none
SVCHOST - DNS Client High CPU Utilization

    Question

  • Hello Everyone,

     

    The past couple of days I've noticed an unusually high CPU utilization from one of the svchost.exe processes.  Upon deeper inspection it turns out that the DNS Client (Dnscache) is the culprit.  I've been able to curb the CPU thrasing (constant 60-80%) by disabling the DNS Client service on startup.

     

    Does anyone know if this is a known (and unresolved) issue?  I've checked so many forums, blogs, etc. but there doesn't seem to be a good answer, everyone is just grasping.  I tried the search function on this site but wasn't successful either.

     

    I'm running Vista Enterprise 32-bit SP1 on a Dell Latitude D630 with the latest Windows updates and Dell drivers/firmware.

     

    Thanks for any help you can offer!

    Mobius

    Thursday, June 05, 2008 9:27 PM

Answers

  • Hi,

     

    Please understand that Microsoft provides different support services which have different service levels and support boundaries. Regarding this issue (high CPU), it is necessary to collect related dump file to analyze the root cause. However, debugging service is out of our Forum support boundaries. I’d like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance, the support professionals there are better qualified to assist you.


    To obtain the phone numbers for specific technology request please take a look at the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    Thank you for your understanding.

     

    Wednesday, June 11, 2008 6:59 AM
    Moderator

All replies

  • I have the same problem with svchost and DNS client, but im using Windows XP SP2 with everyupdate.
    Any fix for it?
    Saturday, June 07, 2008 6:15 PM
  • Hi,

     

    Please understand that Microsoft provides different support services which have different service levels and support boundaries. Regarding this issue (high CPU), it is necessary to collect related dump file to analyze the root cause. However, debugging service is out of our Forum support boundaries. I’d like to recommend that you contact Microsoft Customer Support Service (CSS) for assistance, the support professionals there are better qualified to assist you.


    To obtain the phone numbers for specific technology request please take a look at the web site listed below:
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

     

    Thank you for your understanding.

     

    Wednesday, June 11, 2008 6:59 AM
    Moderator
  •  

    Hi,

     

    I have the same problem with the SVCHOST taking High CPU utilization.

     

    Running Vista with alle updates.

     

     

    Wednesday, August 06, 2008 9:56 AM
  • I'm also having the same problem.

     

    The Svchost with DNS Client (Dnscache) is typically taking around 50% of my CPU usage.

     

    Disabling the DNS Client service fixes the problem, but then my web browser says it can't find sites.

     

    I'm running 32bit Vista Business on a Toshiba Tecra. 

     

    Monday, September 01, 2008 6:47 AM
  • Hi all,

    Has anyone found a resolution to this irritating problem?

    I identified this issue with Process Explorer...always consuming between 40-60% CPU utilization when attempts are made at using a browser.

    For comparison, I've got a brand new Dell PC I bought for my Dad sitting on my desk directly next to my main PC. It's browser is very responsive...obviously, same internet connection (DSL, 1.3M down). And, the rest of the performance on my main PC is pretty crisp (apps, files, audio, video, etc.).

    On my main PC, it can take anywhere from 20 seconds to several minutes to load a webpage. It doesn't matter whether I'm using IE, Firefox, Flock, Opera, or Safari. Opera is only slightly faster.

    I run antivirus, antispyware, & firewall software full time...and have for many years. And, I don't visit questionable sites & I scrutinize all firewall connection requests.

    I've even run the complete gauntlet of malware eradication tools from the very thorough CastleCops site. I've manually purged the cache several times. I've done all the about:config tricks for Firefox & Flock...no improvement whatsoever.

    I've even set-up OpenDNS correctly...yet, the 50%+ svchost (dnscache) continues.

    This forum certainly benefits from having some of the smartest people on the planet participating in it. Surely, someone has a resolution for this completely annoying & time-wasting issue.

    Someone? Anyone?

    Best, Maketso

    Windows XP Pro, SP2, current patches, 3GHzP4/2MB RAM/large drives
    Friday, December 12, 2008 8:49 PM
  • I had the same problem on svchost.exe and ProcessExplorer pointed to the DNS Client service. I browsed through some forums and found a solution that worked for me. The hosts file was too big, causing the dns lookups to take a long time. I checked it and it had 264KB and inside I could see that the software "Spybot Search & Destroy" changed it to block several thousand spyware sites. I deleted them all, leaving only the default hosts file and the problem was solved.
    Tuesday, February 03, 2009 6:56 PM
  • The "DNS Client" service (through C:\WINDOWS\system32\svchost.exe) does consume lots of CPU in some cases.

    follow those steps:
    1. open (start->run) "services.msc".
    2. look for "DNS Client".
    3. right click the line. -> select STOP. wait few seconds. right click again and check that it does stopped.
    otherwise you should doing next steps through window's SAFE-MODE (F8 before windows starts up).

    4. write down in "Run" (=start->run) the following line:
    notepad "C:\WINDOWS\system32\drivers\etc\hosts"
                 ^
              space ! between last 'd' and first ' " '

    5. hold CTRL+A to mark all text.
    6. copy following lines (inside the rectangle bellow) and paste those (only) as the HOST file content.

    # Copyright (c) 1993-1999 Microsoft Corp. 
    # 
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. 
    # 
    # This file contains the mappings of IP addresses to host names. Each 
    # entry should be kept on an individual line. The IP address should 
    # be placed in the first column followed by the corresponding host name. 
    # The IP address and the host name should be separated by at least one 
    # space. 
    # 
    # Additionally, comments (such as these) may be inserted on individual 
    # lines or following the machine name denoted by a '#' symbol. 
    # 
    # For example: 
    # 
    #      102.54.94.97     rhino.acme.com          # source server 
    #       38.25.63.10     x.acme.com              # x client host 
     
    127.0.0.1       localhost 
     

    now save the file (File->Save), if you can't save. close the file. browse to
    C:\WINDOWS\system32\drivers\etc\    make sure you have all hidden files visible through folder's option.
    (hidden+system files -> unhide, there are two "checks" to uncheck inside folder's option dialog box).

    right click and
    uncheck the "READ ONLY" check-box. now reopen RUN (start->run) and re-do the last steps (as explained before...)

    7. close down your updated HOSTS file.
    *if you have shutdown to safe mode restart your windows (start->shutdown->restart...)

    8. reopen SERVICES.MSC
    9. make sure your "DNS Client" is set to AUTOMATIC (startup type) and it is currently running,
    otherwise, set to AUTOMATIC startup, and right click again, and click on run.

    10. you've just fixed part #1 of the possible problem.

    part #2 (short one), just for firewall owners, and not the windows firewall kind:
    find out through a tel. call to your I.S.R what's your DNS addresses, (there are two!).
    open your firewall, and add those IP as safe or in some firewalls (as zonealarm 2008/9) those called trusted zone. it is fine to do so, only dns related information would pass through those addresses.


    11. a second restart of windows is recomanded :)

    12. enjoy all your 'new' availabe CPU power (reclaim your CPU...).


    do send eMail for more details & and help considering this to
    EladKarako@gmail.com

    hope that helps..
    EladKarako.



    Elad Karako
    • Proposed as answer by Remi Kaupp Tuesday, June 19, 2012 10:20 PM
    Thursday, March 05, 2009 1:03 PM
  • I have been fighting the hundred percent utilization problem for over two years on my laptop. (My wife has the same model laptop and has never had the problem, but I use more software and more high end software than she does.) I have been to many forums and sites, found many "potential" solutions and tried some. Nothing worked. I was running Vista. I reloaded several times. I have used TaskManager, Process Explorer, EndItAll, etc. Nothing worked. The problem would come and go. Rebooted many times. Shutdown the computer totally and waited for a while. I upgraded to Windows 7, praying that it would fix the problem. No such luck.

    I recently took note of the fact that the bottom of my laptop was very hot. I had vaguely noticed this before but hadn't paid much attention since it seems like it had always been that way. Then I started running experiments. When my computer hit 100% utilization I tipped it up on its side and used a clip on fan to cool it. In less than five minutes the CPU utilization started to drop. I took the fan off of it, put the laptop on a pillow to simulate my lap and watched the CPU utilization. In less than five minutes the CPU utilization started to climb to 100% again. I did five or six variations of this experiment, always with the same result -- the CPU utilization rose with the heat and fell with the cooling.

    I had been chasing what I thought was a software problem but finally determined that it was a hardware problem. I thought it was associated with the WiFi component because it seemed to heat up more when I had heavy network traffic. (I like to know as much about a problem as I can before I call about it.) I had gotten serious about fixing this problem since my extended warranty is running out in June, 2010. So I called Dell, and after the usual checks of this and that (I usually have tried all those things before I ever call), the tech went off to talk to somebody. When he came back he wanted to know if I had a hair dryer (I thought... I've already gone through the heat tests). But what he wanted me to do was blow out the grid covering the fan on the side of the laptop. I told him I could do better than that, I had a air compressor out in the garage that I had just been using and was ready to use. So I took my laptop out and in 10 seconds blew compressed air in all the openings on the laptop. A very small amount of dust came out of the grid and I thought "well, that's not going to fix the problem".

    So I took my laptop back in, started it up, and everything was fine. (Actually he had called me in response to my previous call that had not solved the problem and when he called I was sitting there with 100% utilization on my laptop). The tech said he would call back in about half an hour to see how things were going. When he called back it was still running coolly and at very low CPU utilization.

    I was a happy camper and still am. NO MORE 100% UTILIZATION. It has been several weeks since this fixed it and I have never had the problem since. Get those fans and air compressors out if you have this problem. It's a simple fix if it works. Don't live with it for two years like I did.

    Wednesday, April 28, 2010 1:40 AM
  • Hello Elad,

    This seems to have worked for me, thank you very much. Indeed the DNS client was struggling with a really big HOSTS file, which had been hyper-inflated by Spybot. 

    Thanks,

    Rémi


    Rémi

    Tuesday, June 19, 2012 10:35 PM
  • i cannot open my test SharePoint farm this morning, on DB server, i find that IP address is 169.254.80.146, not my normal DHCP address.  And IPConfig /renew just hang. I noticed High CPU with resource monitor:

    The DNS client service bring me to this thread, however, Process Explorer tells me that WinRM service is the culprit:

    I cannot image that both tools are correct.

    The same situation i encountered last time: http://social.technet.microsoft.com/Forums/windows/en-US/9fbd5b1d-a2a3-48ce-9232-7542a40b937c/service-host-svchostexe-using-99-cpu

    Since this is just a test environmet i shared administrator password with a lot of users, i cannot help thinking that some guy is joking with me with windows remote management (i am not familiar with this service).

    But the inconsistency between these tools seems real to me.

    Friday, July 26, 2013 3:12 AM
  • You da man, Elad!  Got rid of my bloated (591 kB) HOSTS file and immediately the Dnscache CPU utilization dropped to and stayed at essentially zero.

    Thanks!

    Win7 Home, fwiw, but probably would be same for any Windoze.


    • Edited by tqmbill Sunday, February 02, 2014 12:52 PM added detail
    Sunday, February 02, 2014 12:48 PM
  • Thank U thank U very much!!

    I have done everything to fix this thing. I have run several malware programs and spend hours reading google and trying several ways to fix this. And now I found U! Thank U. Computer works fine now!!

    Monday, September 29, 2014 7:17 PM
  • Five years after the answer above, I've spent several hours looking for solutions (now on Win7 x32) and got many leads about malware and services.msc and so forth, anyway this is it.
    Surprisingly, I haven't used Spybot since I last cleared the file (mostly I'm using Kingsoft anti-virus) so I don't know who is writing into that file.
    (I think I had the problem about half a year ago, and I fixed it the same way, but I'd forgotten this very simple solution. Alas, there is no such simple solution for wetware.)
    5 hours 15 minutes ago