svchost.exe (LOCAL SERVICE) cpu hog!

oyesiku · #1 09-29-2002, 02:46 PM

I have XP pro system/1gig ddr 266 ram/p4 2.26ghz/netgear router to connect to westell dsl modem (provided by verizon).

i have noticed that when online, the svchost.exe (LOCAL SERVICE) begins eating up major cpu time (30-50) and increases as you spend more time online or even just on your computer not doing anything. after a few hours, it is up to about 85-90 -- basically using up all cpu time. unfortunately, this particular svchost.exe contains many different MS processes, some of which are obviously vital since you cannot end the process in Task Manager. You also cannot decrease the priority of this svchost.exe either. Does anyone know how to combat this problem. I have tweakui (Powertools), customizer xp, and wintask and none of these have provided a way to decrease this services cpu usage.

can anyone help?

Disk_Contented · #2 09-29-2002, 06:47 PM

I have just checked Task Manager and all the svchost services combined equal Zero cpu.
I would disconnect immediately to check for undesired guests, ie virus, trojans, spies etc. do you use a firewall other than the built in MS version? If not, then i would say that a trojan etc would be all the more likely.
It could be simply a software problem, but do you want to take that chance.
I don't want to be the bringer of doom, but it is an avenue that needs to be explored.

oyesiku · #3 09-29-2002, 09:32 PM

doubt that's the answer/cause. i have installed and re-installed my system (from scratch -- formatting the drive) 3 times, and it happens each time. i doubt that with, norton antivirus, norton internet security, and xp's built in firewall that all three times i have gotten trojans. in addition, it is a common xp problem. i have found a number of posts on different sights - yet no answers.

Grendel · #4 09-30-2002, 07:35 AM

Do you have any security software installed by RSA?

Check out the links.
http://support.microsoft.com/default...;en-us;Q324139

It could also be cause by soem scanner software by Visioneer.

http://support.microsoft.com/default...;en-us;Q303777

GOOD LUCK

CONFUSER · #5 10-01-2002, 06:40 AM

I tried to post this yesterday. Do yourself a favor as I had a similar issue that a brilliant friend caught. If you have Partition Magic, boot from DOS and check your partitions. You may have a hole as I did which had a daemon virus lurking there. Reformatting the drive will NOT correct it. No antivirus will find it as it is not assigned. It is probably about 8MB in size. If it is the ONLY way to kill it is to low level reformat your drive. WD and others have a utility that does that. When I killed my Internet connection and network connection, I thought I was in a Steven King Novel as the virus kept banging on my floppy to escape. The symptoms were the same, except mine used 99% of the CPU through explorer. Same effect though.

I hope you don't have it. Only other thought is to kill ALL services you can and go into safe mode. If it still happens, then I bet that you have either a hidden virus or a real one. I'd boot from DOS with anything you have. It doesn't matter and then use Norton or another Antivirus product to check your MBR and your memory.

The Non partitioned issue is a know one which I understand has really never been published by anyone. I hope that helps. Low level formating and reinstalling is no fun. But it's better than where you are now.

Luck

Disk_Contented · #6 10-01-2002, 07:00 AM

Nice one Confuser!
looks like i had the right idea..and this needs further investigation.
No matter what precautions you take

CONFUSER · #7 10-01-2002, 10:13 AM

Thanks. Note some people think that an 8MB un assigned partition is normal on some HAD's. I don't, but I am not a tetchy. Just lucky I had a brilliant friend who immediately diagnosed what neither Microsoft or other could. In any even, the bastard was there and now is gone. Unfortunately I had an 80GIG drive to reinstall! lol!

Note only partition Magic will find it. FDISK. Won't. And don't try to merge the empty one into another. The action seems to work, but when you reboot, NO CHANGE.

Penguin2212 · #8 11-09-2002, 09:15 PM

That 8 mb wasted space on the hard drive is a limitation of the NT File System. That was there ever since I installed Windows XP on a brand new hard drive. I can verify that it has been there since the start, because it is set up like that. Moreover, that space has now been partitioned as a ext3 filesystem. So there's no way there's anything on it.

Disk_Contented · #9 11-10-2002, 03:26 AM

I agree with confuser, i had two of these partitions on mine. They should not be there by default. Plus the fact that i have found these present on Fat filesystems.

botkiller · #10 03-07-2003, 01:38 AM

Ok, so I just got over what was a banging my head on the keyboard problem somewhat akin to yours. I was finding that I could not login to certain services, such as yahoo mail and my ebay. So, I deleted my dialup connection, created a new one, and installed zonealarm. say what you want about ZA, it still catches a lot of random traffic in and out of your box that you dont need. So, upon installing ZA and dialing up again, I was greeted with a zonelarm asking if I wanted svchost.exe to act as a server. I said no, and all my traffic is now a million times faster than it was before.

everyone is talking about how you need to have svchost.exe running, but i as of yet see no reason. it catches traffic for almost no good reason at all, and, despite what others are saying, slows your computer. I am currently investigating as to if svchost.exe is susceptible to trojans and could be used as a remote server into your box.

but my ultimate point here is that I am not running that program right now, and my traffic is three times as fast over a dialup connection, and that's a lot. I am also able to access servcies that as I said, i was not able to access earlier. So, it's up to you, but if i were you I would tell svchost to screw itself and move on.

CONFUSER · #11 03-07-2003, 08:09 AM

Thank you. I will check this out.

CONFUSER · #12 03-08-2003, 08:16 AM

OK My turn!

How do you kill severest? I can't find it in services ( I can find the file, but I know damn well if I delete it) it will be restored from cache. So hod did you accomplish this feat?

Thanks a lot

cheers

ccsteiny · #13 04-08-2003, 01:31 PM

Yea, my svchost has been pissing me off lately, the computer will be running fine for a long time, then all of the sudden it starts lagging everything, I looked at processes and sure enough it was svchost, I figured by ended the task it might help, of course it did, then I lost sound

on the whole computer. So, I have to restart the comp for it to go away. It jumps from 0 to like 40-80 every like 30 seconds to a minute. Its really annoying. Does my schools firewall have anything to do with it? or is it something in XP?

qhp310 · #14 02-25-2009, 07:01 PM

Hi
I just fixed a similar problem.
1 - Immediately after rebooting, my Processor useage was 50% (I have dual processors)
This was fixed by going to the service management and disabling HPSLPSVC32.DLL (HP network device support) I have a HP printer.
2 -Then, after a while and no recall of what I had been doing, the processor would act up again, but this time in quick burst mode for about 45% (both processors).
This was fixed by doing Regedit.
I have a Canon Scanner 9950F. Recently, I moved the USB connection and was left with Scanner #1 (inactive) and Scanner #2. Scanner #1 (inactive) was the culprit. It was being polled after using the Scanner.
See Microsoft about a Visioneer USB Scanner:
http://support.microsoft.com/kb/303777
When you have located the device key for your scanner, open the following DeviceData subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000\DeviceData
NOTE: There can be multiple values in this key, such as, Server and TwainDS.

To change the polling time interval, create a new DWORD value under DeviceDate called PollTimeout, and then set its value to have a polling interval in milliseconds. A value of 1000 can poll every second. The default value is set at 700.
To disable the button functionality and the polling capability, create a new DWORD value called DisableNotifications, and then set the value to 1...................................
I applied the last solution "DisableNotifications" to my Scanner #1....Et Voilà
Hope this helps.
Regards

goldsteve · #15 06-04-2009, 10:48 AM

I do network admin for a medium business and have had a few issues with svchost, specifically c:\windows\system32\lhmsvc.dll running via svchost.exe -k LocalService.

Use process explorer to try and find some more detail of exactly what process is causing the issue, slowly stopping each service until the CPU stops running at 100%.
See here for help http://www.bleepingcomputer.com/tuto...torial129.html

There are a number of svchost related issues resolved in XP service pack 3, so I would first try applying or reapplying SP3.

If that doesn't work, try updating the WindowsUpdateAgent as per http://support.microsoft.com/kb/932494/en-us and http://support.microsoft.com/kb/927891/

You could also try these steps: http://support.microsoft.com/kb/927385/en-us

I have had luck with these steps, which made a sluggish PC seem fresh again, but it depends on what service within svchost is causing the issue.