# svchost.exe using 50-60% cpu



## cookedpotatoes (Jan 31, 2018)

Hi so I recently did a windows update a few days ago and it seems like a problem came after it. Here is a picture:








I tried searching for solutions but none of them worked. I used a program called Process Explorer to see what services were running in svchost and when hovering over it looks like this:








I looked around a bit and I noticed that if you go in to properties of svchost.exe in process explorer, and then go in to the Threads section, there are 2 msvcrt.dll files that are using 23% cpu each. I tried killing them and my cpu usage went back to normal. But whenever I restart my computer it returns. Does anyone know how to fix this?


----------



## dmccoy (Oct 7, 2017)

When you go into the properties window of svchost. Click on the Services tab and provide a screenshot.


----------



## DaveA (Nov 16, 1999)

Have you tried shutting down (not sleeping, hibernate or suspend) and then restarting?


----------



## cookedpotatoes (Jan 31, 2018)

@dckeks when I go into the properties window I can't see any services tab, either in normal task manager or process explorer.









@DaveA Yes I usually turn it off whenever I go to sleep so that didn't work


----------



## dmccoy (Oct 7, 2017)

Okay usually there is one there.

Perform the following:

Step 2:
Click on Start menu
Type command to start searching
Right click on command prompt in list and select Run Administrator
Copy and Paste the command below into the command prompt and press Enter key

tasklist /svc /fi "IMAGENAME eq svchost.exe" > "%userprofile%\desktop\tasklistsvc.txt"

Upload the Tasklistsv.txt to your reply

Run Download Process Explorer
In the View Menu click on Select Columns
Do Not Remove any of the Default Selections
Add Verified Signer, Virus Total selections and Click OK
Select Options Menu and Check Verify Image Signatures, VirusTotal.com > Check Virustotal.com
Double Click on the CPU Column to sort by highest CPU usage.
(Highest CPU Processes should be at the top once sorted properly)
Wait approximately a minute
Select Save or Save As from the File menu and save SystemIdleProcess.txt to Desktop
Upload the file to your Reply


----------



## jenae (Mar 17, 2013)

Hi, this high CPU useage might be only happening at certain times, that dll controls runtime and involves updating modern apps. Most of us turn off background apps it saves processing power and bandwith, and you don't need them running.

Press the win + r keys and in the run dialogue copy paste:-

ms-settingsrivacy-backgroundapps (press enter)

Turn off all running background apps.

See how you go, let us know.

Cmd is:- ms-settingsrivacy-backgroundapps

Forum doesn't like semi colons!! go to pc settings, privacy, background apps.


----------



## cookedpotatoes (Jan 31, 2018)

@dckeks I followed your instructions and uploaded the files

@jenae Background apps were on so I turned it off and it seems like one of those .dll files stopped running in svchost so it uses less cpu now but there still one running so it still uses like 30% cpu


----------



## dmccoy (Oct 7, 2017)

Lets try the following:

*Run WPT*
Step 1:
*Download and Install WPT*
Click on *Start menu*
Type *command *to start searching
Right click on *command prompt* in list and select *Run Administrator*
Copy and Paste the full *commands *below into the command prompt
*xperf -on latency -stackwalk profile -buffersize 2048 -MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d "%userprofile%\desktop\highCPU.etl"*
Let it run for approx *1 min*
Then *Press Any Key* to *Stop* capture
This will create a file *highCPU.etl* on your *desktop
Compress* the file to a *.zip* file and *upload* to your reply


----------



## cookedpotatoes (Jan 31, 2018)

It seems like the problem appears randomly when using the computer so this time it took a while for it to appear but here is the file. When I tried uploading it here it gave me an error multiple times so I uploaded it to mediafire instead, hope that's okay.

http://www.mediafire.com/file/cklqjecn37si0p9/highCPU.zip


----------



## dmccoy (Oct 7, 2017)

Okay, was it showing the high cpu when you ran this command? If not please redo when it happens or I won’t be able to tell much. I will analyze and get back with you as soon as I can.


----------



## cookedpotatoes (Jan 31, 2018)

Yeah I waited to run the command until the cpu problem appeared


----------



## dmccoy (Oct 7, 2017)

I am sorry for the delay, I had a surgery procedure a few days ago but should get to this soon.


----------



## cookedpotatoes (Jan 31, 2018)

@dckeks no problem, hope the surgery went well.


----------



## cookedpotatoes (Jan 31, 2018)

I noticed something new and just wanted to update, when the svchost problem appears I also noticed that my GPU starts spiking at 100% like every minute and it gets really laggy. I tried updating my drivers but it didn't help.


----------



## DaveA (Nov 16, 1999)

I see that you say that you power down every day, but how do you power down?
Do you just push the power button?
Or do you go to Start and then shut down?

If you just push the Power button, then what action is the setting set to when you press the power Button?

See https://www.windowscentral.com/how-customize-power-button-action-when-pressed-windows-10


----------



## dmccoy (Oct 7, 2017)

Does this only happen when you are gaming? If not please perform the WPT step again while not playing a game.


----------



## cookedpotatoes (Jan 31, 2018)

@DaveA I always go to Start then shut down. I only use the power button if there is some sort of problem and I can't turn it off the normal way.

@dckeks I did another scan when it happened while I wasn't gaming and I uploaded that one as well

http://www.mediafire.com/file/5vom7pdqp9mcqmc/highCPU(2).zip


----------



## dmccoy (Oct 7, 2017)

Great, I will check it out.


----------



## dmccoy (Oct 7, 2017)

You may have some possible malware causing these issues. Please perform the following steps:

Download MiniToolBox by Farbar and save it to your desktop.
Run as Administrator to start the tool

Select to Run All options
Click Go and wait patiently
Upon completion (a reboot may be needed) a file called Result.txt will be saved on your desktop.
Upload or Paste the Results.txt to your next reply
Rkill

Download Rkill from the below link.
https://www.bleepingcomputer.com/download/rkill/I
Double click on Rkill program to stop the malicious programs from running
RKill will now start working in the background, please be patient while it looks for malicious process and tries to end them
When the Rkill tool has completed its task, it will generate a log
Do Not Reboot your computer or the malware programs will start again
Upload or Paste your Log file to next reply
Adware Cleaner
Download Adware Cleaner to your desktop.
Important! close all open programs and internet browsers

Double click on AdwCleaner.exe to run the tool
Right-click on program and select Run As Administrator.
Click on the scan button
When the scan is ready click on the Clean button
Upload or Paste the log in your next reply.
Junkware Removal Tool

Please download Junkware Removal Tool to your Desktop.
Please close your security software to avoid potential conflicts. See Here how to disable you security protection (Anti Virus)
Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete, depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
Please post the contents of JRT.txt into your reply.
Please download Malwarebytes Anti-Malware to your desktop.
https://www.malwarebytes.com/mwb-download/

Launch Malwarebytes Anti-Malware Then click Finish.
If an update is found, you will be prompted to download and install the latest version.
Once the program has Started
Click on the Settings button
Click on Protection tab
Enable the Scan for rootkits
select Scan now. Or select the Threat Scan from the Scan menu.
When the scan is complete , make sure that that all Threats are selected, and click Remove Selected.
Reboot your computer if prompted.
After the restart, Open Malwarebytes
Click on the History tab > Application Logs.
Double click on the Scan Log which shows the Date and time of the scan just performed.
Click 'Export'.
Click 'Text file (*.txt)


----------



## cookedpotatoes (Jan 31, 2018)

I followed the steps but when I tried downloading and running rkill, adware cleaner and junkware removal tool I had some problems. When I ran them my pc turned of and I got a blue screen with "critical process died" error. When I tried to search for adware cleaner in both windows search and in firefox it would just shut down. Malwarebyes worked however and I noticed that there were some malware that wouldn't be quarantined even when I pressed it. So I found out where they were located and noticed that I didn't have permission to open the folders. I found out how to reset the permission so I could get acess and I tried deleting the malware files there. Some were running so I couldn't delete them but after restarting I could remove all of it. After scanning with malwarebyes later it came up with 0 threats. I don't know if this has fixed anything but I will keep using the computer and see if I still get the problem.


----------



## dmccoy (Oct 7, 2017)

There are some licensing errors. Please perform the following for verification.

Download and save to desktop - http://go.microsoft.com/fwlink/?linkid=52012 )
Once saved, run the tool.
Click on the Continue button, which will produce the report.
To copy the report to your response, click on the Copy button in the tool (ignore any error messages at this point), and then paste (using either r-click/Paste, or Ctrl+V ) into your response.


----------



## cookedpotatoes (Jan 31, 2018)

Sorry I'm away on a school trip but I will report back as soon as I can.


----------



## dmccoy (Oct 7, 2017)

No problem. Whenever ready


----------

