Hello, friends! In this article I will tell you why SVCHOST.EXE netsvcs loads the memory and processor of your computer. Among users of personal computers, there is often a conversation about an incomprehensible process that constantly loads the machine .
SVCHOST.EXE – a large number of malicious utilities that existed relatively recently had a similar name. Therefore, I decided to figure out which processes are truly dangerous and which do not pose a threat to machines. In addition to all this, you will learn what to do in a situation when a process loads your computer or it turns out to be a virus.
In this article you will learn what to do if SVCHOST.EXE netsvcs is using up memory and processor.
Service Svchost.exe (netsvcs): what is this process?
Let's take Windows 7 as a basis, since in systems of a higher rank the problem with this service is not so pronounced.
It was from the seventh modification of Windows that the developers decided to make the system faster, using for this, as they believed, a universal solution, the essence of which was to not call the executable file of some system or user process, but to launch it through one service in background mode.
Scan your PC for malware
Sometimes it can be difficult to know whether your computer is infected with malware or not. However, if none of the previously mentioned solutions helped you get rid of the problem, there are even more reasons to scan your system for malicious activity. Various infections can lead to many conflicts and instabilities in the system. Unwanted or malicious programs can consume a lot of network resources to carry out their functions and remain on the system for a long time. You can use the built-in Windows Defender or try installing a more advanced antivirus developed by Malwarebytes, a trusted and talented group of experts who constantly update their software to combat both minor and major threats. You can download it now using the button below and try a 14-day free trial of full malware protection.
Malwarebytes main window
Malwarebytes Settings
Malwarebytes scan results
How the service works
If you look at the list of processes in the Task Manager, you can see several Svchost.exe services (netsvcs). What this is and why this happens will become clear if you understand the basic principles of operation of this component. In general, processes may contain four (minimum) or more such components, but they all belong to the same group (netsvcs). The working principle of the process is to launch system processes through special svc hosts using the Services.exe tool. In this case, the accompanying components of any program (for example, dynamic libraries DLLs, which are not accepted for execution by the system in the usual way) are loaded into RAM. It is believed that this allows you to speed up the start of executable applications (including user ones).
Could this process be a virus?
The process itself is an official Windows component. While it is possible that the virus has replaced the real Service Node
own executable file, this is very unlikely.
If you want to be sure, you can check the base location of the process file. In Task Manager, right-click on any Host process and select the Open file location
.
If the file is located in the C:WindowsSystem32
, you can be sure that this is not a virus. But you can still run a virus scan on your system using one of the free antivirus programs. God saves man, who save himself!
Why does the process load RAM and virtual memory?
But why then does the Svchost.exe (netsvcs) process load Windows 7 memory? The decision to eliminate such a problem will have to be made based on the reasons for such system behavior. Among them, the main ones are the following:
- exposure to viruses masquerading as Svchost.exe processes; malfunctions in the Windows update search and installation tool; accumulation of computer garbage when surfing the Internet; problems with the tunnel adapter; enabled Prefetch service.
It is worth noting that the Svchost.exe (netsvcs) process loads physical memory (RAM and virtual, which uses the space reserved on the hard drive to load program components when there is insufficient RAM). In the simplest case, you can get rid of excessive load by simply restarting the system. But this gives only a short-term effect, as does terminating each process in the same “Task Manager”. Therefore, drastic measures will have to be used.
Removal
For example, you can simply restart the process. More precisely, delete it from the task manager, and then it will start again. This technique helps when a regular reboot turns out to be useless. The reasons may be different - from a system failure to incorrectly installed content. But the fact remains that Svchost.exe netsvcs needs to be removed from the list of tasks to be performed.
Press Ctrl + Alt + Del on your keyboard. Now open the task manager and then go to the Processes tab. Find the line you need here. Ready? Then select it (left-click on the line), and then select the “Finish” command. You will be given a message indicating that the process is irreversible. Agree with him and then confirm your actions. Our process will disappear for a while and then start. If this does not happen for some reason, then you should restart your computer. With the advent of the process, it will be noticeable how everything fell into place. Now the computer's memory will not be fully loaded. But there are other cases. They are not eliminated as easily as we would like.
Check for viruses and malicious codes
First of all, you need to determine the presence of viruses masquerading as Svchost.exe (netsvcs) processes in the system, using their attributes in the “Task Manager”. On running services with a user name, the process description can only contain the attributes Network Service, Local Service or System. If something else is specified (most often Admin), you need to start checking immediately.
In the simplest version, you can use a standard scanner, but in most cases this does not give any results (after all, apparently, the antivirus has already missed the threat). Most experts recommend using independent utilities, among which one of the most powerful is Rescue Disk from Kaspersky Lab. The antivirus can be loaded from a disk or flash drive even before Windows starts, and at the same time it is capable of finding viruses, even those that are very deeply integrated into the system.
What if my internet speed is still slow?
Updating your drivers should always be your option when something goes wrong with your computer or system. Whether you choose to update device drivers manually, using Windows Update, or using a trusted third-party product, it is important that you always have the latest, correct device drivers for your operating system.
If you're not comfortable playing with device drivers, we recommend using Driver Easy . This is a tool that detects, downloads, and (if you're using Pro) installs any driver updates your computer needs.
To update your drivers using Driver Easy, just click Scan Now
, then when the list of drivers that need to be updated appears, click
Update
.
The correct drivers will be downloaded and you can install them - either manually through Windows or all automatically using Driver Easy Pro .
Svchost.exe (netsvcs) uses up memory in Windows 7. Solution: System Update Service
Many experts call problems with the Update Center another common problem. It happens that Svchost.exe (netsvcs) loads the processor (Windows 7) for no apparent reason (as it seems). But there is a reason. The problem is that some updates may have been underloaded, so the system tries to download and install them again and again.
Disabling the search and installation of updates through the Update Center, called from the Control Panel, may not work (even if you set the automatic search mode and offer installation at the user’s discretion). In this case, it is best to use the command line, launched as an administrator, in which three commands are written, followed by pressing the enter key after each of them (for any version of Windows):
- to stop the service - net stop wuauserv; to disable background intelligent transmission - net stop bits; to deactivate delivery optimization - net stop bits.
Rollback
Occasionally, a system rollback may help. True, this option is relevant when the process loads your computer for a short time. In order to perform this action, go to “Start” and select “All Programs” there. Find "Special" and then "Service". In this list you will have to find “System Restore”.
Review the information in the window that appears. For example, you will have to take into account that this process is irreversible. And it cannot be interrupted. Agree with the information, and then select the so-called rollback point. By default, they are created automatically from time to time. Click "Next" and then wait until the process completes. During this period, the computer will reboot itself several times. Don't be alarmed, this is how it should be.
After approximately 30 minutes, the rollback will be completed. And you will no longer have a CPU and memory load on Svchost.exe. You should agree to this action only if you are completely confident that, overall, the system is working normally. Otherwise, your rollback may be critical for your computer.
Terminating related processes
Now let's look at another option for deactivating Svchost.exe processes (netsvcs). How do I disable service-related components? First, you should find out which processes are “attached” to it and are called when the system starts, but are not in the automatic boot menu.
To do this, in the “Task Manager” you need to find all the searched lines containing Svchost.exe (netsvcs), sorting the processes in alphabetical order.
On the selected process, through the right-click menu, you need to go to services using the corresponding line.
Each service can be stopped right here or open the service management section (this can also be done through the program launch menu “Run” (Win + R), where the command services.msc is entered. But this option is somewhat inconvenient only because you have to remember the name of each service, and then look for it in the service tree.
Next, by double-clicking, the settings menu is called up, where the service is either stopped with the corresponding button, or it is assigned a different startup priority or complete shutdown. But you shouldn’t overdo it, because this can disable important system processes, which can negatively affect the operation of the entire OS (up to a failure, after which you will have to restore or so-called rollback to a previous working state).
How to fix the problem
- Just try to close the svchost process that consumes the most RAM. The computer should start working faster, because the CPU load will become much less.
- Disable automatic downloading and checking for updates. To do this, go to Control Panel -> Windows Update -> Settings.
- Next, under “Important updates,” select “Don’t check for updates (not recommended).”
- Look in the task manager to see which user is in front of the svchost.exe processes. There must be “system”, local service, network service. Everything else is viruses. Close the process by right-clicking and selecting End Process Tree. And of course, check the system for viruses with Dr.Web, Kaspersky or another relevant program.
- Delete the folder in the “C:\WINDOWS\Prefetch” directory and restart the computer. It stores data about programs and services that run on the system. In some ways it resembles the “Temp” folder (temporary files). If you delete all information from “Prefetch”, then the necessary information of the program will be written into it again the next time you load Windows 7, and the unnecessary information will simply be deleted.
- Now go to the “Control Panel” and go to the “Administration” section. Then select “Event Viewer”. In the next window, in its left column, find the “Windows Logs” category. Expand its list and double-click the left mouse button on the “Applications” item. Now select “Clear Log” from the left column of the window.
- Do the same with the “Security”, “Installation” and “System” items.
After these steps, your computer should start working faster. The conclusions are as follows: do not enable automatic download of updates, check the operation of the PC after disabling the most resource-intensive svchost process, clear the “Prefetch” folder and the event log
Pay attention on whose behalf the process is running. If the user field contains the name of your PC, this means it’s time to clean your computer of viruses
How can I check differently whether it is a system file or a virus? Just select the heaviest svchost and right-click “Open file storage location”. The “C:\WINDOWS\System32\” directory should open and only that!
However, if you open the “Task Manager” and see that svchost.exe takes up a maximum of 20 - 30 MB of RAM, then this only says one thing: the reason for the slow operation of the system is not at all in it.
Removing computer junk and registry optimization
In some cases, the load on the system from the Svchost.exe (netsvcs) processes may be associated with simple clogging with computer garbage.
Carrying out cleaning on your own is a very troublesome task, so to simplify the work you should use optimizers like CCleaner, Glary Utilities, Advanced SystemCare, in which for scanning you need to mark not only deleting temporary files or clearing the cache, but also enable searching for problems in the system registry and then correcting or deleting incorrect keys and even defragmentation.
What to do if nothing helps
If none of the previously performed procedures brought results, you can try to enhance the effect:
- Roll back the system to an earlier restore point.
- Roll back the system three times in a row. Sometimes this is the only way to get rid of viruses.
- Apply successively several different antivirus programs. It is quite possible that the virus is quite recent, so not all antiviruses can fight it yet.
- Clean your computer from accumulated errors. Using CCleaner or another package with similar functions, you can free the system from temporary files and also tidy up the registry.
- Clear the System Volume Information folder. This system hidden folder, located in the root directory of the system drive, stores information necessary for the recovery service. Sometimes viruses penetrate it.
Troubleshooting tunnel adapter issues
Infrequently, there is a problem with the Teredo tunnel adapter. At the same time, even some of its controls may simply freeze. The way out of this situation is to disable the corresponding protocol (especially if it is enabled by default but not used). To deactivate it, you need to run the command line with administrator rights and enter two commands: netsh interface ipv6 set teredo disable and netsh interface teredo set state disable, and after executing them, reboot the computer terminal.
Checking the status of the SuperFetch service
Finally, another global problem, although partially related to Svchost processes, is the activated service for remembering frequently used programs and applications to optimize or speed up their launch, which is called SuperFetch.
You can disable this component through the service management section (services.msc) by selecting the desired startup type, or perform similar actions in the system registry, which is not very convenient.
But it is believed that the simplest method of reducing the load on system resources in relation to this particular service is to delete the Prefetch folder, which is located in the Windows root directory in the system partition. After this, you can terminate all Svchost processes in the standard Task Manager and perform a full restart of Windows.
Where did he come from?
Svchost is a system service introduced by Microsoft professionals not many years ago. Before this, it performed the functions of ensuring a correct network connection and connecting to the Internet, which had nothing to do with launching applications and programs. After this, specialists from Silicon Valley considered that this was not enough for the Svchost process, and assigned it the responsibility of speeding up the launch of various programs, which led to unintentional loading of Windows memory. It didn't turn out very well, to put it mildly. And yet, the fight against excessive load is possible.
Results
What can be said about the processes considered if we sum up some results and draw conclusions? Among the main reasons causing increased use of system resources, and especially in Windows 7, the main ones are problems with the impact of viruses, failures in the update service and the SuperFetch service. But this situation in most cases occurs on low-power computers that are too weak to simultaneously support the optimization of running a large number of resource-intensive programs. And, what’s most interesting, most often it’s not the processor that takes the brunt of it, but the RAM, the use of which in some cases can reach one hundred percent. The lack of RAM capacity leads to the fact that the system begins to actively use virtual memory (hard disk space), which leads to a significant slowdown when accessing the hard drive. As for solving this problem, you should use each of the above methods. But you will have to be extremely careful not to terminate some systemically important process (although in this case a spontaneous reboot with recovery may simply follow). But the SuperFetch component should not be disabled on modern machines with large amounts of RAM and powerful processors. This solution is applicable only in the case of outdated computer equipment.
