locked
svchost.exe netsvcs strangles startup performance RRS feed

  • Question

  • Toshiba Tecra with i7 and 16GB RAM. Approximately one minute after cold start and login, system becomes almost totally unresponsive because of disk activity taken by svchost.exe netsvcs as shown by Task Manager / Resource Monitor. This continues for as much as 15 minutes. Removed Norton and substituted Windows Defender, no help. What can be done to reduce the stranglehold that svchost.exe netsvcs has on the system? It is INTOLERABLE.
    Thursday, July 23, 2015 10:34 AM

Answers

  • Hi,

    To troubleshoot whether this issue is caused by the third party services.

    We could perform a clean boot to have a troubleshoot.
    How to perform a clean boot in Windows
    https://support.microsoft.com/en-us/kb/929135

    To troubleshoot this issue deeply, we could refer to the link as ZigZag posted to capture the startup process.

    If we suspect the issue is caused by the updates, we could check the update history for any failed updates. We could perform a system restore to recover the machine to a previous normal point. Then install the update one by one to have a troubleshoot if it is possible.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.



    Friday, July 24, 2015 7:48 AM

All replies

  • In order to diagnose your problem we need to run Windows performance toolkit the instructions for which can be found in this wiki


    If you have any questions feel free to ask

    Please run the trace when you are experiencing the problem

    Since this is a boot issue use the boot configuration


    Wanikiya and Dyami--Team Zigzag

    Thursday, July 23, 2015 10:41 AM
  • Will do. Will advise when log file has been uploaded. Thanks.
    Thursday, July 23, 2015 10:49 AM
  • I have a similar problem. I am running Windows 7 Professional on a DELL Vostro 3560 laptop, 8GB RAM, i7-3632QM 2.20 GHz 64 Bits.

    Everything was working fine until a Windows system update, which I cannot identify, has been installed.

    The startup hangs on different points and the disk seems to be in a high activity, its indicator led do not even blink.

    I do not know how to determine which is the responsible software for the disk access.

    I ought to hard shutdown the computer several times to provoke the initialization correction to start, which generally solves the problem.

    Is there something I can do ? I am avoiding a Windows reinstallation because I had a lot of work to configure this computer to my use, and it will be very hard to do it again.


    Jayme Jeffman

    Thursday, July 23, 2015 1:24 PM
  • As soon as possible after login, start Task Manager, click Performance tab, click Resource Monitor button, see Resource Monitor start, click Disk tab, see two horizontal panes, top showing processes using the disk, bottom showing file activity. If you have the same problem as I do, you'll see the svchost.exe netsvcs process as the culprit. I have yet to acquire the log file as requested above. Of course, since doing ANYTHING while the problem is occurring is almost impossible, acquiring the log file may prove difficult.
    Thursday, July 23, 2015 2:54 PM
  • Hi,

    To troubleshoot whether this issue is caused by the third party services.

    We could perform a clean boot to have a troubleshoot.
    How to perform a clean boot in Windows
    https://support.microsoft.com/en-us/kb/929135

    To troubleshoot this issue deeply, we could refer to the link as ZigZag posted to capture the startup process.

    If we suspect the issue is caused by the updates, we could check the update history for any failed updates. We could perform a system restore to recover the machine to a previous normal point. Then install the update one by one to have a troubleshoot if it is possible.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.



    Friday, July 24, 2015 7:48 AM
  • Have uploaded zip to onedrive and shared with tnmff@microsoft.com. Please confirm receipt.
    Sunday, August 9, 2015 10:09 PM
  • Hi Frank,

    If it is possible, please share the link here, too. It would attract other volunteer experts in this forum to help analyze the issue.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, August 10, 2015 1:08 AM
  • Don't know how to do that. I see my OneDrive screen, somewhat like Windows Explorer. I can "share" a file, but I don't see any way to extract the path to a file. How is that done?
    Monday, August 10, 2015 1:22 AM
  • Hi Frank,

    Please refer to the following link to get a share link from OneDrive

    Share files and folders and change permissions

    https://support.office.com/en-us/article/Share-files-and-folders-and-change-permissions-9fcc2f7d-de0c-4cec-93b0-a82024800c07?ui=en-US&rs=en-US&ad=US

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, August 10, 2015 3:04 AM
  • https://onedrive.live.com/redir?resid=B266E90FD15FD8AB!172&authkey=!AAsXGUtEt6o7JMo&ithint=file%2czip

    Above is link to files on OneDrive.

    Tuesday, August 11, 2015 2:30 AM
  • Hi Frank,

    Have you referred to the link as ZigZag posted to collect the information?

    According to the etl file, it is a little weired. Most of the time the disk is occupied by an "Unknown" process. To ensure the safety, please perform a full scan with an antivirus software in safe mode.

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, August 12, 2015 5:28 AM
  • Hi MeipoXu,

    Yes, I followed ZigZag's post step for step.

    Whenever I have observed this problem, Task Manager / Resource Manager has always indicated svchost.exe [netsvcs] as the culprit, not an "unknown" process.

    Will rerun and repost.

    Thanks for your time.

    Tuesday, August 18, 2015 10:11 AM
  • 99% of the time this will be malware or a virus on the machine in question.

    What were the results of the full virus scan?

    As soon as the system starts up could you right click the process (svchost.exe) in task manager and "go to service" list all highlighted services. Could you also do a "Go to process" and list exactly what the process name is, what its location is and the filesize \ version of the file? I would also display "command line" in task manager, could you then list the top 10 processes running on the system as shown below.

    I personally have no real way of anylising the etl files, im attempting to use netmon but its very painful. I would personally prefer to work with a full crashdump of the system or at least a crashdump of the process.


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember, if you see a post that helped you please click "Vote as Helpful", and if it answered your question, please click "Mark as Answer". I do not work for Microsoft, I manage a large estate in the public sector, my views are generally first hand production experiences.

    Tuesday, August 18, 2015 10:43 AM