Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

How can you tell which service is making svchost use tons of CPU?


  • Please log in to reply
9 replies to this topic

#1 signofzeta

signofzeta

  • Members
  • 421 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 22 July 2014 - 10:28 AM

Here's the situation here.  When my computer is idle, the CPU usage is at around 10% all the time, so I check what it was that is using this 10% CPU, and the biggest culprit is svchost.exe.  I right click on svchost and click on services, and it shows the PID as 1380.  I have a bunch of services with PID 1380, but I don't know which one is causing the svchost.exe to use around 8% to 10% CPU while my computer is supposed to be idle.



BC AdBot (Login to Remove)

 


#2 buddy215

buddy215

  • BC Advisor
  • 12,989 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:47 AM

Posted 22 July 2014 - 10:48 AM

You can use Process Explorer.

Download from here and not from Cnet: Process Explorer

 

Info on how to use to find the offending service: Stop svchost.exe from stealing CPU cycles | The Download Blog - CNET Download.com


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#3 signofzeta

signofzeta
  • Topic Starter

  • Members
  • 421 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 22 July 2014 - 11:32 AM

Unfortunately the link you posted does not tell me how he found out which service is the culprit that is causing svchost to hog up the CPU.  He just said he found the culprit, and not how he found it.



#4 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:09:47 AM

Posted 22 July 2014 - 05:40 PM

Take a look here: How to determine what services are running under a SVCHOST.EXE process.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#5 signofzeta

signofzeta
  • Topic Starter

  • Members
  • 421 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 23 July 2014 - 02:20 AM

It still doesn't tell me which individual service from the svchost is causing the 10% CPU usage.  It only tells me which services are under that svchost, and it does not tell me which individual service under that svchost is causing the 10% cpu usage, or if each service is using a equal amount of CPU usage which adds up to 10%.  It doesn't tell me any of that.

 

Here is the situation here.

 

I know that one of the many svchosts is taking up 10% cpu usage.

 

I know that this svchost controls many services.

 

What I do not know is which service within this svchost is causing the 10% cpu usage.  It could be one service causing the 10% cpu usage, or it could be 10 services each using up 1% cpu usage thus adding to a 10% cpu usage.  All I really ask for is for a way to find which service(s) is causing the 10% cpu usage, and not what services is controlled by the offending svchost.


Edited by signofzeta, 23 July 2014 - 02:24 AM.


#6 buddy215

buddy215

  • BC Advisor
  • 12,989 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:47 AM

Posted 23 July 2014 - 06:15 AM

The idea is that once you have identified which svchost contains the service that is using the CPU the most, then

disabling one or more of those services until you find the culprit.


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


#7 signofzeta

signofzeta
  • Topic Starter

  • Members
  • 421 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 23 July 2014 - 11:04 AM

Here is a screenshot of the list of services using that svchost.

 

Attached File  processexplorersvchostpic.jpg   65.6KB   2 downloads

 

I do not want to stop any single service if it means that my computer will be inoperable without having any one of these services started.

 

If I tried to stop any of them, process exploerer has this error message:

 

"Error opening service for control:  Access is denied."

 

I want you to tell me if any of these services listed in the picture above is safe to stop, without wrecking my computer.

 

Or

 

You could tell me if there is a way to isolate the services in that list that is causing the 10% CPU usage.


Edited by signofzeta, 23 July 2014 - 11:07 AM.


#8 signofzeta

signofzeta
  • Topic Starter

  • Members
  • 421 posts
  • OFFLINE
  •  
  • Local time:11:47 AM

Posted 23 July 2014 - 11:23 AM

I was a little too impatient so I went to services.msc and stopped and started each one of these services.  I found the culprit.  On the picture, the service that is causing svchost to use 10% CPU is the very last one on the list.

 

I want to know if this service is necessary, or is there no dire consequence if I stopped it?



#9 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:09:47 AM

Posted 23 July 2014 - 11:49 AM

Here is a description of the service: http://msdn.microsoft.com/en-us/library/windows/desktop/aa384240(v=vs.85).aspx

Someone here: http://www.sevenforums.com/performance-maintenance/303097-winhttp-web-proxy-auto-discovery-service.html

disabled it and is not having problems.

I just verified with one of our Malware training admins that this is not a low-level kernel service. This will be a trial and error type of thing. You can safely disable that service. If problems arise then re-enable it. I have found that many people using Nero and Adobe products have had issues with not having that service enabled. So if you have any Nero or Adobe you might want to reconsider.

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#10 buddy215

buddy215

  • BC Advisor
  • 12,989 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:11:47 AM

Posted 23 July 2014 - 03:27 PM

Curious...what happens after rebooting the comp....does the offending service stay disabled?


“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users