When opening the Task Manager, you should always monitor CPU usage. The total workload is indicated at the very bottom of the window. Sometimes the “System” process can completely overload the system, up to 99%. And this is far from the norm. But it is quite possible to solve this situation on your own.
Most often, the reason for the CPU overload of the “System” process is associated with the Automatic Update mode of the Windows operating system being enabled. To troubleshoot, you must open a command prompt with administrator rights. Insert the phrase “net stop wuauserv” into the line and confirm your action. A window should open in front of you notifying you that the service has stopped.
After that, open the Task Manager again and check the CPU load. If the indicators remain critical, you need to restart the disabled service. Open the command line again and enter the same phrase.
If you have Windows XP operating system installed, the cause of CPU overload may lie in the IPSEC service. Therefore, it is worth trying to disable it. To do this, type the hotkey combination Win+R and enter “control ADMINTOOLS” in the command line that opens, confirm your action. A list will open in front of you, in which you only need the “Services” item.
We go into it and look for the IPSEC service. Right-click on the file and select the “Stop” function from the drop-down menu. After this, we check the CPU load. If the problem is not resolved, you can enable the IPSEC service in the reverse order.
Sometimes the cause of CPU overload is due to the antivirus not working correctly. Try uninstalling the antivirus and viewing the task manager again. If the problem is resolved, just download a new antivirus. If you installed a paid version of the antivirus, you need to contact technical support to resolve the problem. Also, you should definitely check your system for viruses. In this case, the current antivirus will be Dr.WEB. Download it and conduct a full check.
Date of publication: 07/20/2010Article updated 12/09/2011
Symptoms:
Your computer suddenly began to freeze and slow down the system. At the same time, you have an antivirus with the latest antivirus databases. Click Ctrl+Alt+Delete and click on the tab Processes. You will see a list of all processes that are currently running; at the same time, you will see that one of the processes is consuming a lot of computer resources (although you are not currently using any programs). Here you will see a certain process svchost(there will be several processes with the same name, but you need exactly the one that loads the system at 100%).
Solution:
1) First of all, try simply restarting your computer.
2) If after a reboot this process continues to load the system, then right-click on the process and, in the list that opens, select End process tree. Then restart your computer.
3) If the first two methods did not help you, then go to the folder Windows and find the folder there Prefetch(C:\WINDOWS\Prefetch). Delete this folder ( delete exactly the folder Prefetch; DO NOT accidentally delete the folder itself Windows!!!)
Next, follow the second point (i.e. delete the svchost process tree). Restart your computer.
How many processes should there be in total?svchost.exe in the "Processes" tab?
The number of processes with this name depends on how many services are running through svchost. The quantity may depend on the version of Windows, the properties of your computer, etc. Therefore, there can be from 4 processes (the absolute minimum) to infinity with the name “svchost.exe”. On my 4-core computer with Windows 7 (including the services being launched), there are 12 svchosts in the “Processes” tab.
How to determine which one is a virus?
You can see in the screenshot above that in the “User” column next to each svchost there is the name of the source that launched this very process. In normal form, next to the svchosts it will be written “system”, or “network service”, or “local service”. Viruses launch themselves as “user” (can be written “user” or “administrator”).
What is a process anyway?svchost.exe?
In simple terms, the svchost process is an accelerator for the launch and operation of services. svchosts are launched through the system process services.exe
What happens if I click on “End process tree” and accidentally end a system process?svchost, and not the virus itself?
Nothing bad will happen. The system will give you an error and restart your computer. After a reboot, everything will fall into place.
What viruses masquerade assvchost.exe?
According to Kaspersky Lab, the following viruses are disguised as svchost.exe: Virus.Win32.Hidrag.d, Trojan-Clicker.Win32.Delf.cn, Net-Worm.Win32.Welchia.a
According to unconfirmed reports, some versions of Trojan.Carberp also disguise themselves as svchost.exe
How do these viruses work?
These viruses, without your knowledge, access special servers, from where they either download something else dangerous, or send information to the server (namely your passwords, logs, etc.)
Processsvchost.exe loads the system, but in the “User” column it says “system". What it is?
Most likely, this means that some service is working hard. Wait a little and this process will stop loading the system. Or it won't stop... There are some viruses (for example: Conficker) that use real svchosts to corrupt your system. These are very dangerous viruses, and therefore you should check your computer with an antivirus (or better yet, several at once). For example, you can download DrWeb CureIt - it will find such viruses and remove them.
Why do you need to terminate the process tree and delete the folder?Prefetch?
If you terminate the process tree of your system-slowing svchost, the computer will reboot immediately. And at startup, when the virus tries to start again, the antivirus (which you must have installed) will immediately detect and remove it. Although there are many modifications. For example, the original source of such a virus may be located in the Prefetch folder. This folder is needed to speed up the operation of services. Removing it will not harm your computer.
Your advice didn't help me. Processsvchost.exe continues to load the system.
First of all, check your computer with an antivirus. Better yet, check your computer with several antiviruses.
I can also advise you to clean out the System Volume Information folder. This folder contains restore points for your computer. Viruses register themselves in this folder, since the system does not allow the antivirus to delete anything from this folder. But this is unlikely to be of use to you. I have not yet heard of such modifications of viruses that pretend to be svchost.exe and are located in the System Volume Information folder.
If you have any more questions, I will be happy to answer them.
Latest tips from the Computers & Internet section:
Council comments:
Thank you very much! Everything is clear and without water. All unnecessary processes have disappeared. Thank you!
Windows6.1-KB3102810 x86 (x64) - for 7, whose updater eats up a lot of RAM.
In short, I figured out why svchost was loading the percentage by 30%, the Spyware Process Detector utility (you can find it on the Internet with a crack) helped to uncover this mysterious process, and it turned out not to be some kind of malware, but an ordinary system process Defrag exe, and it was ratting. In short, I turned off the service Disk defragmentation, svchost no longer occurs. The problem is solved.
I tried everything, and disabled the update center, and deleted Prefetch, and completed the process tree, nothing helps, svchost still loads at 30%.
Ilya, thank you very much! It helped! I did everything as written. Only on my XP the service is called Automatic Update. After disabling autorun, as soon as I managed to stop the service, this process disappeared and the CPU load subsided. For those who don't care about XP or updates, I recommend this method.
Ivan, thank you very much for your comment) It helped. I denied access and everything returned to normal. Nothing helped before!
I deleted the Prefetch folder, but after a reboot it appears again, just like the problem with the RAM.
on Win XP I solved the problem simply - by disabling system updates. Probably the soft ones are in this way unobtrusively pushing users to leave XP and 7.
Rustam, the article clearly states that this folder is not for system files (which are located in the windows folder). Here is a quote from the article "Removing it will not harm your computer." READ THE ARTICLE CAREFULLY, cykablyat!
I looked into the svchost folder, but found there only the root folders of all programs running on the computer. when deleting, a catastrophe could occur, but the main thing is: a complete shutdown of all life-supporting programs, which ultimately would lead to the fact that after a reboot the computer would stop working altogether, and I would have to reinstall Windows. So, I did not risk deleting the entire host folder . I will look for other solutions to problems. And for those who think that disabling the update solves the problem, I’ll say: I did this once, and the virus that got into the computer ate the entire motherboard and the hard drive stopped working. in fact, it starts the laptop, but immediately freezes and does not even respond to ctrl-alt-del. And on the start and shutdown button of the computer. I have to take out the battery... since then the laptop has been retired... not a single workshop will undertake to repair it. some kind of nonsense.....
I demolished this folder - it helped. Thank you!
who can help with svchot? my contact details WhatsApp Viber +7 999 171 60 74 Skype West00073 I will be grateful. I tested the computer in every possible way and it doesn't help.
who can help this SWSHOT just tortured me, tried everything. Is there anyone who can solve this issue?
All the methods indicated in the article did not help me, I decided to read the comments and they most often said that it was not a virus but updates and I turned off these updates and everything went away
Thank you!! took down the folder. corrected ;)
I apologize, my mistake. other processes in Sestem32
What if the process that consumes the CPU is located not like all other svchosts in Win32, but in AppDataRoaming?
Thanks, I deleted the folder and everything is fine.
The advice from the comments from Roman on 08/30/2016 helped me, namely the second (additional) method, through Administration!
Thank you everything fell into place!
Can I contact you on Skype?
If the RAM is overloaded, but the system is working.
Is your operating system consuming a lot of memory? And overloaded from session to session. Don't panic. As paradoxical as it may seem, especially for those who suffered from a lack of RAM on old computers, the condition in which the RAM is overloaded is sometimes absolutely normal. “Underloaded” memory is just a waste of that same memory.
Let's separate the causes and problems
But first, let's clarify the situation. If the RAM is overloaded, this is sometimes a bad sign. If the memory is full, and the computer begins to slow down, the hard disk loading indicator blinks continuously, and the system begins to fill the paging file on the hard drive with operational data. If this happens, there is only one conclusion: there are many applications running that consume too many Windows resources, or there is a process running against you in the system. The nature of these applications can be judged by Task Manager, which describes all programs currently running. These could be tasks you started or viruses. Often programs are able to camouflage themselves even from the Manager, so if the RAM is overloaded “for no reason”, you should think about changing your antivirus or it’s time to add an anti-malware. But the first thing I would start with is checking the RAM with the utility.
And again, the situation is different. If you notice that the memory begins to fill to capacity just when you connect to the network or when you try to download something (and the Windows Manager is silent, like a guerrilla), it’s worth remembering whether you installed some software or special drivers to enhance the download. In any case, check your network drivers. And the easiest way to check whether a specific device is working against you is to Safe mode without network drivers.
Let's continue further. Comrade Russinovich, who, together with his colleagues, has written a lot of useful things for Windows, has a separate copy that significantly expands the functions of the Task Manager in the area of RAM operation. We're talking about a utility. Anyone who has wondered about the use of RAM should have this utility appear on their computer.
Working with the utility - and within this... go directly to the tab File summary: it can already clarify a lot, because it gives a list of not just abstract programs and services, but a NAMED LIST of files that are SPECIFICALLY eating up your RAM right now. Frankly speaking, this is one of the few utilities that can really help to catch the culprit of problems with RAM, not in the form of “Yes, Chrome eats a lot!”, but will show a specific document on the hard drive, which, among others in the running service, is the culprit of the situation.
AMENDMENT
In this article, I am not looking at special cases when the RAM is overloaded so much that the system simply stops and it becomes impossible to work with it. Moreover, it does not matter what amount of RAM is installed on the computer: 4 GB or 16 GB - the memory is completely filled almost immediately after the system starts. In this case:
- If your computer is particularly slow when accessing the Internet, read the article. There we will look at an example of how to identify the cause of such slowdowns.
- The task manager shows that the system is slowed down by one of the specific processes, but for no reason visible to the user. Read the article
- The RAM is completely occupied, the system stops, but the Task Manager cannot indicate the reason: visually all processes consume a non-critical amount of memory. This is a virus or malware that “edits” network drivers. Dig this way.
So you should separate the situation with a full RAM load as a result of the actions of malicious programs or broken drivers and a malfunction of the “RAM-slot-waterbox” connection and the scenario where in fact everything works correctly, only a few programs are open, and there are signs of a slowdown in the computer is not observed, but the RAM is still overloaded.
One of the ways to find out the reason or try to get to the bottom of the reasons for RAM overload is to create a another account. With administrator rights. And compare everything you can compare: running processes and services in the Task Manager, information from System Monitoring, Startup folders and System Configuration from msconfig. If there is a problem, it may manifest itself.
Caching
Those who experienced Windows XP remember well how freshly installed Windows consumed 150-250 MB of RAM. For owners of Windows 7 and later, the situation has changed radically. It consumes at least 1.3 GB of RAM by default. Hence, many of the users made the wrong conclusions about the advantages of the previous system over Windows 7. RAM for the modern system is used much more profitably than in the days when the immortal Windows XP was born. It is now a cache for frequently used files and program data. It is the responsibility of the RAM cache to store a copy of the files that you have recently accessed (if the system constantly accesses the hard drive for this data, it will stop moments after starting).
Thus, for the first time, technology appeared in Windows Vista SuperFetch(super sample). SuperFetch is an internal service that runs inside the system process svchost. Technology SuperFetch allows you to determine the user's most frequently used applications, create their database, and re-upload the data into memory in ready-made blocks each time the program is launched. As a result, programs load faster. Constantly updating the list of user preferences, SuperFetch right during operation, it is capable of changing the speed of Windows itself, observing the user’s actions.
SMALL INSTRUCTIONS FOR MEMORY DIAGNOSTICS
Now I will show with a small example how you can use some of the built-in and special programs to find missing RAM in Windows.
- So, what do you need to know about cache and how to control it? Using Windows tools - almost nothing. However, since the current size of the RAM cache is easy to check (its size in the current session can tell you something), let's take a look at it: in the Task Manager it is in the tab Performance. So, in Windows 10 it is here:
For now the situation is normal, but in moments it will begin to change
The main thing you should understand now: if you have installed 4 GB RAM, it is full, and the cache is allocated in the area 200 MB, you have serious problems. Means…
- open the tab Processes Manager and for ease of viewing, rank the column with processes according to the amount of RAM consumption, and by adding the values, estimate whether all processes really consume so much physical memory that the 4 GB mentioned in the example is not enough? We discovered a failure and half were missing:
even offhand - there’s not even a gigabyte of RAM here
- in the same Dispatcher we need . Here everything is in more detail and some inconsistencies are already evident (it just paints a real picture of how RAM in the system is distributed and where it is currently used):
the situation does not require intervention: the most consuming applications are visible in full view - these are the Chrome and Edge browsers
- however, in a few minutes the situation will change and the time comes - it becomes warmer:
too much for a “small” part of the system cache
For those who are interested, but have forgotten: A metafile is part of the system cache and consists of NTFS metadata. And this, in turn, is the MFT table, folder names, paths to them and assigned attributes. But something already hurts too much...
- In general, further research may not be interesting to you. The event log showed that the defragmentation service tried to analyze all system volumes of the hard drive according to a schedule, but each time it encountered an error in one of them. Fortunately, the situation was successfully resolved by correcting errors on the disk and starting the defragmentation service along with the MFT table. It took a lot of time (all night on a 500 GB partition), but after the reboot, tears of joy appeared on the face of the computer owner: 1.2 GB maximum RAM load instead of 4 GB before. For a weak system, the increase is significant.
What else is there in the arsenal to speed up the system?
Windows developers continue to care about the user by loading the system with a set of functions that allow you to respond to problems without waiting for massive reviews. For this purpose, a third of Windows services are only diagnostic in nature, which work on the “started-observed-notice-report” principle. Whether the system is stable or not, the services will be started. The processor is loaded, the RAM is full. Who's feeling good? No, this is not about stopping all “unnecessary” services. The question is in the area of “articulation” between an aging computer and a shoehorned version of Windows. In general, drivers and more drivers.
By the way, the most likely option to get rid of one of these services is to stop, for example, the monitoring service Network Diagnostic Usage(aka NDU). Only the developers know what she’s looking at there. Personally, after turning it off, I felt a little better and the amount of free RAM increased by 10 percent:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu
parameter Start I deduce from the meaning 2 on 4 :
I repeat, there can be quite a few such services in the system, as evidenced by the paragraph NonpagedPool windows of the same RAMMap. Or it may not exist at all.
The Windows operating system performs a large number of background tasks that can negatively affect the performance of low-power computers. One of the processes that loads RAM, disk or CPU is System.exe. In the “Task Manager” you can see that the System file loads Windows, and if more precisely, it loads the computer’s hardware. The computer owner can solve this problem on his own if he follows a number of simple steps.
Table of contents:The System process loads the hard drive and memory to 100%
System is a Windows operating system process that is not a virus, contrary to popular belief. It is responsible for running applications in the “background” mode, that is, without active control by the user. This process is not hidden, and can be easily found in the Task Manager.
The main problem with the System.exe process is that it cannot be stopped. Thus, if System is loading up the computer’s RAM or hard drive, it will not be possible to turn it off using simple methods. Lowering the priority of a process using standard Windows tools also does not lead to success. 
The System process is notable for the fact that it takes up RAM little by little and eventually loads it completely. At the same time, in the “Task Manager” it may be noted that System loads no more than 200-400 MB of RAM, but it will be completely filled, and the computer will begin to freeze severely when performing any tasks. Similarly, the System process can load the hard drive.
To prevent the System file from loading your computer, using up excessive resources, you should disable some “background” tasks in the Windows operating system:
If any computer owner can turn off and remove DrWeb without any further prompts, the other two tasks are more difficult to cope with, and we will tell you about them in a little more detail.
How to disable Windows 10 automatic updates and system services
Microsoft has provided the ability to automatically update software in the Windows 10 operating system and earlier versions. Unfortunately, this function on some computers leads to the fact that when checking for available updates on Microsoft services, the System file loads the RAM or hard drive. In this case, the only solution is to disable automatic updates of Windows 10. Attention: If you have disabled automatic updates of Windows 10, we recommend that you check for new builds of the operating system yourself every few months (or weeks).
Disabling automatic updates in Windows 10 is quite simple; to do this you need to:
By following the above instructions, the operating system will disable the service that automatically checks, in the background, whether the version of Windows running on the computer is up to date.
In addition to automatically updating Windows 10, so that the System process does not load the system, you need to disable some services. In the “Services” menu, which is opened with the command services.msc, you also need to stop and then disable the following local services:
Note: Depending on the version of the Windows operating system and the number of drivers and codecs installed, some of the services listed above may not be available.
After disabling DrWeb antivirus, automatic Windows 10 updates and some services, you should restart your computer. By disabling a number of tasks that took up a lot of computer resources, system performance should generally improve, and in the Task Manager the problem with loading the hard drive and RAM will disappear.
Video instruction
Working on a personal computer requires quite a lot of effort from the user. But this is only if the main goal is to create a productive device. If your PC is slow, this could be due to a variety of reasons.
One of the most common options is CPU overload. If the user begins to analyze the current situation, he may note that the fault lies with completely incomprehensible applications and running processes.
Strange central process loading is a problem that many users face. This also applies to the most modern processors. Therefore, it is necessary to look for a reason other than outdated equipment.
In some situations, you can reinstall the operating system. Another popular method is to update and install the necessary drivers. This real problem must be dealt with using effective techniques.
Finding out the reasons
The relevance of this issue is very great. Users need to first find out which program is to blame for such a negative situation. This problem is quite common, so many users are interested in it.
To assess the degree of CPU overload, you need to open the task manager. After that, go to the tab with all applications that are running on the personal computer. Next, all objects are sorted according to certain parameters. You can do this by name or by load produced.
The problem can occur even when the user has closed the application, but it is still in the active list. As a result, they load the system. And the user may not even be aware of this, since he is sure that he closed the program or game.
If problems start, you can reboot your personal computer. In some cases, this helps, since in this way the downloaded programs will still be closed. You can also use the task manager. With its help, you can close all the necessary objects even faster.
At the time of processing the result of all displayed processes in the download, the user should conduct an analysis. Some applications may be dangerous. If they are not eliminated in time, users will experience a gradual or sudden decrease in device performance.
Professional help
A situation may arise when all programs are closed, but the CPU load is quite high. Such situations are also not uncommon. In this matter you cannot do without the help of specialists. It is not at all necessary to take the device to the specialist. You can use the Process Explorer utility.
The application will help you see all hidden downloads. As soon as the list appears on the screen, you can sort out unnecessary services. You should also identify whether there are any suspicious objects in the device. To do this, you need to use this particular software product, since the Task Manager is not always able to display all the elements.
Active struggle
The most common cause of the problem is the lack of necessary drivers. Users need to boot the device using Safe Mode. Immediately after this, you can assess whether there is a load on the processor or whether there is no such problem.
In most cases, the reason lies precisely in the drivers. The surest way is to reinstall the OS. It is better to entrust such actions to a specialist. Only after installing the system should you carefully download drivers. These components must be installed one at a time.
Users need to act very carefully. It is better to download directly from the official website of the manufacturer of your device. In this case, the risk of problems occurring is reduced to zero.
In second place are viruses. It is these pests that can negatively affect the operation of the processor. Some of these objects can extract files. Also, pests simply steal personal data and other important components. The appearance of banners is also the influence of malware.
Fixing the problem is a very simple process. All you need to do is install a high-quality antivirus service. First of all, it will begin the process of scanning the system. An effective utility is able to identify all pests of different types and types. Afterwards, you can eliminate all threats and begin to eliminate problems that arose due to viruses.
The performance of the device may also decrease if HDD mode is activated. It is important to ensure that the hard drive operates exclusively in DMA mode. Any other option will lead to all sorts of problems and failures.
You can also check the impact of all connected objects. To do this, simply disconnect the mouse, flash drive, if it is a laptop. If the work is carried out with a desktop computer, then the user must also turn off the monitor and keyboard.
You should pay attention to the Device Manager. If yellow or red icons are displayed next to some devices, this may mean that the drivers are not working correctly or are missing. So it is imperative for users to study all the information displayed.
Based on this, conclusions can be drawn about the state of each element. So you can immediately download missing drivers or update outdated versions. If necessary, users can entrust some problems to real experts, who will certainly help solve all problems professionally.
Another common reason is the presence of dust and dirt. Some users do not keep their device clean. Therefore, the result of such negligence is overheating of the device. The cooler starts working much faster just to cool the personal computer.
Also replacing the differential in the operating mode. The device can work either stronger or weaker. Also, the spontaneous reboot and shutdown of the PC is no exception. Users can fix all these failures themselves.
It is important to constantly monitor the temperature of the device. To do this, you need a special utility. The application will be able to estimate the optimal performance indicator. When it increases to a critical level, a notification will be shown. So the user needs to immediately identify the cause and try to eliminate it as soon as possible.
Dust cleaning must be done at least twice a year. Each user can do this independently. The thermal paste should also be replaced during the cleaning process. This is a fairly simple process. You should first read or watch a video on this topic.
Each considered problem-solving option is really effective. Users only need to find out the reason to choose the right method. If it is difficult to decide to implement any process, then you can simply reinstall the operating system. It's a win-win.