Stop svchost.exe from stealing CPU cycles

Svchost.exe processes in Windows Task Manager.

(Credit: CNET Networks)

The situation is familiar to countless Windows users: They're in a groove at work, firing off e-mails, crafting documentation, and even blogging on their personal site during breaktime, when suddenly, something takes over 99 percent of the CPU, slowing it to a virtual standstill. A quick look at the invaluable Process Explorer (or the standard Windows Task Manager) indicates that a process called svchost.exe is using all that CPU. What's more, there's one main CPU offender. Multiple versions of svchost.exe are running in the background and hogging CPU cycles. What is it? Is it spyware? Hackers? Terrorists?

Although there are historical cases of malware using svchost.exe, because of its common presence, it's most likely just Windows being Windows. Svchost.exe is a generic process name for Windows services that run from Microsoft DLLs (dynamically linked libraries). Each of those instances of svchost.exe in the process lists actually represents a group of services that each process is managing. With Process Explorer, it's easy to see which services each process manages, and stop them one by one to see which is the CPU culprit.

In the spring of 2007, a major problem arose with a Windows update that caused svchost.exe to use 100 percent of CPU because of an issue with Automatic Updates. To correct that bug, be sure that Windows is fully patched with the most recent updates.

The first thing to do is to determine which of the active svchost.exe processes is causing the slowdown. Fire up Process Explorer, and click on the CPU column header to sort the list of processes by processor usage. A list of processes, sorted from most processor intensive to least intensive, is displayed. When the computer stalls, switch over to Process Explorer and see which running process is causing the crunch.

Once the offending version of svchost.exe is found, re-sort the processes to keep it from moving up and down the list (because CPU usage changes constantly). Usually, my busiest svchost.exe process will also use a very large chunk of memory, so I usually sort by Private Bytes.

Hovering over an svchost.exe process in Process Explorer will display all of the related Windows services.

(Credit: CNET Networks)

Now that the specific svchost.exe process that's using up all of the CPU has been identified, hover the cursor over its name in Process Explorer. A tooltip window, that provides a list of all the Windows services associated with that process, will pop up.

Users can then use that list to determine which, if any, of the Windows services is killing their productivity. Launch the Services manager in XP by launching the Control Panel, selecting Administrative Tools, and then double-clicking the Services shortcut, or by typing "services.msc" into the "Run" dialog in the Windows Start menu. From this Services manager application,users can pause, stop, restart, or run any of their Windows services.

Often users will see about 20 different services represented by one process (see svchost.exe example in Process Manager above.) How are they supposed to know which of those is causing my computer to slow down? Well, luckily I've played around a bit with nearly all of the services in the list and found my biggest problem: Task Scheduler.

Task Scheduler is a Windows service in the NT family of operating systems that lets users schedule programs or automated jobs that can be performed at specific times or regular intervals. Since I'm working on a CNET company PC, there are a lot of corporate controls that I haven't manually configured. For example, security scans are managed on a networkwide IT level.

While my IT team might not like to hear it, if I'm in a deadline crunch and svchost.exe keeps slowing me down, I generally launch the Services manager and temporarily stop the Task Scheduler and Automatic Updates. Both of these services are critical to the health of my PC, of course, so I can't turn them off indefinitely, but I can stop them for the hour that I need to get my time-sensitive work done. I know that antivirus and antispyware protection is critical, especially for a computer tied to a huge network. However, in my hour of need, the applications that edit text files and images are much more critical than my regularly scheduled virus scan.

Have you suffered performance problems because of an svchost.exe process hogging your CPU? Have you found a solution for the problem? If you've got a great fix for the issue, or a specific question about your computer let us know in the comments.