Svchost exe is not working. What to do if Svchost is using a lot of CPU? Reasons why svchost exe loads the processor

No introduction, straight to the point. The computer or laptop was working perfectly and, suddenly, the image on the screen and the cursor began to twitch. This usually happens when the central processor and RAM are loaded to the limit of their capabilities (up to 100%).

This situation may occur if one or more processes, services or programs consume a lot of laptop or PC resources. Svchost loads the system (processor and memory) due to errors and shortcomings in the program itself, problems in Windows OS or insufficient computer resources (weak processor, low RAM, etc.). How to remove svchost?

To understand which processes are causing the system to run slowly, you need to go to the Windows “Task Manager” (Ctrl+Alt+Del) and open the “Performance” tab. For detailed information, click on the “Open Resource Monitor” link.

What processes most often load and greatly slow down the operation of a laptop and computer:

• Svchost.exe (netsvcs, LocalServiceAndNoImpersonation) - problems with installing drivers on some devices. The Svchost.exe process is used during the operation of some network services (belongs to the networkservice type). The most powerful impact on the performance of a computer or laptop is the activity of Windows Update;
• Svchost.exe (netsvcs, LocalSystemNetworkRestricted) - problems with the Superfetch service and Windows Update. Superfetch, what is this service? Superfetch is used to speed up access to frequently used files, folders and programs through advanced caching. In some cases and with certain configurations of a computer or laptop, the service can either speed up work or greatly slow it down. Using Superfetch for SSD+fast RAM over 4GB=doesn't make sense. Whether or not to disable Superfetch and Prefetch is up to you;
• MsMpEng.exe - Antimalware Service Executable, Microsoft Security Essentials, executable file of the built-in antivirus program (firewall) in Windows 10. Another name for Windows Defender or Windows Defender.

Popular questions about the Svchost.exe program.

1. Svchost.exe - what is this process? This is a standard host process for Windows 10 services (7, 8, etc.).
2. Why are there many processes running with the same name svchost.exe, is this normal? Because many Windows services and components use this process in their work. These are mainly network services and various computer or laptop devices. Don't be afraid, this is not a virus, but a normal Windows system process.
3. Why does svchost.exe netsvcs (localserviceandnoimpersonation, localsystemnetworkrestricted) waste memory and CPU? This process can put a lot of stress on the system during peak times, such as when checking, downloading Windows updates from the Internet, and installing them. Congestion may also be caused by driver installation or malfunctioning devices and components. If resource-intensive programs are running at this moment, try closing them and wait a little. If the problem is not solved even by rebooting, then you need to take action.

If the processor or RAM is not heavily loaded, but the computer still freezes a lot, the problem may be in the hard drive. Old HDDs can greatly slow down the operation and performance of the entire system as a whole. Check the disk for errors and try to copy something from one folder to another; if the process takes a long time, the hard drive needs to be replaced.

How to disable services and processes that use memory and CPU:

1. How to disable svchost.exe (netsvcs). To disable the Windows Update service, you need to launch the Task Manager by pressing Ctrl+Alt+Del. Select the “Services” tab and click “Open Services” at the bottom. Find the "Windows Update" service, right-click - "Stop". Then right-click on the service again and select “Properties”. In the startup type, select “Disabled” from the drop-down list and click “OK.”
2. How to completely disable, remove Windows Defender 10, 7 (MsMpEng.exe) permanently. It is highly not advisable to remove Windows 10 Defender. It is necessary to at least somehow protect the system from viruses, if no other anti-virus software is installed. When installing any other antivirus (ESET Nod32, Kaspersky, DrWeb, Avast, etc.), Windows 10 Defender and the standard firewall are automatically disabled. To disable the Defender service manually, you will need to edit the registry. Disabling Windows Defender is only required in extreme cases; usually the problem is resolved without this.
3. How to disable Superfetch Windows 10. It turns off in the same way as svchost.exe (netsvcs), only we look for “Superfetch” among the service names.
4. How to disable Prefetch. If you are going to disable the sysmain superfetch service in Windows 10, it makes sense to disable the Prefetch service along with it. Both of these services were created to speed up programs and improve performance on slower computers. Superfetch and Prefetch show good results for slow hard drives with low read/write speeds. On more or less modern laptops and PCs with SSD and DDR4, you can safely disable them. It is better not to touch the Prefetch folder itself in the Windows directory. Disable only the service itself in the registry.

If you have to choose between installing Windows 10 Defender or an antivirus, choose a good antivirus package. Windows Defender (msmpeng.exe) or Antimalware Service Executable is a temporary measure to combat viruses and is not effective enough to prevent serious cyber threats. The msmpeng.exe process in some cases heavily loads the processor and memory.

If none of the above helps, I highly recommend checking out these 3 threads on the Microsoft technical support forum:

• Here is a detailed description of the solution to the issue from LocalSystemNetworkRestricted -
• Here about Windows 10 Defender (MsMpEng.exe), what to do if it loads the processor and memory -
• Once again about possible problems with svchost.exe (netsvcs) -

These are some simple ways to deal with slowdowns on your laptop and PC. I'm waiting for questions in the comments. Good luck and good luck! 😉

The first step is to try disabling applications one by one. Indeed, a low-power device can easily be overloaded by simultaneously running several heavy-duty applications.

Second. Often the cause of problems is prolonged active surfing on the Internet. The system is littered with hundreds of megabytes of temporary files. The registry is confused. There are two options here.
1. Run the cleaner and remove all unnecessary files, repair the registry and perform basic defragmentation.
2. Didn't help? Then open System Restore and roll back to an earlier state. It is almost never possible to restore normal performance in one go. Usually no more than three restorations are sufficient.

And don't forget to create rollback points. Does the computer fly? Go to Recovery and create a return point. It will come in handy.

The next assumption is that an evil virus has entered the computer. If possible, run a scan. You need to be patient, drink some tea, take a nap. In such a relaxed state of the system, scanning will take a long time.

Another classic cause of system overload is the svchost.exe process.

What is this and why does it interfere with the operation of the computer? The svchost.exe process is one of the auxiliary system services involved in many other tasks. The thing is useful, but sometimes it's buggy. What can disrupt this process?
1. Physical damage to memory chips. A lot of dust has accumulated in the system unit. Service centers recommend vacuuming the inside of your computer at least once a year.
2. Errors when downloading automatic updates. For example, during the update process there were interruptions in the Internet connection or power outages. Facts have been noted where the update packages themselves were initially delivered with bugs. Even Microsoft experts themselves admitted this.

In cases where problems are caused by bad updates, it is recommended to go to the official Microsoft website and download a proven and reliable package, then install it yourself.

Viruses are often disguised as svchost.exe processes.

It is very convenient for hackers to present a virus or Trojan under the guise of the svchost.exe process. The system will issue a notification about an unknown error and the user will still be able to figure out the reasons. First you need to find out if the svchost.exe process is at fault? To do this, open the Windows Task Manager (Alt+Ctrl+Del) and go to the Processes tab.

There will be at least four svchost.exe processes. Now look at the load level for each process. If some svchost.exe process has a load close to 100%, this is the culprit of the problems. What's next?
1. To begin with, it is always recommended to reboot the system. Most often the problems disappear.
2. If everything happens again, open the Task Manager again and end the overloaded svchost.exe process. To do this, open the context menu (right mouse button) and click End Process Tree. Restart your computer again.
3. Didn't help? Now the surgical method. Open Windows Explorer. Find the Windows folder. Select the folder C:\WINDOWS\Prefetch. Delete this folder. Then open Task Manager again and end the tree of the overloaded process svchost.exe again. Restart the computer.

Basically, if the problem was actually a random crash of the svchost.exe process, everything should be fine. If the problems continue, the cause should be looked for somewhere else. It may actually be a viral infection. Then you need to take a closer look at all the processes and try to identify the disguised virus.

Signs of a virus disguised as the svchost.exe process

Normal svchost.exe processes run under the username:
- SYSTEM LOCAL SERVICE
- NETWORK SERVICE

Or something like that. Viruses hide under the ADMIN username or whatever you are logged into the Windows user account.

If a misdirected Cossack is detected, complete its tree and thoroughly clean the system with antivirus. Don't be afraid if you accidentally kill the normal svchost.exe process. Smart Windows will simply reboot automatically.

Be sure to install a decent antivirus package if you use the Internet. Especially if you like to explore new sites, experiment with programs and other eighteen-plus entertainment. Download the healing utility Dr. Web CureIt. Copy it to a flash drive and store it for a rainy day. This program does not require installation and is capable of finding and neutralizing viruses on already affected systems.

For the rainiest day, keep a Windows distribution kit and make timely backups of important documents.

In today's article we will talk about the problem when Svchost.exe loads the processor on

There is probably no Windows user who has never encountered a phenomenon where this process loads the PC processor to a critical level of 100%.

We will try to help and give several ways to solve this problem.

Svchost virus or system process?

Svchost.exe is a process used for services that are loaded from dynamic link libraries (.DLLs).

This operation is used in the MS Windows family starting with Windows 2000 and ending with the latest version of Windows 10.

In order to reduce the cost of CPU time and RAM, the developers decided to use a single process to run several services.

We will talk about the disadvantages of this solution below.

Note! Virus and Trojan developers use the name of this operation to disguise their malicious applications. This can be easily explained by the fact that the process named svchost.exe launches many libraries, therefore, when launching the task manager in order to identify a malicious program, the user will see many processes with the same name - svchost.exe.

Since a quick analysis reveals that the svchost.exe process is a system one, i.e. one that is initialized by the operating system and its termination can affect the stability of its operation, many switch to searching for the virus elsewhere.

Important! It should be remembered that the svchost.exe system process can never be launched as a user, but only as LOCAL or NETWORK SERVICE, SYSTEM. We also draw your attention to the fact that this operation is launched only through the system services mechanism. If the svchost.exe process is initialized from the Run section of the registry, you are dealing with a virus.

Ways to solve the problem with svchost.exe

Method number 1. To restart a computer. In some cases, restarting the computer can lead to the desired result, which is why we have placed this method for solving the problem with processor load at the beginning.

Method number 2. Checking virus activity. This check can be performed independently or using an antivirus.

Self-scan is usually faster, but less accurate compared to antivirus scanning.

Advice! Manual checking begins with the fact that we need to go to the “Task Manager”; this can be done by pressing the key combination Ctrl + Alt + Del.

Go to the “Processes” tab.

Here, for ease of perception, you can sort processes depending on the load on the processor (or consumed memory); to do this, in the “Task Manager” window, click on the column header called “CPU” (or “Memory”, respectively).

As a result, the most resource-intensive processes will be at the top of the column, in our case it is svchost.exe, and although the processor load is minimal, this operation consumes almost 167 and 132 MB of memory.

In our case, everything is fine - the process is launched from SYSTEM (system) and LOCAL and NETWORK SERVICE.

If the process is launched from any other user in front of you, there is a high probability that it is a virus, and at this stage it is necessary to scan the computer with an antivirus.
In order to figure out which service is running with a particular svchost.exe process, you need to right-click on the process and select “Go to services”.

In this window we can see more detailed information about which services use the svchost.exe we have selected. Services are highlighted in blue and have the same process ID.

Further, by alternately disabling one or another service, you can understand the cause of this problem.

The most common services whose operation leads to increased consumption of system resources by the svchost.exe process are “IP Auxiliary Service” and “Windows Automatic Update Service”.

You can disable these services and check the result, but you should pay attention to the fact that as a result, the operating system will not automatically receive updates.

This problem can be solved by running the update manually.

"IP Auxiliary Service" This service is used for highly specialized tasks, providing the ability to tunnel for version 6 of the IP protocol.

For most users, disabling it will have absolutely no effect on the operation of the system.

Checking virus activity using an already installed antivirus in some cases does not give the required result. In some cases, the virus can infect the antivirus itself.

To achieve the best scanning results, we recommend downloading a free version of an antivirus that does not require installation (for example, DrWeb Cureit, Kaspersky Security Scan, Kaspersky Virus Removal Tool).

Copy it to a USB flash drive and run it for testing, after booting into safe mode.

Method number 3. Check for Windows updates and, if available, install them.

Method number 4. Perform a system restore from a restore point. You can learn how to do this from our previous article.

Method number 5. Delete the contents of the Prefetch folder. This folder is used to speed up the loading of the operating system (and the launch of programs) by saving the values ​​​​of previous downloads.

Typically, the Prefetch directory is one of the subdirectories of the system directory.

svchost .exe is loading the system! (100% solution)

Svchost.exe loads the processor on Windows 7. 5 ways to solve the problem

Below is a list of the most common reasons why svchost.exe creates CPU load. First, we will look at what the point of this process is in general, and then we will look at methods for solving the problem in specific cases.

What is svchost and can it be removed?

This process is one of the main ones in Windows. It helps programs installed on your computer run and is designed to reduce their resource consumption. You cannot delete this file from the system (this does not apply to viruses masquerading as it, but more about them below).

If there are many programs, then the number of running processes with this name can be increased to the required number. Therefore, if there are several svchost.exe in the Task Manager, this is normal and not yet a reason to worry.

Possible causes of CPU load

Viruses

The first thing to do when faced with a CPU usage problem is to find out if malware is behind it.

A clear sign of such a threat:

Open Task Manager and check under whose name all svchost.exe are running (to make it easier to see, sort the display of processes by name).

The screenshot shows 3 groups on behalf of which a real, safe process is launched:

• System
• Local Service
• Network Service

If you see that it was launched under your account, you are dealing with a malicious program. In this case, the first thing to do is right-click on it and select “Open file location.”

This way you will know where it is. Now this file can be submitted for scanning via virustotal.com to obtain detailed information about the type of threat.

But the easiest way is to immediately use two programs to clean the system:

• Dr.Web Cure IT (on the page, first click “Next”, and then “Download with the function of sending statistics”)

Because deleting just .exe is not enough: there are almost certainly auxiliary files scattered somewhere on the disk that will either simply prevent it from being destroyed or will be restored after a reboot.

The scanning speed depends on the size of the hard drive. But in the case of CureIT, it is quite possible to specify for scanning only the system partition on which Windows is installed, because almost always all pests try to “register” there. It would be enough.

In MBAM, you can simply click on “Start verification”, because... Scanning the entire system takes 15-20 minutes on average.

Based on the results of the scan, a report will be issued with a list of files that the program considers dangerous. MBAM will delete some elements (registry entries) immediately, but for others it may ask you to reboot the system.

CureIT digs deeper, but sometimes misses points that MBAM cleans up.

After downloading and installing the utility from Dr.Web, you can let it scan anything you want by simply clicking on “Start scanning”.

To be more confident that nothing will escape, you can specify, in addition to the main places to check, the entire disk on which Windows is located.

Automatic updates

By default, Windows has system updates enabled, which is often the cause of the load created by svchost.exe.

Press the Win+R key combination and enter “services.msc” in the window that opens.

In Windows XP/Vista/7 you can start it like this: Start -> Run (XP) / Search (Vista/7) -> services.msc

In the list of services, find Windows Update, double-click with the left mouse button and set the parameters as in the screenshot below.

In XP, the line you need is called "Automatic Updates"

As you can see, this service uses svchost.

conclusions

Practice shows that most often, in addition to malicious applications, the problem lies in simple system updates. The remaining cases can be called “special”, because In almost every one of them, everything is “tied” to a specific application. For this reason, it is impossible to describe all cases, but searching for problematic programs using Process Explorer can help.

There are many different processes and mysterious files in the Task Manager that constantly consume some computer resources, turn on, turn off and live their active digital life. Among them, users find the so-called Host process for services Windows, aka svhost.exe. This article will tell you what this process is for.

What is the process svchost.exe

The host process for Windows services is a system process of the operating system. Windows services and services that are launched from executable files are registered in the task manager as full-fledged separate processes with their own names and graphs of memory, processor, disk and network consumption. Those services that are loaded from dynamically linked libraries (also known as DLL - Dynamic Linked Library) cannot be “registered” as a full-fledged process. Instead, the system registers them as a process known as the Windows Services Host Process or svchost.exe. These services include network connection managers, plug-and-play service, update center, security mechanisms, and so on.

Another feature is that for each service based on dynamic link libraries, the system creates a separate host process. This is why you may see multiple svchost.exes in the Task Manager. To see how many svhost.exe you have running, and go to the tab Details. Often there are several working in a system dozens host processes for Windows services. This is the norm.

Host processes. Thousands of them.

Unfortunately, Task Manager does not allow you to see exactly how many services or groups are associated with each host process. If you're really interested in finding out which libraries are attached to your computer's host processes, you'll need a small utility called Process Explorer, developed by Microsoft. It's "portable" so you won't need any installation. Just download it and unpack it to the desired location. Run the file processxp64 if you have a 64-bit version of Windows or processxp, if 32-bit. On the list Process find svchost.exe– these are the same host processes for Windows services. Hovering over one of them displays a list of services associated with a particular process. For example, Local Session Manager, HID Device Access, Local Event Log, User Profile Service, and so on. There are many different services that are vital to the operation of Windows.

svchost.exe loads the processor

You may notice that immediately after you turn on your computer, all Windows services host processes are putting more strain on your computer, especially the CPU. This is also the norm, right? must be. After some time (not very long) everything will calm down and the load will drop. Why is this happening? When Windows starts, the host process scans all service and registry entries and also compiles a list of DLL services required to start. These services are then loaded, which increases CPU consumption.

Other factors also influence the increase in CPU load by the svchost.exe process. For example, the system performs indexing, downloads an update, or performs another background task that is required to maintain the system. Of course, there are emergency situations when one of the system services does not work correctly, which leads to a load on the processor and slows down the speed of the computer. There can be a large number of reasons for this. For example, corrupted system files, a problematic driver, service failure, hard drive failure, or malware.

Often the main cause of abnormal CPU load is a failure in one or more services. You can diagnose such a failure in the same Process Explorer utility. Find the process in it that consumes the most resources and hover your mouse cursor. A list of connected services or services will appear in a tooltip window. Try turning them off and observe the result. Having discovered a problem area, act according to the instructions to solve problems in the operation of the service.

Warning: System services should not be blindly disabled. Make sure you know what you're doing and are confident in your ability to get it back. Blind manipulation of the system may damage its operation.

Is svchost.exe a virus or not?

We have already clarified that the svchost.exe process or the Host process for Windows services is a standard system mechanism, which, in principle, cannot be a virus on a normally operating computer. However, there are times when malware or virus pretends to be svchost.exe.

Pay attention to the location of the file. In the task manager on the tab More details right click on one of the svchost.exe and select File location. Its main location is a folder C:\Windows\System32 or SysWOW64 . A file with the same name can also be found in directories Prefetch, WinSxS And ServicePackFiles, you will never get from Task Manager to these folders if svchost.exe works normally.

If you suspect the presence of malware and detect anomalies in the location of svchost.exe, you will need to turn to the services of your antivirus, which is quite obvious. This guide will only help you understand why the svchost.exe process is increasing the load on your computer.