svchost.exe takes all cpu power from time to time

[unko]

Late reply, sorry! I tried it and i'm afraid it didn't solve the issue :/

 

[Callender]

Well some users report that installing a particular version of Windows Update Client fixes the issue for them. However the version required varies.

Personally I found that although installing a particular version of Windows Update Client improved things (less RAM usage) it still wasn't a complete fix.

The solution for me was to fully remove Windows Updates including various files and folders along with resetting IE and fully removing and reinstalling .NET Framework. Then force install Windows Update Client. The fix is very long and complicated and may not even work the first time around. It could take several attempts.

I'm not confident that I could guide you through the fix.

RE: Your issue - the same as in Post #10 of this thread

There is something you can try although I have not ever tried this myself.

Start> Run

then type services.msc

in the window that opens scroll down to Windows Update Service and stop it.

Run an Elevated Command Prompt

Start - All Programs - Accessories - Right click Command Prompt and choose Run As Administrator.

If Windows is installed on drive C type:

esentutl.exe /k c:\Windows\SoftwareDistribution\DataStore\DataStore.edb

This will check integrity.

For help type esentutl.exe /?

​

You can attempt to defragment and repair DataStore.edb. If problems were detected do a recovery followed by a repair.

Recovery
esentutl.exe /r c:\Windows\SoftwareDistribution\DataStore\DataStore.edb

Repair
esentutl.exe /p c:\Windows\SoftwareDistribution\DataStore\DataStore.edb

 

[unko]

I'm back here cause i still have that issue after fresh install of windows 7 x64 on different pc, and multiple times (different ISO, which are the basic system with all updates pre-installed, one from 12/15, other one from 06/15); the issue seems actually worse now :/ I just tried "esentutl.exe /k c:\Windows\SoftwareDistribution\DataStore\DataStore.edb" but i get "Jet error -1032" AccessDenied..?!

PS: Off topic but do you have a link for a tools that'll scan for all known keyloggers? That'd be great.. Thanks!

 

[Callender]

I don't know much about problems with Windows Update after a fresh install. I heard that users resort to a fresh install in order to resolve Windows Update RAM usage issues only to experience the same problem.

Take a look at Usernameissues' post here:

http://www.sevenforums.com/windows-...ws-update-client-post3224052.html#post3224052

Let's see which Windows Update Client you've got:

From an Elevated Command Prompt - type Powershell then press enter and wait for the prompt to appear.

Then type (or copy and paste if you know how to enable quick edit mode in command prompt)

get-hotfix -id KB 2990214,KB305026,KB3065987,KB3075851,KB 3083324,KB3083710,KB3102810,KB3112343,KB3135445,KB3138612

Press Enter. It should list what's installed.

 

[Callender]

PS: Off topic but do you have a link for a tools that'll scan for all known keyloggers? That'd be great.. Thanks!

The one I use is PowerTool:

​

However it is pretty advanced and if used incorrectly will screw up your system.

I'd suggest a scan with Zemana AntiMalware free:

https://www.zemana.com/AntiMalwareFree

Or Malwarebytes free:

https://www.malwarebytes.org/antimalware/

When Malwarebytes installs it will ask you if you want to update to the free pro trial, update definitions and launch the program. Don't select the Pro trial - just select to update the definitions and launch the program.

Note: I do not currently use Malwarebytes but many other forum members do use it.

 

[unko]

30978 pages seen
0 bad checksums
0 correctable checksums
206 uninitialized pages
0 wrong page numbers
0x553a9 highest dbtime (pgno 0x6ca4)

15489 reads performed
968 MB read
3 seconds taken
322 MB/second
3603785 milliseconds used
232 milliseconds per read
562 milliseconds for the slowest read
0 milliseconds for the fastest read

Here's the integrity check you asked for above.

Powershell gives me a red error text when i try what you said.

PS: I'm not sure why you're so sure it's WUpdate causing this issue..

 

[Callender]

30978 pages seen
0 bad checksums
0 correctable checksums
206 uninitialized pages
0 wrong page numbers
0x553a9 highest dbtime (pgno 0x6ca4)

15489 reads performed
968 MB read
3 seconds taken
322 MB/second
3603785 milliseconds used
232 milliseconds per read
562 milliseconds for the slowest read
0 milliseconds for the fastest read

Thanks - nothing wrong with that.

Powershell gives me a red error text when i try what you said.

Sorry but I mistakenly left extra spaces in the command line. Here is the corrected one:

get-hotfix -id KB2990214,KB305026,KB3065987,KB3075851,KB3083324,KB3083710,KB3102810,KB3112343,KB3135445,KB3138612

PS: I'm not sure why you're so sure it's WUpdate causing this issue..

Well you confirmed that Windows Update was the issue here:

I had the same problem. For me it was a problem with windows updates check reading datastore.edb

View attachment 372453​

Then note RAM usage by datastore.edb during an update check after fixing:

View attachment 372455​

The fix is not easy.

Ok so i can confirm i have the same issue. You couldn't fix it?

You can disable Windows Update service via services.msc then reboot and test for a day to see if RAM usage becomes normal. If it doesn't - then it's not a Windows Update issue.

 

[unko]

Fine, I'll try. So the service is active and running even when updates are not being installed/downloaded/seeked? Seems so?

 

[Callender]

Fine, I'll try. So the service is active and running even when updates are not being installed/downloaded/seeked? Seems so?

Yes and if you set Windows Update service to disabled and reboot you can test for a day or two to see if it Windows Updates the culprit.

Start> Run

type services.msc

Press Enter.

Right click Windows Update Service > Properties> Startup Type> Disabled. Reboot.

 

[unko]

PS C:\Users\Admin> get-hotfix -id KB2990214,KB305026,KB3065987,KB3075851,KB3083324,KB3083710,KB3102810,KB3112343,KB31354
45,KB3138612

Source Description HotFixID InstalledBy InstalledOn
------ ----------- -------- ----------- -----------
PC-TPW Update KB2990214 AUTORITE NT\Système
PC-TPW Update KB3112343 PC-TPW\Admin
PC-TPW Update KB3138612 PC-TPW\Admin

 

[Callender]

Okay so you've got the latest version of Windows Update Client installed. Do you also have .NET Framework 4.6.1 installed?

​

Control Panel> Windows Updates> View Update History> Installed Updates

Also - have you actually run RAMMap again to check what's actually using RAM?

In RAMMap - go to "File Summary" tab and click the "Active" column to sort by highest usage.

 

[unko]

MalwareBytes detects Rootkit.Fileless.MTGen here. Haven't tested if it's on the other unit too. Could be related. Will update. If you know how to get rid of it, tell me please. Doing things in safemode didn't help, it's still here.

 

[Callender]

I don't know anything much about rootkit removal except that rootkit detections "hidden from system" cn often be false positive detections. Having said that MBAM isn't known for false positives.

A decent rootkit scanner that I've used:

Trend Micro Software Download Center

See if it finds anything. It's fast.

 

[unko]

We're talking about UC usage first, eh? RAMMap shows Chrome in top list, then there is system.evtx and then windows.edb

I do not see .NET Framework 4.6, i wasn't offered... How does it relate to the actual issue? Thanks for your replies.

 

[Callender]

We're talking about UC usage first, eh? RAMMap shows Chrome in top list, then there is system.evtx and then windows.edb

RAMMap needs to be run only when you are also running a manual windows update check. If you don't see very high RAM usage by datastore.edb then windows update isn't likely to be the problem. If disabling windows update service (or manually stopping it along with BITS) returns RAM usage to normal then it's something you should investigate.

I do not see .NET Framework 4.6, i wasn't offered... How does it relate to the actual issue? Thanks for your replies.

Some say that .NET Framework 4.6 is needed if the latest WUC is installed. Check installed versions using this tool:

.NET Version Detector

Also see this post:

http://www.sevenforums.com/windows-...till-wont-update-post3237782.html#post3237782

 

[ThrashZone]

Hi,
Just wanted to note
On a 32 bit system net 4.6.1 was actually a bad thing
Net 4.5.2 was better for it

I do have net 4.6.1 installed on 2 64 bit systems without any issues,
I'd first test with net 4.5.2 it really should not matter unless you're on a 32 bit system
https://www.microsoft.com/en-us/download/details.aspx?id=49982
Net Framework 4.5.2
https://www.microsoft.com/en-us/download/details.aspx?id=42642

 

[Callender]

Hi,
Just wanted to note
On a 32 bit system net 4.6.1 was actually a bad thing
Net 4.5.2 was better for it

I do have net 4.6.1 installed on 2 64 bit systems without any issues,
I'd first test with net 4.5.2 it really should not matter unless you're on a 32 bit system
https://www.microsoft.com/en-us/download/details.aspx?id=49982
Net Framework 4.5.2
https://www.microsoft.com/en-us/download/details.aspx?id=42642

Cheers!

 

[ThrashZone]

Hi,
No problem
My 32 bit was a weird ride on it's issue
I only noticed the problem like most people stalling on context menus slower performance....

Not until I installed Realtemp did I see the cpu was 50++ soon after startup

I out of desperation clean installed Vista sp2 32 bit on another spare ssd
Activation did not work so I phone activated with a new string from M$ which did activate finally,
Then used my retail win-7 upgrade disk and key which did activate.

Reinstalled the problematic ssd install and did the other process for existing installs
First thing I did was get rid of net 4.6.1 and installed net 4.5.2
Then the rest of it as stated on the previous link Callender posted too

dang if it didn't work finally
For how long no telling
But I did use Brink's bat file from option 3 here to use the upgrade key
I always suspected it might be why I was having the problem with svchost going nuts ?
http://www.sevenforums.com/tutorials/31402-clean-install-upgrade-windows-7-version.html