Runaway servicehost.exe -- WXP Pro Machine

[CobraPilot]

I have a WinXP Pro machine I need to keep usable awhile longer because of some parallel port hardware I use with it.

All of a sudden (or so it seems), I have a "runaway" servicehost.exe process that keeps my CPU usage at or near 100%, making the computer virtually unusable. Stopping it releases the CPU, but I lose, among other things, my audio system.

Using Process Explorer, I find the "runaway" servicehost.exe involves services shown below. I'm guessing I can find the problem by stopping them one-at-a-time, but I fear I'll create more problems.

I've searched online, but articles I've found always seems to advise stopping the services until you find the source of the problem. I haven't found anything that explains how to pinpoint the problem while the runaway servicehost.exe is running.

If anyone has any experience or suggestions as to which of these services are suspects; i.e., where to start, I would appreciate it.

o AudioSrv
o Browser
o Cryptsvc
o DHCP
o dmserver
o ERSvc
o EventSystem
o FastUserSwitchingCompatibility
o helpsvc
o lanmanserver
o lanmanworkstation
o Netman
o Nla
o RasMan
o Schedule
o Seclogon
o SENS
o Shared Access
o ShellHWDetection
o srservice
o TapiSrv
o Themes
o TrkWks
o W32time
o winmgmt
o wscsvc
o wuauserv
o WZCSVC

[hech54]

Start up in SAFE MODE.....run MalWareBytes, SuperAntiSpyware, CCleaner, etc etc?

[CobraPilot]

My oversight: I should have mentioned in the OP that I've done all the usual spyware, virus checks, ccleaner steps.

[davexnet]

Open Process Explorer and right click the svchost in question.
Properties/threads. Which thread is using all the CPU? Does the module name provide a clue as to the particular service?

Also there are miscellaneous reports of the windows update process causing issues in XP.
From the CMD prompt issue this to temporarily stop it and see if it affects the CPU

net stop wuauserv

[Drowning]

Kill it from CMD is not not work for me. I searched the web for answer and found that some people use RKill and TDSKill executable programs to stop the malware processes and remove toolkits. I do not know the app before, but it worked for me. You could also try it. I even asked it to the Microsoft Answer and no one could solve it.

[hech54]

Time to try the heavy hitters like CombiFix and the other "killers" mentioned above.

[Nelson37]

Download Malwarebytes, ccleaner, the latest drivers for your audio card, and also the previous set.

First test if the problem is present in safe mode, or not.

Boot to safe mode, install MBAM and cleaner, run. Reboot and run again. Test.

Next, completely uninstall audio drivers, run ccleaner AGAIN, delete driver directory, reboot, Test.

Re-install new audio drivers, reboot, test.

If you have used other software, use the ones specified. If you already used the specified software, say so. "The usual steps" means different things to different people, there are areas in life where "close" doesn't cut it, get it right and save some time.

Carefully examine ALL changes, updates, anything at all, that has changed on the PC before problem began. SOMETHING HAS CHANGED. It is possible for a file corruption to be the cause, but this is rare. Likely some update or added program is responsible. Knowing what that was would be useful. Most folks won't mention what they did, and/or won't take the time to look. Such is life.

If there is no identifiable culprit, then a thorough test of the hard drive is strongly recommended.

Further steps if needed dependent on test results.

[CobraPilot]

Thanks for all the suggestions!

My "culprit" seems to be "wuauserv" (2d from bottom of my Process Explorer list above), identified as "Windows Update" service. Stopping it, CPU levels dropped immediately to <10%. A Google search on this exact service name shows lots of users have had this same problem.

I tried simply restarting it, in Process Explorer, which produced a similar CPU usage drop, but it soon returned to high levels.

I saw a suggestion to install a fresh copy of wuauserv to see if that helps, which I will do.

If the problem returns, I guess I'll need to move to the next step, that of preventing its re-loading at every boot.

[davexnet]

Thanks for all the suggestions!

My "culprit" seems to be "wuauserv" (2d from bottom of my Process Explorer list above), identified as "Windows Update" service. Stopping it, CPU levels dropped immediately to <10%. A Google search on this exact service name shows lots of users have had this same problem.

I tried simply restarting it, in Process Explorer, which produced a similar CPU usage drop, but it soon returned to high levels.

I saw a suggestion to install a fresh copy of wuauserv to see if that helps, which I will do.

If the problem returns, I guess I'll need to move to the next step, that of preventing its re-loading at every boot.

Yes I mentioned this above as a possibility, before the malware theories took off.
There was supposed to be a fix for XP in 2014. Is your system not up to date with MS updates ?

[CobraPilot]

Thanks for all the suggestions!

My "culprit" seems to be "wuauserv" (2d from bottom of my Process Explorer list above), identified as "Windows Update" service. Stopping it, CPU levels dropped immediately to <10%. A Google search on this exact service name shows lots of users have had this same problem.

I tried simply restarting it, in Process Explorer, which produced a similar CPU usage drop, but it soon returned to high levels.

I saw a suggestion to install a fresh copy of wuauserv to see if that helps, which I will do.

If the problem returns, I guess I'll need to move to the next step, that of preventing its re-loading at every boot.

Yes I mentioned this above as a possibility, before the malware theories took off.
There was supposed to be a fix for XP in 2014. Is your system not up to date with MS updates ?

Apologies for not acknowledging your suggestion as being the solution, davexnet. Thanks.

Have ALWAYS kept Windows XP updated. Will take a look for the 2014 update you mentioned.

[davexnet]

See if there is anything here that helps.
http://solotechpros.com/2014/01/08/windows-xp-svchost-exe-wuauclt-exe-cpu-100-fix/

[CobraPilot]

See if there is anything here that helps.
http://solotechpros.com/2014/01/08/windows-xp-svchost-exe-wuauclt-exe-cpu-100-fix/

Many thanks!! I'll see what this does for my problem! Manually stopping wuauclt.exe at every boot-up is more than a pain!

Given that we're talking about the "no more updates except maybe for extreme ransomware" status for Win XP, if the above or other suggestions don't solve my problem, would it be solved by stopping the automatic update process in entirety?

[jan5678]

If your system is absolutely up to date than disable windows update won't hurt your system because there are no more updates coming for xp.

"except maybe for extreme ransomware"is off course something to keep thinking about for the future because microsoft "might" make updates for xp for this kind of problems

[CobraPilot]

If your system is absolutely up to date than disable windows update won't hurt your system because there are no more updates coming for xp.

"except maybe for extreme ransomware" is of course something to keep thinking about for the future because microsoft "might" make updates for xp for this kind of problems.

That "except for ransomware" factor PLUS the occasional non-OS MS updates to MS Office and other MS software I continue to receive makes me less-than-eager to completely shut it off.

Altho something of a pain, davexnet's reminder that START RUN net stop wuauserv makes it easy to stop that service, even at high CPU-usage levels.

If/when I can find a true fix (vs. shutting off updates entirely), I'll post it here, in the ongoing spirit of VideoHELP!

Thanks to all who offered suggestions!

[CobraPilot]

I am cautiously optimistic that I've found the solution . . . . What follows is a "fix" someone posted online about having trouble with Windows Update in general, although not specifically my "runaway svchost.exe" problem. I figured it was worth a try.

Inside the OP's quotes (" "), my added comments are bolded, preceded/ended by ***.

"I had the same problem with windows updates and tried all the remedies posted on umpteen replies and none worked. I then found while scouring the net this piece of information of which - BINGO - it worked! (not sure if its in the forum anywhere but here it is anyway):

Re-register the WU components:

1. Quit all programs that are running.
2. Click Start, and then click Run.
3. Type "regsvr32 wuapi.dll" (without the quotation marks), and then click OK.
4. When you receive the "DllRegisterServer in urlmon.dll succeeded" message, click OK.

If this does not resolve the problem [*** it did NOT solve my "runaway" ***], repeat inputting the following commands and click OK after each command:

regsvr32 wuaueng.dll \
regsvr32 wuaueng.dll / *** Duplicate or typo? I did it twice, anyway. ***
regsvr32 wuauserv.dll

*** Registering the above 3 (2?) seems to have solved problem of runaway svchost.exe, as CPU use plummeted. Seemed to work after 1st reboot . . . . I confirmed in Process Explorer that the audio service was running inside its svchost.exe, along with a lot of others associated with that one. It may be that simply reregistering wuauserv.dll was all that was needed, but I know it worked about the first 3(2). ***

regsvr32 wucltui.dll
regsvr32 wups.dll
regsvr32 wuweb.dll
regsvr32 iuengine.dll

A couple of these regsvr32's did not register but I ignored them and as I stated it still corrected the
problem. I sincerely hope it helps anyone who is going nuts trying to sort the problem out!"

*** VideoHELP.***

[CobraPilot]

"Cautiously optimistic" didn't last.

After a second hard reboot, the runaway svchost.exe returned, so I don't know why it worked after the first hard reboot the day before.

Reregistering wuaueng.dll stopped the high CPU use.

So, I'm back to working my way back through the suggestions above, some of which I haven't yet tried because I thought I'd found a solution with the reregistration of the dll's.

If/when I find something that works after each reboot, I will update.

Thanks for the continued advice!

[davexnet]

There was an MS "fixit" for WU problems for XP, I believe it was called microsoftfixit50202, unfortunately I don't know where to find it.

EDIT I found it on my PC, I'll upload it if you can't get it anywhere

[Nelson37]

Disable the freakin update and run it manually when something worthwhile is released, or just periodically.

The reason I and others suggested the possibility of a virus is that they are extremely common causes of similar problems, and you made no mention of what specific steps you took to eliminate that possibility. Also no mention of safe mode testing and results of obtaining a fresh copy of the offending file from a KNOWN GOOD source.

Note that if automatic updates were turned off, and then only run manually, and assuming you were paying attention and chose to disclose the information, there would be definite knowledge if this problem were directly tied to a recent update, or if no such updates were performed recently, then you could focus on some likely different cause of the problem.

The date stamp on the offending DLL might be a useful tidbit of information. A thorough file and registry cleanup might be useful if that file has not been changed recently.

[CobraPilot]

Nelson37 sez: The reason I and others suggested the possibility of a virus is that they are extremely common causes of similar problems, and you made no mention of what specific steps you took to eliminate that possibility.

Actually, my comment #3 above mentions virus checks, ccleaner, etc., but I AM guilty of assuming my being on this illustrious board since 2004 would mean I might not need to go into as much detail as suggested. Clearly I was wrong about that. In my #16, I mentioned I would return to working through the suggestions made by others, including Nelson37, who might have missed it, but who continues to give good advice, nonetheless. I now have plenty to work through in hopes of finding a solution to share.

davexnet adds: There was an MS "fixit" for WU problems for XP, I believe it was called microsoftfixit50202....

Found it!! Thanks!