none
svchost.exe (LocalServiceAndNoImpersonation) using about 30% of core i5.

    General discussion

  • I am using a core i5 processor with Windows 7 (Ultimate) x-64.

    seldom the cpu usage goes to about 30-40% and it maintains the level consistent.

    In the resource monitor i found that a process named "svchost.exe (LocalServiceAndNoImpersonation)" makes a abnormal usage of the cpu at a level of about 30-35%.

    I would like to get some assistance for getting rid of this disorder as early as possible, because during the abnormal usage the battery consumption also increases a lot.

    Please help!!

     

    Sunday, July 03, 2011 5:47 PM

All replies

  • Svchost can run multiple processes.  To see the processes in detail, type at the command prompt:

    tasklist /svc <Enter>

    This wil show you all the processes running in the various svchosts, and you can use this method to find which program is causing your high cpu usage.

    Sunday, July 03, 2011 6:12 PM
  • Perhaps a more straightforward method to highlight the likely Services: use Task Manager, right-click the offending svchost.exe and select "Go to Service(s)", this will switch to the Services tab with the Services already highlighted.

    If you then use LatencyMon, you might find a driver responsible and be able to roll-back or update it.

    Sunday, July 03, 2011 6:42 PM
  • On Sun, 3 Jul 2011 17:47:23 +0000, Tanay N wrote:

    I am using a core i5 processor with Windows 7 (Ultimate) x-64.

    seldom the cpu usage goes to about 30-40% and it maintains the level consistent.

    In the resource monitor i found that a process named "svchost.exe (LocalServiceAndNoImpersonation)" makes a abnormal usage of the cpu at a level of about 30-35%.

    I would like to get some assistance for getting rid of this disorder as early as possible, because during the abnormal usage the battery consumption also increases a lot.

    It sounds very likely that you are infected with malware. What
    anti-virus and anti-spyware programs do you run?


    Ken Blake, Microsoft MVP
    Sunday, July 03, 2011 9:46 PM
  • Both Resource Monitor and Process Explorer can show you the specific service running within an svchost that is spiking the CPU. Process Explorer even lets you see the thread using the most CPU within that spiking service (within that spiking svchost).

    Resource Monitor

    1. Launch Resource Monitor from the button on the bottom of the Performance tab in Task Manager, or just Start, Run, resmon.
    2. Maximize the window to see all the columns and sort by CPU.
    3. Check the box next to the specific svchost.exe with high CPU, then click on the CPU tab.
    4. On the CPU tab, expand Services and click the Average CPU column. That will show which service contained within that svchost instance is consuming the most CPU.
    5. Expand Associated Handles to see the handles for that svchost, which may help you figure out what it is doing.
    6. Expand Associated Modules and sort by Full Path to see if any third-party DLLs are loaded within that svchost.
    7. On the Disk tab, expand Disk Activity to see what that svchost is reading and writing to disk.
    8. On the Network tab, expand Network Activity, TCP Connections, and Listening Ports to get an idea what that svchost is doing on the network.
    9. You can also right-click that svchost and select Analyze Wait Chain to see if it is waiting on other processes.

    Only Services under the CPU tab breaks out the activity by each individual service running under that svchost - but that is enough to show you the service with the highest CPU. If you can't tell what it is doing by looking at handles, modules, network, or disk in Resource Monitor, you may need to break that service out into its own svchost. More on that later.

    Resource Monitor showing services running within svchost instance

    Process Explorer

    1. Launch Process Explorer and click the CPU column to sort by CPU usage.
    2. Hit the spacebar to pause updating so things are not jumping around.
    3. Hovering over any svchost.exe in the Process column will bring up a tool tip that shows the services running within it.
    4. Double-click the svchost.exe using the most CPU to view its properties.
    5. The Services tab will show the list of services running in that svchost.exe.
    6. The Threads tab lets you sort by CPU so you can see the DLL file that contains the function being called. You can usually tell the service that is reponsible from that DLL name. For example wuaueng.dll is the module for the Wuauserv for Windows Update. On Windows 7 there will also be a Service column that tells you which service created that thread.
    7. On versions of Windows prior to Windows 7, you may get a message when clicking the Threads tab that you need the debugging tools installed because it needs to access a more recent version of dbghelp.dll. To do that, run the Windows SDK installer and tell it to install only the Debugging Tools for Windows under Common Utilities. Then go to Options, Configure Symbols and browse to the debugging tools folder to specify the Dbghelp.dll path and for Symbol path enter srv*c:\Symbols*http://msdl.microsoft.com/download/symbols).

     

    Thread tab in Process Explorer running on Windows XP

    Running a service in its own Svchost 

    Say Resource Monitor or Process Explorer shows Wuauserv is the high consumer of CPU within that Svchost. You may be able to see enough about what it is doing while it is running in an Svchost with other processes to know what is going on. But often it can be easier to troubleshoot if that one service is running in its own Svchost. That lets you monitor everything about that Svchost process using all the normal methods, knowing the only service responsible for the activity is that one service you are interested in troubleshooting.

    You can use SC to configure a service to run in its own Svchost.

    sc config wuauserv type= own

    Note there must be a space between type= and own (type= own).

    For some services you can run that command, then stop and start the service, and you will immediately have it running in its own Svchost. For others you may get access denied trying to configure them, so you may need to change the Type registry value for the service from hex 20 to hex 10.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
        Type    REG_DWORD    0x20     <== Change this to 0x10 to run in its own svchost

    Once you have it in its own Svchost, use Resource Monitor or Process Explorer to view the activity again because now when you view that Svchost, all activity is just coming from that single service. Filtering on the PID for that process in Process Monitor is another way to view the activity.

    Relevant links

    Process Explorer 14 identifies the service threads in a shared svchost
    http://blogs.msdn.com/b/levs/archive/2010/11/17/process-explorer-14-identifies-the-service-threads-in-a-shared-svchost.aspx

    Figuring out why my SVCHOST.EXE is at 100% CPU without complicated tools in Windows 7
    http://www.hanselman.com/blog/FiguringOutWhyMySVCHOSTEXEIsAt100CPUWithoutComplicatedToolsInWindows7.aspx

    Getting Started with SVCHOST.EXE Troubleshooting
    http://blogs.technet.com/b/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx

    Analyze Wait Chain - Why is my program stuck?
    http://blogs.msdn.com/b/matt_pietrek/archive/2009/04/17/analyze-wait-chain-why-is-my-program-stuck.aspx

    Process Explorer
    http://technet.microsoft.com/en-us/sysinternals/bb896653

    Process Monitor
    http://technet.microsoft.com/en-us/sysinternals/bb896645

     


    Sunday, July 03, 2011 11:31 PM
  • Something similar I noticed happening here just 5 mins ago - and following your clue to look at resource monitor sure enough there was the culprit causing core 7 of my i7 to be at 65% for no apparent reason. Apple mobile device support is now uninstalled - I don't have any mobile devices anyways.. thx for the tips. I'll look into this svchost.exe diagnostics later.

    pkn2011

    Monday, July 04, 2011 12:43 AM
  • I am using Netprotector antivirus. It says it has got anti-malware program too.
    Friday, July 29, 2011 4:38 AM
  • ok!
    I'll try it.

    Thanks.
    Friday, July 29, 2011 4:43 AM
  • The only service running under 'svchost.exe -k LocalServiceAndNoImpersonation' is 'Function Discovery Resource Publication' service.

    Great resource monitor tips.

    In process explorer, to get the services column in the threads for svchost to work, you have to run procexp as the System user.  Download psexec and run 'psexec -sid cmd', then run 'procexp' in the new window.

     

    Friday, July 29, 2011 7:58 PM
  • Hi JS2010, you said.. The only service running under 'svchost.exe -k LocalServiceAndNoImpersonation' is 'Function Discovery Resource Publication' service

    hmm, on mine the only service found for it is:  FontCache  (oops Vista 32bit)

    On my Win7 64bit there's the FDResPub as you've mentioned above, also FontCache, SSDPSRV, upnphost and wcncsvc.

    ???, pkn2011 


    If my post was helpful - give it a Vote. If it helps solve your problem - propose it as Answer. ;-)
    • Edited by pkn2011 Saturday, July 30, 2011 10:36 AM 64bit added
    Saturday, July 30, 2011 10:19 AM
  • Same issue - appears to be another Microsoft train-wreck...
    Tuesday, February 12, 2013 11:55 PM
  • Same issue here - running anti-malware, avast!, and tried gmer on it.  nada - appears to be a microsoft issue - showed up about two updates ago.  Kick a programmer's butt and let's get this repaired...

    Tuesday, February 12, 2013 11:57 PM