Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running Windows Server 2003 Standard (Much to my distaste), I've applied all the security updates and now I'm stuck with a box that's constantly being hammered by svchost.

The process ID is always around the 700 mark and if I use tasklist /svc, I can see that RpcSs is causing it.

I have tried various things that have come up in google searches such as turning automatic software update services off, removal of antivirus software, removal of systray items, removal of remote screen services such as RDP, VNC, LogMeIn etc.

I'm still stuck with this RpcSs running at 90%, I'm completely at the end of my tether with this now but I don't really want to sit through a complete re-install just to see if it happens again.

share|improve this question
To clarify - are you saying the CPU hammering started after the updates were applied? – Chris Feb 1 '11 at 20:41
Yep. Can't pinpoint which one though as I performed a few software updates one after the other. You know, download-install-restart, check for more updates, goto 0 – Squeeb Feb 2 '11 at 8:53
up vote 2 down vote accepted

You might try using the Sysinternals tools Process Explorer and Process Monitor. For example, in Process Explorer - select the relevant svchost.exe instance, right click and choose properties and then go to the Threads tab. You may see a dll name in there that gives you a clue.

share|improve this answer
+1 Great tools And free! – Dave M Feb 1 '11 at 21:33
Thanks, I'll give this a try :) – Squeeb Feb 2 '11 at 8:53

I have seemn some malware use this process and we had to use a bootable disk with the Syamantec Endpoint Recovery Tool and current defs to remove. It was some kind of rootkit that slipped by the installed AV.

share|improve this answer
we tried this, but there was nothing to remove. It was clean. – Squeeb Feb 1 '11 at 19:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.