Svchost.exe utilising high CPU usage

Thought i'd post this here to help others who might get this issue in the future.

Basically svchost.exe had been using all my cpu. The services which seemed resposible was plug and play and dcom launcher.

However you cannot turn off either of those services via services.msc

So i downloaded sysinternals process explorer. From this i deduced that the actual service responsible was wmiprvs.exe to find this out it opened the svchost process in process explorer and looked at the activity from wmiprvs.exe and suspended it. Cpu activity instantly dropped, i resumed it and straight back up to 80%.

So time to stop the service.

Start > run > services.msc and click the service call Windows Management Instrumentation. And change it to disabled and reboot.

Problem solved.

Hope this helps someone in the future as my google searches came up with nothing and lead me on a wild goose chase.

 

Well done - you went the perfect path yourself

But:
This is only a temporary fix - why - not everybody has a high CPU usage from that process, so the next question is why was it running at "full blast"?

Changed Registry entry?
Change in system configuration?

 

Better try to repair the failure instead of just disabling an otherwise well working service. Something is wrong with your system! And just disabling this service may worsen everything.
http://www.blackviper.com/WinXP/Services/Windows_Management_Instrumentation.htm

 

Also some viruses hide themselves using this process.

 

I'm pretty sure it's not a virus as i haven't visted and dodgy sites or downloaded anything recently. I'm using nod 32 aswell which is pretty reliable.

Problem is i have no clue as to what is making it use so much resources :\
Disabling it seemed to be the only viable option.

 

About the dodgy sites...

If you visited any UK governmental sites - their security at least was quite lacking according to the times...

With links inserted to sites of dubious contents...

Although the "site operator" say Sony, or Ford, Maybach even may be trustworthy someone could have hacked into it and inserted malicious code.
You never know what they are up to...

So I wouldbn't discount that probability per se due to your reason given.

(Saying that - I do not seem to have had a single virus on a laptop so far)

 

Well i wasn't completely disregarding it but my anti-virus hasn't flagged anything and the process is running from the right place

So it seems unlikely.

 

That is true.

My gues would be a messed up registry entry...

Somehow on an old Medion a O&O defragmentation managed to mess up the registry so that I think indexing was constantly accesing the Harddrive - a registry cleaner solved that issue.
(Pure luck, it was XP too)

 

I think the svchost.exe have been infected..
That's what happened to my computer..

The remedy.. download a new svchost.exe or svchost.dll and boot up from the cd, maybe bartpe.. replace the 2 files.. It happened quite some time, so I can't remember if there a .exe or .dll for the svchost..

 

Just checking but was the process actually ' wmiprvs.exe'?
The correct WMI process name is ' wmiprvse.exe'.
If you made a typo, you're good.
If not, you might have a worm (W32/Gaobot) issue. (notice; might)
Cheers.

 

Ooops yeah it was a typo

 

Only problem I have with svchost.exe is using too much memory, not cpu.
Have already checked what services is causing, disabled the unnecessary ones, but the main ones still use a fairly large amount. Oh well.

 

Svchost will always use alot of memory, not an issues when you have 3gb of it though