Problem Solution: Windows XP, svchost.exe using 99% CPU, very slow system

[Denzil_DC]

Last edited Thu Dec 12, 2013, 10:27 AM - Edit history (5)

We encountered this problem the other day and the solution isn't obvious without some Googling, so I'm posting it here.

Symptoms: Your computer is running very slowly and networking may also be running at a snail's pace.

Confirmation: Hit Ctrl-Alt-Del to start up Task Manager. In the Processes tab, check out the CPU activity for svchost.exe. If it's running high, possibly even peaking or consistently at 99%, then you probably have this problem.

Solution: If you're running a version of Internet Explorer earlier than 8, update it, then apply security update KB2870699. (Even if you never use Internet Explorer as a browser, it's an integral part of Windows XP.)

How to do it: Since your computer is running so slowly, you're best to do this in Safe Mode with Networking, where your computer should run fairly normally.

To do this, reboot and keep hitting F6 until you see a screen that offers a range of boot options. Select Safe Mode with Networking.

Using either Internet Explorer or your usual browser, download IE 8 and install it. You can find it here:

http://www.microsoft.com/en-us/download/internet-explorer-8-details.aspx

or more directly from

http://windows.microsoft.com/en-us/internet-explorer/downloads/ie-8

After installation, your computer will ask to reboot. Let it do so.

You'll now be back in your usual Windows configuration. If your system's still running slowly, you may need to reboot into Safe Mode with Networking again to do the following.

Download and install Cumulative Security Update for Internet Explorer 8 for Windows XP (KB2870699) from http://www.microsoft.com/en-us/download/details.aspx?id=40119

Reboot again. By now your computer should be running more normally.

After you've done that, visit http://update.microsoft.com/microsoftupdate/ and let it identify any other updates needed by your computer and install them. If your computer's running relatively normally by now, you don't need to do this in Safe Mode with Networking.

This resolved the 99% usage problem on one of our laptops which was originally still running IE 6. It also sped up another laptop which already had IE 8 installed but not the security update, and which was running less quickly than normal and showing intermittent 40% or so svchost.exe CPU activity even when at rest.

There may be other reasons why your computer might be running slowly, so you need to confirm that svchost.exe over-activity is the problem before applying this solution.


Afterthought: svchost.exe over-activity has been a recurrent problem with Windows XP for some years, usually tied to Windows Automatic Updates or sometimes installation of proprietary software (e.g. from Hewlett Packard) that uses an updater.

One simple solution doing the rounds is to disable Windows Automatic Updates, but that can lead to its own problems over time.

Other solutions require more tinkering under Windows XP's hood. At the time of writing, this particular instance of the svchost.exe problem does seem tied to IE and its security update, which is why I've offered this solution here rather than trying to address other possible causes and solutions that may apply now or later. It uses normal Windows processes and doesn't involve any great technical knowledge, so it's unlikely to do any harm, and it's worth trying it first before doing any more instrusive troubleshooting, as at least you'll have eliminated one possible cause.

[hobbit709]

1. Before you do any of that, run full security scans.

none of those patches will do any good if the cause is some kind of virus or malware.

[Denzil_DC]

2. Good point.

Unfortunately, the first laptop I was referring to was running so slowly that it would have been impossible to do a normal security scan! Depending on the AV software you're using, it should be possible to run a scan in Safe Mode.

[hobbit709]

3. Had a couple brought in recently with about 20 instances of svchost running

both computer had that damn Sweet Packs installed. what a pain to remove everything it buries itself into.
One of them had a trojan that made a hidden virtual drive that Windows wouldn't let you see. Once I figured out what was going on, I booted with a Linux Live disk-which lets you see everything on the hard drive and removed all traces. Many, many bad words were involved.

[truedelphi]

4. Very decent information -

I'm just thanking you to show appreciation and as a way to bookmark for when this could be happening to me.

[Denzil_DC]

5. You're welcome. I figure that if Microsoft does go ahead and withdraw Windows XP support,

holdouts like me who have no pressing reason to update to a newer OS (and whose otherwise perfectly sound hardware may not be fit to run a newer OS) are increasingly going to have to rely on each other for tech support for any problems down the line, not least those Microsoft bequeaths to us. That's why I particularly appreciate input like hobbit709's recent post about the Windows replacement disk.

Funnily enough, if they do go ahead and stop issuing XP updates, that'll remove one source of these svchost.exe overload problems, as they're often linked to a specific Windows updates and the Windows Automatic Updates process!

[truedelphi]

6. My goal in early 2014 is to have

My computers up and running in Linux, and then to hell with MicroSoft.

But perhaps there will be ways for people to help support each other and the XP platform. The internet can sure allow for us to keep the information flowing freely.