svchost.exe High CPU usage 98% of at least one CPU.

I have had that message a couple of times whilst on the Forum. Haven't noticed it when I am doing anything else.
Here's the info I get when I click on more details;

Filename: svchost.exe
Full Path: c:\windows\system32\svchost.exe

____________________________

____________________________


Developers
Microsoft Corporation

Version
6.1.7600.16385

Identified
21/11/2014 at 18:32:15

Last Used
14/07/2016 at 09:14:42

Startup Item
No


____________________________


Many Users
Millions of users in the Norton Community have used this file.

Mature
This file was released 6 years 11 months ago.

Trusted
Norton has given this file a trusted rating.


____________________________


Source File:
svchost.exe

____________________________

Performance

____________________________

Avg. Resource Usage: Low
Avg. CPU Usage: Low
Avg. Memory Usage: Low
____________________________

Performance Alert

Process ID
444

CPU
98% of at least one CPU.

Memory
Normal

Handles Count
Normal

Disk Read Activity
Normal

Disk Write Activity
Normal
____________________________

File Thumbprint - SHA:
93b2ed4004ed5f7f3039dd7ecbd22c7e4e24b6373b4d9ef8d6e45a179b13a5e8
File Thumbprint - MD5:
c78655bc80301d76ed4fef1c1ea40a7d

Here's a screenshot of Process Explorer which I think indentifies the problem. I'm just not sure what to do to rectify this.



Any help much appreciated.
P.S. I have Malwarebytes Pro installed and running, I have also done a complete scn just to be safe!

Get the PID of the problematic svchost.exe process (586 in your screenshot

Run Task Manger and right click on the matching svchost process and choose "Go to service"

Let us know which services are running under it.

If Windows Update shows up it's likely to be the culprit. You can confirm by stopping Windows Update Service via Start> Run> services.msc

Stop then set startup type to disabled and reboot to test.

Also worth a mention:

Grab copies if these and run them:

Svchost Process Analyzer

svchost viewer

The first one helps you check for anything out of the ordinary (malware running under svchost.exe) or unusual services configuration.

The second one just breaks down each svchost.exe process into it's component services.

Windows Update problem (if suspect can also be confirmed using RAMMap:

Windows 7 updates

How to remove Windows 10 upgrade updates in Windows 7 and 8

Note: RAMMap must be run when the problem is actually happening.

Thanks for the response. Getting a bit late now so will get to it tomorrow. Jusy one point there isn't a PID 586 in my screenshot. Did you perhaps mean "356"?
EDIT: Had a quick look using Process Explorer and there is a Windows Update process in there . Will look again tomorrow as it is not showing high at the moment

Yes, sorry. I meant svchost.exe PID 586 PID 356 in your screenshot. The process might use a different PID next boot.

svchost is how windows groups running services together and assuming that you do not have an unsigned malware process disguising itself as svchost.exe - the problem is likely to be with one of those services.

I think I 'm getting to the nub of the problem. The PID 356 does contain an "update service. Have run RamMap and here's a screenshot of the result after clicking "Active" tab


What's my next step?

Well that confirms that you've got the windows update high svchost.exe RAM usage problem. Solving the problem might not br straightforward. Many users report that installing some version of WU Client solves the issue.

If you could possibly take a look at which Windows Update clients are installed it would help. Then for the last couple of months there have been other updates that also need installing to fix the problem.

If you open an Elevated Command Prompt, start a PowerShell prompt and run the following it should produce a list.

Windows Update memory leak, and random CPU spikes

Use this after the Powershell prompt appears:

Code:

get-hotfix -id KB2990214,KB305026,KB3065987,KB3075851,KB3083324,KB3083710,KB3102810,KB3112343,KB3135445,KB3138612

Here's mine for comparison:

You could also review this post:

Slow updates

Then check if any of the updates mentioned are missing.

Many thanks. I'm out all day tomorrow, hospital appointment so may not get back until Tuesday.

No problem. There are a few other members here who might be able to help too. It's a known problem but the fixes are varied and can be tricky.

Am back for a short spell. More Hospital later. Here's the result of the Powershell: