• Welcome to Overclockers Forums! Join us to reply in threads, receive reduced ads, and to customize your site experience!

svchost keeps spiking CPU usage on boot

Overclockers is supported by our readers. When you click a link to make a purchase, we may earn a commission. Learn More.

raventy

Member
Joined
Jul 26, 2002
Location
NJ
Hey guys,
I have done a fresh install of windows xp pro with SP2 on a laptop(700mhz,128mb ram) however for some reason on boot svchost keeps spikeing the CPU usage up to 90%+! It makes the system inoperable unless I end svchost right when it loads. When I used a third party task manager(process explorer) I found that svchost seems to make the cpu spike when processing ""ntdll.dll!RTlAllocateHeap+0x18c" anyone know why this is happening and how to fix it? thanks!
 
One of the main things is that the computer is not up to par with the minimum requirements of Windows XP or even SP2. Other than that, I wish microsoft would at least let us know what the hell they put in the background that does it so much. Also, see if there are any updates available right now.

LI Utilities

That site gives a brief explanation of the function of the svchost.exe service. Hope it helps.
 
thanks for your help thus far! acording to microsofts site all you need is a 233mhz proc and 64mb or ram to run xp with sp 2... ive even run xp on slower pc's before. I just dont understand why svchost keeps sucking up resources like this. I had a spare hard drive which I poped in and did another fresh install on and the same problem still exists! Also, for some reason whenever I try to run windows update svchost skyrockets backup to 99% cpu usage(this is after I already ended it via task manager once before) and then the windows update screen just sits there.
 
hhmm another note is it seems after leaving the pc alone for about 10 minutes after boot the svchost calms down...however when I try to run windows update it starts to go back up again... however this time it is starting to update so ill let it sit and see what happends... regardless.. haveing to wait 10min after boot is not right so I wonder whats caussing that
 
Vipersfate said:
One of the main things is that the computer is not up to par with the minimum requirements of Windows XP or even SP2. Other than that, I wish microsoft would at least let us know what the hell they put in the background that does it so much. Also, see if there are any updates available right now.

LI Utilities

That site gives a brief explanation of the function of the svchost.exe service. Hope it helps.
It fits the minimum...not the "recommended". Get it right. :)

Something's screwy; we have a machine here that does that too. I haven't been able to track it down. As a side note, are you running Norton? (I think that has a LOT to do with it.)
 
A quick note on the hardware specs... The processor should be ok for XP, at least from my experiences, but the memory is REALLY low. So, if you want to try to make things run smoother overall, try to see if you can boost the amount of memory you have.

Windows XP can run with less than optimal memory however when Windows exceeds your on chip memory then it uses a virtual memory file on your hard drive. Apparently, your hard drive is much slower than your on chip memory. So, if it needs a random memory value, it tries to load it from chip memory and fails... then it tells the hard drive to start searching for that value there... which in computer terms takes a LONG period of time. The program requesting that memory is now stalled until it gets the memory values that it wants. It wouldn't be nice if, after it retrieves that memory value, that it decides that it needs another... and another...

Drivers on your system allow access to things such as your hard drive. So, although this is more prevalent with 3rd party drivers, hard drive access can take up processor and memory resources. Usually this is built into the normal requirements of the OS though.

I'm not quite sure what is causing the CPU spikes... but if those vanished with a boost in memory I wouldn't be surprised either...

Sidenote... When a memory value isn't in the on chip memory then your hard drive is accessed. Older comptuers mean SLOWER hard drives... so it can exaggerate the problem. Similar issues come up with laptops with slower hard drives (as in diminished performance).

To help everybody else out here... what programs are you running on your machine?
 
I have a older computer that exhibited this very same problem (XP sp1 4min to boot with all services).
svchost does many things at once, one of them being the autoupdater for XP I disabled this and boot time cut in half. Just Hop over to SYSinternals .com and dl process explorer it will show everything that is running as a part of svchost (just hold cursor over svchost). Hope this helps.
 
gt24 said:
A quick note on the hardware specs... The processor should be ok for XP, at least from my experiences, but the memory is REALLY low. So, if you want to try to make things run smoother overall, try to see if you can boost the amount of memory you have.

Windows XP can run with less than optimal memory however when Windows exceeds your on chip memory then it uses a virtual memory file on your hard drive. Apparently, your hard drive is much slower than your on chip memory. So, if it needs a random memory value, it tries to load it from chip memory and fails... then it tells the hard drive to start searching for that value there... which in computer terms takes a LONG period of time. The program requesting that memory is now stalled until it gets the memory values that it wants. It wouldn't be nice if, after it retrieves that memory value, that it decides that it needs another... and another...

Drivers on your system allow access to things such as your hard drive. So, although this is more prevalent with 3rd party drivers, hard drive access can take up processor and memory resources. Usually this is built into the normal requirements of the OS though.

I'm not quite sure what is causing the CPU spikes... but if those vanished with a boost in memory I wouldn't be surprised either...

Sidenote... When a memory value isn't in the on chip memory then your hard drive is accessed. Older comptuers mean SLOWER hard drives... so it can exaggerate the problem. Similar issues come up with laptops with slower hard drives (as in diminished performance).
While you have a good idea of what a page-not-present fault is, you're not quite there. ;) You can't do an operation to a variable on disk in the strictest sense.

Memory is divided into pages on "modern" OSes[1]. On the x86, this page size is 4KB (or as defined otherwise programatically, I do believe you can have larger pages on systems with PAE). This has a few nifty side effects:
1) It can permit programs to have their own address spaces and crash hopefully without wedging the machine.
2) It can permit the OS to free up physical memory by writing pages to a larger, slower memory, such as a hard drive.

A device called the Paged Memory Management Unit (PMMU) is used to determine if memory pages are in memory and if the currently running program has the rights to access them[2]. If a page isn't in memory when a program tries to access that part of its memory and/or the program doesn't have the right to access that page, a page fault is generated (#PF) and the page fault handler is invoked to verify that the process has the right to access that page and if appropriate fetch the requisite page from disk. If there aren't any (physical) RAM pages available, the PF handler has to search for a victim to page out to disk. When you do a lot of paging, you're IO-limited on performance. If the page fault is a "you can't access that" fault, the current process is terminated and you get the nice little "Foobar.exe encountered a problem and blah blah", or, if you're in Kernel Mode, you BSOD. You also BSOD when the paging algorithm screws up and pages out a kernel area that shouldn't ever be paged out -- PAGE_FAULT_IN_NONPAGED_AREA.

Say you have a userland process that executes this statement:
Code:
movl          %eax, *foobar
If the (virtual) address that is referenced by foobar isn't in RAM, the page fault handler is invoked to get the page into RAM so the program can frob the variable.

As far as I recall the Windows paging algorithm will endeavor to keep as much physical RAM free as is possible which is why you hear a lot of disk thrashing (among other reasons). Of course, I haven't seen the algorithm with mine own eyes, and neither has anyone else on this forum. (If someone here happens to work for the MS Operating Systems division, I'm curious, and you can correct me if I'm wrong on any of the above. Silly closed-source monopolies.)

Windows WILL NOT run comfortably in under 256MB of RAM, and it should be against the law to sell computers with XP that have less than that much RAM.

Footies ...
[1] Windows doesn't qualify as a Real OS, but it does qualify as modern due to chronology.
[2] That's not all it does. Consult the IA-32 Programmer's Manuals for further information.
 
Captain, awesome post!! :)

As for the cause...

9/10 when I see this I think malware. But you're saying this is a formatted drive with a fresh copy of XP. Only other constant is the hardware, so perhaps there's a device driver conflict?

I do tech support for a living, and at this point in the problem you start grasping at straws. Turning off what svchost does fine on 99.99% of the computers running XP is putting a bandaid on a gunshot wound. There's no reason it should be eating those resources.
 
Last edited:
after letting the pc sit for a while(an hr) with windows update running it finally kicked in and started to download and install the updates! After installing the updates and restarting, svchost no longer rapes the cpu upon boot! however!, boot time has now drastically increased! Before the update, the system would boot up fast and once svchost was ended via taskmanager the system was nice and zippy! However now, its taking over 5-10minutes to boot up into windows and once in it doesnt feel as fast as it was before! When I checked the Event viewer it didnt show any problems or anything as well. Also, I have another laptop with similar specs(different brand so different motherboard ect) and it runs windows xp no problems at all and is quite zippy so i'd image this one should be able to get similar preformance.
 
Last edited:
Captain Newbie said:
Windows WILL NOT run comfortably in under 256MB of RAM, and it should be against the law to sell computers with XP that have less than that much RAM.

I dam well agree by that statement my brother purchased a eMachines system about 3 years ago £1000 for the whole lot. Including a monitor that wasn't even an eMachines model his new system only had 256mb DDR memory. I tried to tell him go for at least 512mb but nooooo I don't know nothing then last year he asked if I can get him some so I got him an extra 256mb. Turns out his motherboard is crap thou supports only 4x AGP and dosn't support dual channel I've noticed with all pre-built systems they only have crap unknown motherboards with 4x AGP and 2x DDR slots.

I personally think XP should have 512mb+, 1GB and your sorted for programs and stuff, 2GB if you play extreme games. But for laptop's 512mb or more is a defo for sure my old boss asked me to provide her with advice when buying a laptop. I went with her and told her to buy a nice Acer A64 Turion 1.6ghz, 40gb HDD & 512mb DDR Memory. I've tweaked it for her removed all the rubbish software that came with it added Diskeeper 9 for better defragmention. And disabled un-needed services the thing runs smooth real smooth.
 
you have something set to run:

1. on boot.
2. on login
3. on idle every xyz

likely a scanner of some sort.
a defrag on login?
virus scan?

or the opposite side of the coin, malware.
 
Could edit, but this is a sepearte thought anyway.
(OFFTOPIC LIKE A WILD RACOON)


raventy - PLEASE ditch the koolance stuff.
you sure joined earlier than i did, but PLEASE.

ive lost TWO harddrives and two sticks of ram to that koolance (mylar bag) *cough* -i mean- coolpack crap. you -arent- just asking for it, you are +++begging+++ for it.

it ended my overclocking days with my materials, equipment, and financially.

i now captian a lowly E-machines w3118 with the 2 sticks (one gig) that survived.

TWO Samsung spinpoint sp1614n's (allthough one reads as a 26.6 GB drive now out of 160)
ONE msi FX-5500 td 256
One Asus P4P800se
and Two windows installs.
one of them was my ONLY backup of stuff ( because my real backup died) since Pre y2k.

*ouch*

all of that gone, because of coolance coolpack based products.
it tends to burst at the seams near the inlets/outlets.
i would have sent it all back to coolance, but they would have just laughed, and that wouldnt get my data OR rig back so...i think i chucked most of mine. (dont USE any of it anymore)
i havnt seen anything so far from that company that wouldnt be on my list of hardware to avoid at all costs.
(End O/T)
 
Nice post Cap'n!

I always thought the 4KB variable was only adjustable on HDD (in RAID arrays), I am going to have to look into this :):):):) Thanks!!

To others...

Just wanted to point out to people that are NOT running Home edition that XP does have a tool to diagnose svchost problems.

Open a DOS prompt and type tasklist /svc It will tell you exactly what each service host is running. (It helps to trace by process ID too).

There is also a bunch of tools in SUPPORT that allows you to trace threads which is pretty cool too. (not sure off hand if that is on the CD or a seperate DL from microsoft).
 
orionlion82: hahaha yea the koolance stuff is oolldddd..as a matter of fact.. I dont even have it hooked up anymore! haha I just havent updated my sig in 2-3 years!! hahaha :) (maybe I will latter now that you mention it!)

to the rest: the specific thread that was causing svchost a problem back before I installed the windows updates was: "ntdll.dll!RTlAllocateHeap+0x18c" it kept raping the system up to 99% cpu!

What sucks is the fact that I have another laptop here which has a 600mhz proc, 128mb ram and 12gb hd running xp 100% fine and zippy... yet this one which has a 700mhz proc and 127mb ram takes over 10minutes to boot! The longer boot only seems to be happening a after I updated windows.. if I dont update windows im stuck with svchost trying to process "ntdll.dll!RTlAllocateHeap+0x18c" for like an hr haha! anyone have any other suggestions?

update: when I checked the event viewer again I found a message saying something about the memory used by the registry was not freed when logging off.
 
Last edited:
try visiting windows update again.
its possible that you got patch # 4 and patches #6#7#8 and #10 fix your problems.

i find that sometimes if i dont update for a while, then reboot then update again (sometimes taking 2 or 3 tries and reboots) i sometimes Still stay behind the curve...i diddnt think that patches are progressive/sucessive/dependant like that, but it seems SOME -at least- are.

or you have a a proggie with massive memory leaks in one of your apps (older firefox perhaps?)

or maybe you need to set your harddrive in bios to 32 bit or LBA or somesuch?

maybe its just a service that you dont know about?

SVCHOST hosts services.

Winkey +R then "services.msc" for us so we can see whats running .
there should be discriptions listed. let us know of anything that dosnt look quite right.
especially toolbars, "Helper" applications, and things related to IRC.
 
Neur0mancer said:
Nice post Cap'n!

I always thought the 4KB variable was only adjustable on HDD (in RAID arrays), I am going to have to look into this :):):):) Thanks!!
I RTFM'ed for the IA-32, and if a bit in CR4 is set, you can have either 4KB or 4MB pages. This is a processor thing. I don't know/care how the disks themselves handle it, as I'm not a disk guy.
 
hhhmmm it seems that when I installed windows on a smaller hard drive (12gb) svchost shot up only once they stoped doing it. I went and formated/reinstalled windows on my 40gb drive and still svchost keeps shooting up in cpu usage even after I update windows now! It doesnt do it right away... it seems like once the pc is sitting at the desktop this "ntdll.dll!RTlAllocateHeap+0x18c" thread suddently gets executed which causes the problem. Anyone know what that does or have any other suggestions?
 
hhmm wow yea it definetly seems to be doing it only on the 40gb drive and not my 12gb one.. I kinda really rather use the 40 than this small 12.. hhmm why could it be doing this I wonder?
 
ok well I poped a spare 20gb drive I had into the laptop and it works fine.. so I guess i'll just use it instead of the 40... still interesting though that the system acted weird with the 40.
 
Back