Author Topic: svchost /k netsvcs [Problem on Win.7] (Read 26014 times)

tomos · « **on:** May 29, 2016, 09:02 AM »

In the last few months, I've had problems with svchost /k netsvcs hogging CPU & ram (plus lots of page file activity) on three Windows 7 (x64) machines - two mine, the third a friends that I sort-of look after. Problem lasted over a month, but my two were eventually sorted out via windows updates (I dont know which update fixed them -- I only install 'security' updates since this problem, so it was one of them).

EDIT//
To summarise current status of problem:
1) Machine #1 (friend's) has major problem with svchost constantly hogging one full core (dual-core CPU) and windows update not working
2) Machine #2 (mine) has occasional problem with svchost hogging one full core -- temporarily solved by rebooting, [may yet be solved by windows update, will have to give it some time to see]
//

My friends machine (which older) broke from overheating (I presume related to this), and was repaired. It still has the same problem, with the paging file being used a lot too. I am now unable to update it. I believe the problem is related to window update.

Here's a screenshot from my laptop (looked/looks the same in other machines):

Screenshot - 2016-03-08 , 22_59_15.png

I found this post (forums.techguy.org) from a year ago (previous post also possibly relevant)

Hey guys, i too had this problem, i did consult various forums before ending up on microsoft support agents, i got the information that this was indeed a known bug that bundled itself up on windows 7 and probably 8 win(management) framework 3.0 & ^ update and involves handle leakages{ more casual : resource/memory leakage} so that this "super process" svchost(ntsvc) only acquires memory and fails to let go once done using it, there is presently a fix to this issue inform of a hotfix that you download and install onto your computer, it did help but afterwards you gotta be careful with you updates or the bug will show up again.

have a look at this link : microsoft community.
https://support.micr...com/en-us/kb/2889748

I did risk applying the hotfix because they said it should only be applied by those who are greatly affected by the bug, it worked like a charm and now this "process" only uses {3-5}% of my R.A.M while previously it could use upto 70% memory.

Last updates were installed 2016.03.23
The problem machine is unable to get windows updates. I get offered one update (which I believe was on offer but not installed last time updates were checked on April 11th). It's unable to download it (it tries but always 0 from 0mb). Internet connection is working fine.

=> so I decided to try the KB2889748 mentioned in the quote above
Guess what it does before installing -- it checks windows updates (via a small dialogue box) and also cannot get any results. So it goes nowhere. I just closed the machine down.

I'm hoping someone here will have some sort of creative idea here -- or have lately experienced the same/similar problem.
If I've forgotten any relevant/important info - please ask, and I'll add it.
TIA

tomos · « **Reply #1 on:** May 29, 2016, 12:05 PM »

Same problem is back on my laptop

i.e. now currently on two unrelated machines.
FWIW I'm pretty sure this not a virus. It's just a hunch that it's to do with windows updates -- but I do suspect it is ;-)

I'll do a proper backup of this OS etc and then try installing the KB mentioned above.

Screenshot - 2016-05-29 , 19_02_40.png

Curt · « **Reply #2 on:** May 29, 2016, 12:55 PM »

You didn't mention it, so I "have to" ask: Can't a 'phone home' process be avoided, simply by unplugging the machine, before installing?

MilesAhead · « **Reply #3 on:** May 29, 2016, 01:30 PM »

I'll do a proper backup of this OS etc and then try installing the KB mentioned above.
-tomos (May 29, 2016, 12:05 PM)

Is there the possibility of restoring via a backup image to a state when the problem was in abeyance? Myself, if I got it solved I think I would disable Windows Update service right then and there.

svchost /k netsvcs [Problem on Win.7]

tomos · « **Reply #4 on:** May 29, 2016, 01:42 PM »

You didn't mention it, so I "have to" ask: Can't a 'phone home' process be avoided, simply by unplugging the machine, before installing?
-Curt (May 29, 2016, 12:55 PM)

I suspect it will still hang trying to connect -- but I will try it

tomos · « **Reply #5 on:** May 29, 2016, 01:51 PM »

Is there the possibility of restoring via a backup image to a state when the problem was in abeyance?
-MilesAhead (May 29, 2016, 01:30 PM)

I'm not willing to avoid windows updates (on either machine), so not sure if that would help.

To summarise status of problem:
1) Machine #1 (friend's) has major problem with svchost constantly hogging one full core (dual-core CPU) and windows update not working.
2) Machine #2 (mine) has occasional problem with svchost hogging one full core -- temporarily solved by rebooting, [may yet be solved by windows update]

I rebooted my laptop and it very well behaved. Will see if it comes back again. Problem described in quote in OP as it not letting memory/CPU go once it starts using it. Which makes sense to me. There's also updates available for this machine -- they're downloading as I write . . .

MilesAhead · « **Reply #6 on:** May 29, 2016, 02:23 PM »

Do you know what it is running when svchost hogs the core? Svchost is basically a loader to load and run a service. When some service hogs the machine, like Windows Media Player scouring all your files looking for media files to share, it can show up as svchost.exe or as explorer opening and closing every file on the system.

Next time it hogs resources see which service is associated in task manager.

Also you can try backing up the registry(via restore point or dedicated registry backup tool,) then setting all your services at once to the Black Viper recommended settings. You may get lucky. That may smooth things out.

Curt · « **Reply #7 on:** May 29, 2016, 03:02 PM »

http://www.likenewpc.net is merely $20 - if it did the job, otherwise it's free - and is extremely easy to use: Click go, and come back tonight / tomorrow! But this one I have not tried.

After the repair, "Blackbird - Windows privacy, security and performance" may help preventing new problems; my Win 10 is running noticeable better, after implementing the changes from Blackbird 0.9.92. Just remember to first shut down security for a minute.

tomos · « **Reply #8 on:** May 29, 2016, 03:15 PM »

Do you know what it is running when svchost hogs the core? Svchost is basically a loader to load and run a service. When some service hogs the machine, like Windows Media Player scouring all your files looking for media files to share, it can show up as svchost.exe or as explorer opening and closing every file on the system.

Next time it hogs resources see which service is associated in task manager.
-MilesAhead (May 29, 2016, 02:23 PM)

it's not clear/shown which service is acting up (or do you know a way?)
Here some images (first and last probably of most help)

svchost /k netsvcs [Problem on Win.7]

svchost /k netsvcs [Problem on Win.7]
=>
this last one shows thread that's hogging the CPU but doesnt seem very informative (?)

app103 · « **Reply #9 on:** May 29, 2016, 03:35 PM »

I had a similar problem recently, and it turned out to be Windows Update that was hogging the CPU (discovered by turning off the service)

So, I just kept turning it off when CPU ran high.

And yes, Windows Update was hanging on downloading updates in my case, too. It couldn't seem to download anything, as if something was blocking it? (I rebooted machine and tried to run it manually, several times over the course of a month, with no luck)

Not sure what fixed it, but Windows Update could suddenly download and install all the updates and the excessive CPU usage stopped.

Only thing that I changed was my ISP. Not sure if it was a coincidence, but my issues seemed to solve themselves about 3 days after the ISP change. $:-\$

tomos · « **Reply #10 on:** May 29, 2016, 03:45 PM »

^ very interesting, thanks app

Wont get back to it till tuesday now probably -- I had already reduced windows update to just notify -- will now turn off completely.
(So, I do end up following your advice miles :-)

A bit wary of not having an up-to-date machine for a basic user -- but it's better than a burnt out machine

EDIT// my own machine seems to be ok now -- just checked for updates, and it didnt arouse the CPU hogger.
Will sleep.

x16wda · « **Reply #11 on:** May 29, 2016, 07:06 PM »

As a matter of habit I always do: sc config wuauserv type= own

That causes Windows Update to at least run in its own separate process (after a reboot).

You could also try the Windows Update Troubleshooter from the link.

wraith808 · « **Reply #12 on:** May 29, 2016, 08:52 PM »

it's not clear/shown which service is acting up (or do you know a way?)
-tomos (May 29, 2016, 03:15 PM)

The way I determine is to right click on the service, and choose go to service(s). Then I stop the ones that are there one by one. That has helped me to winnow out misbehaving services.

app103 · « **Reply #13 on:** May 30, 2016, 04:20 AM »

^ very interesting, thanks app
Wont get back to it till tuesday now probably -- I had already reduced windows update to just notify -- will now turn off completely.
(So, I do end up following your advice miles :-)

A bit wary of not having an up-to-date machine for a basic user -- but it's better than a burnt out machine

EDIT// my own machine seems to be ok now -- just checked for updates, and it didnt arouse the CPU hogger.
Will sleep.
-tomos (May 29, 2016, 03:45 PM)

I have mine set to download, but notify before installing. I did not disable Windows Update. I only stopped the service when it started using too much CPU. That way it can start up again, on it's own. And I manually checked for updates after every reboot, and tried to install them (but usually failed, till after I changed ISP)

One thing I didn't think to do, at the time, was to take my laptop somewhere else that has free wifi, and try to manually run Windows Update there. If I had, perhaps the problem might have been solved sooner. (Or maybe not?)

So, if it's a laptop, that might be something you'd want to try, first. Either a friend's house, an internet café, or elsewhere, where you can use a different ISP to see if you can get it to download those updates it seems to be stuck on.

msteph · « **Reply #14 on:** May 30, 2016, 11:19 AM »

Tomos, I recently had a similar (if not the same) problem with 'runaway' cpu usage slowing my system down considerably.

This page let me find the offending svchost.exe and it was indeed Windows Update. I've had the autoupdates turned off for a long time, asking for notice of their availability, but WU still must have been running wild.

http://www.hanselman...ToolsInWindows7.aspx

Using that showed the offender within the specific svchost instance was "wuauserv". Turned it off and the system was immediately back to normal and has remained that way. It does mean Updates are off but I suppose one could turn wuauserv on occasionally, as mentioned, to get the latest updates then turn it back off.

This page also addresses the issue and mentions a couple of "KB" fixes but I haven't looked into that.

http://superuser.com...emory-usage-wuauserv

Also a google of "wuauserv" shows a lot of apparently pertinent info, although I also haven't checked those.

Mike S.

tomos · « **Reply #15 on:** May 30, 2016, 12:22 PM »

Thanks Mike for that info.
Thanks April for clarifying.

I disabled win update after rebooting friends machine (the problem one). Then manually got it to search for updates:
straight away the 50%CPU usage plus crazy page file use + no updates found.

So I'm going to turn off win update completely. I see them often enough to check windows update manually.

Re changing IP address possibly helping access updates:
I've been testing it in my place, will report back if it works in their place when I give it back.

[Thankfully my own machine seems to be fine]

tomos · « **Reply #16 on:** July 13, 2016, 09:29 AM »

Two machines still wont update, even when I check manually.
As before, full core gets used by svchost.exe -- if I (can) stop windows update service, things settle back to normal.

(On my desktop, windows update takes 5 minutes of hogging one core before it will tell me what's available -- but at least it works.)

Is there any other way to check for (windows) updates?
I did find this method, but think it's a bit over my head:
https://msdn.microso...90%28v=vs.85%29.aspx

Shades · « **Reply #17 on:** July 13, 2016, 12:45 PM »

Mainly the method you found is intended for companies that roll out MS updates in their local network to prevent all machines in their network accessing Windows update, each downloading the same set of updates, congesting their internet connection.

The most labor-intensive method would be to check the list of MS updates (kb articles) that are made available by MS for each patch day and manually search/download these on/from the MS website.

hornet · « **Reply #18 on:** July 13, 2016, 04:10 PM »

I have had the same problem on my laptop over the last few months.

I have also resorted to turning off windows updates - and the CPU activity became normal again.

I note that when I run a Wise Cleaner scan - it turns windows update back on - and I need to reverse that.

H.

tomos · « **Reply #19 on:** July 13, 2016, 04:28 PM »

I have had the same problem on my laptop over the last few months.

I have also resorted to turning off windows updates - and the CPU activity became normal again.
-hornet (July 13, 2016, 04:10 PM)

so, are you not updating windows at all?

hornet · « **Reply #20 on:** July 13, 2016, 10:46 PM »

so, are you not updating windows at all?
-tomos (July 13, 2016, 04:28 PM)

That is correct. No more windows (Win 7) updates.

H.

tomos · « **Reply #21 on:** July 19, 2016, 09:42 AM »

Okay, a solution for Windows 7 X64 which has worked for two machines:
Install KB3161608

Listed with direct links under "Alternative Fix (June 2016)"
at this superuser post (via superuser link above):
http://superuser.com...n7-sp1/997067#997067

Took a while on the older machine, but both machines found downloads and were able to successfully download and install (I didnt do all updates in one go FWIW)

Note:
my problem was not only very high CPU usage, but also inability to find *any* updates

mouser · « **Reply #22 on:** July 19, 2016, 06:55 PM »

Thanks for posting that link -- I've had this ongoing update problem with a few computers, going to try these fixes.

hornet · « **Reply #23 on:** July 19, 2016, 08:42 PM »

Thanks for the link.

I downloaded KB3161608 and installed it.

Windows Update then told me I had 22 Important updates (186 MB).

Updates have been downloaded and installed.

So far, all is going OK. ....... CPU stayed at 100% for a time, but now has settled to my "old" usage pattern.

...... we'll see....

H.

tomos · « **Reply #24 on:** July 20, 2016, 02:57 AM »

Is there any other way to check for (windows) updates?
I did find this method, but think it's a bit over my head:
https://msdn.microso...90%28v=vs.85%29.aspx
-tomos (July 13, 2016, 09:29 AM)

and this appears to be a solution for updating a windows machine without using winupdate:
WSUSoffline
http://www.wsusoffline.net/docs/

[disclaimer -- havent tried it -- got link via last supseruser link]