none
windows8: svchost high cpu usage

    Question

  • Hi,

    I have a fresh installation of Windows 8 Pro on my Thinkpad T410s.

    Everything runs smooth except sometimes two service processes taking up all of the cpu. Both are svchost instances. Reboot somtimes helps for a while, but usuallly the two process will come up again and make working with the system impossible.

    I have created a trace under:

    https://dl.dropbox.com/u/37418838/20130108_HighCPUUsage.7z

    Could anyone please help to identify the cause?

    Thanks and best regards,

    Johannes

    Tuesday, January 08, 2013 9:42 AM

Answers

  • Hi Johannes,

    the first svchost.exe causes the high CPU usage because of the DHCP client service which tries to renew the settings:

    So check if your DHCP server can be reached.

    the second svchost.exe causes the high CPU usage because of the Windows Firewall (mpssvc.dll!FwCachedStoreEnumBlobs) and string compares: Kernelbase.dll!lstrcmpiW

    Do you have a large amount of entries in the ingoing and outgoing configuration?


    "A programmer is just a tool which converts caffeine into code"


    Tuesday, January 08, 2013 2:01 PM
  • Think I have found the cause.

    After looking a bit deeper into the eventlog I found some warnings from the DHCP client for one interface.

    This was my VPN interface. Although it got an IP address, the DHCP client tried to determine an IPv6 address as well, which is currently not supported by this VPN.

    So I just disabled the IPv6-Protocol on that interface, which was activated by default.

    Wednesday, January 09, 2013 8:02 AM

All replies

  • Hi Johannes,

    the first svchost.exe causes the high CPU usage because of the DHCP client service which tries to renew the settings:

    So check if your DHCP server can be reached.

    the second svchost.exe causes the high CPU usage because of the Windows Firewall (mpssvc.dll!FwCachedStoreEnumBlobs) and string compares: Kernelbase.dll!lstrcmpiW

    Do you have a large amount of entries in the ingoing and outgoing configuration?


    "A programmer is just a tool which converts caffeine into code"


    Tuesday, January 08, 2013 2:01 PM
  • Hi Andre,

    thanks for your quick response.

    My DHCP service on the local network works fine. Though I have a VPN client running with another interface. The DHCP should also work in this one, as it gets assigned an IP adress. Is it somehow possible to find out on which network interface the DHCP client is trying to update the adress?

    For the firewall I have not adjusted any settings. It is just using the default configuration as done by the windows installation. Though looking into the extended settings there are quite a few active rules that windows semms to have created automatically. There are about 100 active and another 100 incative entries for outgoing and incoming each. I am not sure how they have been created.

    Regards,

    Johannes


    Tuesday, January 08, 2013 3:43 PM
  • I have no idea how to see which network interface is the cause. Try it out and assigned a fixed IP to one of them and test.


    "A programmer is just a tool which converts caffeine into code"

    Tuesday, January 08, 2013 7:54 PM
  • Think I have found the cause.

    After looking a bit deeper into the eventlog I found some warnings from the DHCP client for one interface.

    This was my VPN interface. Although it got an IP address, the DHCP client tried to determine an IPv6 address as well, which is currently not supported by this VPN.

    So I just disabled the IPv6-Protocol on that interface, which was activated by default.

    Wednesday, January 09, 2013 8:02 AM
  • I wanted to chime in as I had the same issue today with my new ThinkPad Yoga (64 bit Win8).  The culprit under svchost.exe was Bluetooth.  I stopped that process and presto, problem solved.  If it happens again after my next reboot, I will have to think of something more permanent as a solution.
    Wednesday, April 23, 2014 3:18 AM