogon, SENS, SharedAccess,
    ShellHWDetection, TapiSrv, Themes, TrkWks,
    W32Time, winmgmt, wscsvc, wuauserv, WZCSVC

    PLEASE let me know if you have a solution for this issue yet. Thanks!
  • newmanmrnewmanmr
    edited November 2006
    By the way, I'm running XP Pro.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    newmanmr wrote:
    ...Here's the process that's causing the problem:
    ...TrkWks...
    Go Here.

    Then, go here. :)

    I would bet that many of the problems like this have a similar cause.
  • newmanmrnewmanmr
    edited November 2006
    profdlp wrote:
    Go Here.

    Then, go here. :)

    I would bet that many of the problems like this have a similar cause.

    Thanks for pointing out that TrkWks should not be there. May I ask why you suggested the second link? Was my message somehow against etiquette? Sorry if it was. I am new here and just thought I would back up the OP with my same issue. Didn't actually expect to get a solution so quick.
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited November 2006
    No, not a problem with etiquette. It was just an efficient way of pointing you in the direction of setting things up for our virus and trojan removal experts.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    Leonardo wrote:
    No, not a problem with etiquette. It was just an efficient way of pointing you in the direction of setting things up for our virus and trojan removal experts.
    Exactly. Sorry if I came across as being brusque. :)

    I was in the middle of something and my post was a little less informative than it should have been. Our SVT Team will help get you patched right up. :thumbsup:
  • newmanmrnewmanmr
    edited November 2006
    Anyway, turns out my TrkWks is the same version distributed by Microsoft, so no problem there.

    I came across some info online (sorry, don't have the link anymore) that suggested that SVCHOST can get fudd up if you uninstall a lot of software. Just so happens I recently did my Fall cleaning in Add/Remove Programs. So, I downloaded and ran RegCleaner to make sure my registry was clean too. After running RegCleaner, rebooting, turning on Auto Updates, running all MS updates, and rebooting again, my problems seems to be cleared up. Of course, I can't be sure which step solve the problem, but its gone nonetheless.

    Thanks for you suggestions, and I hope this helps the OP or at least someone else.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    Good info, newmanmr. I'm sure it will be of help to others in the same boat. :cheers:
  • ThraxThrax 🐌 Austin, TX Icrontian
    edited November 2006
    To explain this, I highly suggest people read this: HERE
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited November 2006
    Thanks for the link. That was very interesting.
  • wombat6926wombat6926
    edited November 2006
    Ok thanks for all the replys guys. But Im a bit confused ???

    Is trkwks a microsoft dll or a malware/trojan ??? The one I have is signed by microsoft and my Anti virus and windows defender both say it is ok.

    The problem i have detected is caused by wuauclt.exe and it appears to be constantly calling heap reallocation and eating up huge amounts of memory.

    This seems like a microsoft bug to me.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    wombat6926 wrote:
    ...Is trkwks a microsoft dll or a malware/trojan ??? The one I have is signed by microsoft and my Anti virus and windows defender both say it is ok...
    Lots of rotten programs replace a legitimate file with one bearing the same name in order to make themselves harder to detect and remove.

    I'd say that you are probably fine. You can check the file by comparing version numbers and file size over here - click on the little Tech Info tab for the details.
  • wombat6926wombat6926
    edited November 2006
    Ok I checked it out and it's fine.
    I still think the problem is with wuauclt.exe

    I now have to go jump thru some hoops for Mr. gates and his flunkys to demonstrate to them I have an actual problem with their OS. LOL

    Mark.... not Mike
    profdlp wrote:
    Lots of rotten programs replace a legitimate file with one bearing the same name in order to make themselves harder to detect and remove.

    I'd say that you are probably fine. You can check the file by comparing version numbers and file size over here - click on the little Tech Info tab for the details.
  • wombat6926wombat6926
    edited November 2006
    Ok Folks I figured out how to attach screen shots here.

    Here are some screen shots I took of process explorer that show my problem.

    Please Look them over and tell me what you see.

    Mark.
  • wombat6926wombat6926
    edited November 2006
    Ok so my screen shots didnt work... maybe I can email them to anyone who is intrested.

    send me a private email with your addy and I will forward my screen shots to you.

    Mark.
  • wombat6926wombat6926
    edited November 2006
    Hi all:

    Here is a summary of my problem. CPU usage going to 100% and XP very sluggish. I have used "Process Explorer" (sysinternals.com) to trace the problem down to the automatic updates DLL (wuauclt.exe) running under
    svchost.

    Turning off automatic updates helps sometimes but not allways.
    XP, Windows Defender and Office all use the automatic updates system and cause the CPU to go to 100% via svchost.

    I have search this tech site and many others and found 100's of reports of the same problem.

    Anyone with this problem should report it to microsoft!!! I have already filed an incident report (SRZ061102000815) and I want to keep the preasure on them to fix this problem!!!! :crazy:

    http://support.microsoft.com/oas/default.aspx?ln=en-ca&x=14&y=11&prid=3219&gprid=37013

    The more people who report this the quicker they will realize it is a serious problem they will have to fix.

    Mark.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    Did you try the steps listed by newmanmr in Post #17?

    You might also want to try opening a Command Prompt and typing in sfc /scannow then hit Enter. Have your WinXP CD handy when you do it. :)
  • wombat6926wombat6926
    edited November 2006
    Yes I have run 2 different regclean programs, cleaned & defraged the disk etc. I have the Autoupdate set to Notify and it still eats 100% cpu for 20 min at a time.

    Please read Microsoft Bulitin # KB916089 .... http://support.microsoft.com/kb/916089/

    It seems MS is aware of this problem.:rant: and i have comr across over 100 posts on this site and five others that describe the same problem.

    I just want MS to fix it.:woowoo:

    I will try the filescan as you suggest but don't expect to find anything. I keep my computer well protected and firewalled.

    Mark.:canflag:

    profdlp wrote:
    Did you try the steps listed by newmanmr in Post #17?

    You might also want to try opening a Command Prompt and typing in sfc /scannow then hit Enter. Have your WinXP CD handy when you do it. :)
  • tsir112tsir112
    edited November 2006
    Does the memory usage for your particular svchost.exe continue to grow? i am having a similar problem, and it seems that the longer my PC goes without a reboot, the more the memory usage grows. ive seen it as high as 500,000 K. i turned automatic updates off, and the problem stopped. as soon as i turned them on, the memory began climbing.
  • GargGarg Purveyor of Lincoln Nightmares Icrontian
    edited November 2006
    I almost posted a new thread, glad I checked this one first :)

    I was wondering why my SVCHOST was monopololizing one of my work comptuers, turns out it was an SMS push that used the Automatic Updates system. I think I probably botched the update when I killed the service, but man is it annoying when suddenly the computer gets bogged down to the point of being unusable without any warning.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited November 2006
    I realize that it's not the most elegant fix, but I leave Automatic Updates and the Background Intelligent Transfer Service disabled except for the once-every-couple of weeks Windows Update check I do.

    No muss, no fuss. ;)
Sign In or Register to comment.