Results 1 to 8 of 8
  1. #1
    3 Star Lounger
    Join Date
    Sep 2001
    Location
    Montreal, Quebec, Canada
    Posts
    256
    Thanks
    18
    Thanked 1 Time in 1 Post

    Massive SVCHOST CPU Usage - Win 7 SP1

    I notice that SVCHOST is using a lot of CPU. attached screen shot from Process Explorer indicates 50% and lists some 15 services. I am not sure if any of these are a problem, but a the time I took this shot, no other applications were running. Any suggestions?
    Attached Images Attached Images
    David P - The Truth Is In Redmond

  2. #2
    jwoods
    Guest
    Windows Update was running at the time of the snapshot, so that's a possibility.

    Nothing running inside that SVCHOST process looks out of the ordinary.

  3. #3
    3 Star Lounger
    Join Date
    Sep 2001
    Location
    Montreal, Quebec, Canada
    Posts
    256
    Thanks
    18
    Thanked 1 Time in 1 Post
    You are quite correct, but I have windows update set to entirely manual, so all it could be doing is checking for updates?
    David P - The Truth Is In Redmond

  4. #4
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,490
    Thanks
    284
    Thanked 577 Times in 480 Posts
    Hi David.

    It looks like MSE (MsMpEng.exe) is calling WU + BITS, probably checking for updated antimalware definitions. It's possible that you could tweak the update/check behaviour but I don't know by how much or whether it would just shift the impact to a different set of time slots.

    How many CPU cores does the PC have, how much impact is/was this having on performance/responsiveness?

  5. #5
    3 Star Lounger
    Join Date
    Sep 2001
    Location
    Montreal, Quebec, Canada
    Posts
    256
    Thanks
    18
    Thanked 1 Time in 1 Post
    I have 2 cores, both equally hit. There is a definite impact on performance, and I think you suggestion about Malwarebytes is probably correct. I may try running for a day or two without it
    David P - The Truth Is In Redmond

  6. #6
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,490
    Thanks
    284
    Thanked 577 Times in 480 Posts
    Not Malwarebytes, that doesn't use WU/BITS for anything, MSE = Microsoft Security Essentials (Windows Defender in W8x) seems to be the culprit.

  7. #7
    3 Star Lounger
    Join Date
    Sep 2001
    Location
    Montreal, Quebec, Canada
    Posts
    256
    Thanks
    18
    Thanked 1 Time in 1 Post
    That's interesting. How do you tell from the screen shot that MSE might be the problem?
    David P - The Truth Is In Redmond

  8. #8
    Super Moderator satrow's Avatar
    Join Date
    Dec 2009
    Location
    Cardiff, UK
    Posts
    4,490
    Thanks
    284
    Thanked 577 Times in 480 Posts
    MsMpEng.exe is running and WU/BITS are running, it's the next suspect in line as it regularly sends/receives chunks of data via WU/BITS; next in line might be a sneaky W10-related installed update... malware or an errant file loading from an 'uninstalled' or buggy 3rd party software.

    I can safely disable WU/BITS until I run WU, you can't do that with MSE as it requires both to download new defs and to query the MS servers for file hash checks, etc.

    A few minutes spent with Resource Manager should help you pin down what's happening with that PID, as well as checking it's Properties with Process Explorer's Performance and Disk and Network tabs.

    Some of the data that can be displayed using PE, TaskMan and Resource Monitor below, using exactly the same svchost as yours - but mine is running leaner, only 6 Services attached to it:

    PETMResmon.jpg

    See also HTG's How to for the Sysinternals tools, it might help you find some more clues.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •