J WILSON asked on March 18, 2013. Status: Answered & Closed.
Mcbuilder.exe And Svchost.exe(CryptSvc) Using 50% Respectively
» Currently both the mcbuilder.exe and the svchost(cryptSvc) are stuck at 50% each, using 100% of the CPU. With the process monitor tool from sysinternals the mcbuilder.exe operation is only Process Profiling, the svchost which is also hosting the workstation, DNS Client, Network Location Awareness and Remote desktop services appear to be opening and closing numerous Cryptography keys in the registry.
Mcbuilder.exe is a Windows file created by Microsoft Corporation. The file is usually found in C:\Windows\system32 folder. If you find it anywhere else, Please note that mcbuilder.exe could be a virus(Exploit:HTML/IframeRef.EC), trojan, worm, or spyware. The location of the file can vary in different Windows versions or languages. This is an executable file. You can find it running in Task Manager as the process mcbuilder.exe.
"Svchost.exe" (Generic Host Process for Win32 Services) is an integral part of Windows OS. It cannot be stopped or restarted manually. This process manages system services that run from dynamic link libraries (files with extension .dll). Examples for such system services are: "Automatic Updates", "Windows Firewall", "Plug and Play", "Fax Service", "Windows Themes" and many more.
At startup, Svchost.exe checks the services portion of the registry and constructs a list of services that it needs to load. Under normal conditions, multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.
If the process svchost.exe uses high cpu resources, it is mostly due because the service "Automatic Updates" is downloading some new Windows update. But having a 99% or 100% cpu usage could be caused by downloads due of some hidden malware on your computer. Some malware like the Conficker worm changes the Windows Registry so that svchost loads the malware .dll file. In this case you only see the authentic svchost.exe process in the task manager!
n case of virus infection, you can use DLL Suite to clean the aftermath caused by the virus removal, and fix the associated dll errors. It can also be use for free download of any missing dll files for your convenience. It contains a large dll file library, which is safe and clean with the professional protection against any malicious attack.
TL AUMAN replied on March 24, 2013
- RIKKI HURSTON replied on March 18, 2013: » First, I suggest you to perform a Clean boot to check if any third party applications is causing this issue.
Perform a clean boot: Log on to the computer by using an account that has administrator rights.
1. Click Start, type msconfig.exe in the Start Search box, and then press ENTER to start the System Configuration Utility. If you are prompted for an administrator password or for confirmation, type your password, or click Continue.
2. On the General tab, click Selective Startup, and then click to clear the Load startup items check box. (The Use Original Boot.ini check box is unavailable.)
3. On the Services tab, click to select the Hide all Microsoft services check box, and then click Disable all.
4. Click OK, and then click Restart.
After you have finished troubleshooting, follow these steps to reset the computer to start as usual:
1. Click Start, type msconfig.exe in the Start Search box, and then press ENTER. If you are prompted for an administrator password or for confirmation, type your password, or click Continue.
2. On the General tab, click the Normal Startup option, and then click OK.
3. When you are prompted to restart the computer, click Restart.
- J WILSON replied on March 18, 2013: » Thank you for your reply. I completed a clean boot as you instructed. I then started a backup and again it "Froze" at 15% and failed. If I kill the SVCHOST process tree that is hosting the CryptSvc service when the backup is froze and priro to it failing the backup will succeed. I've also had issues with program installs where they "freeze" but if I kill the SVCHOST that is hosting CryptSvc they will then continue to success.
- WAYNE SMITH replied on March 19, 2013: » I was also having this same problem. I thought it was comodo antivirus so switched to avast, but had the same problem manifest itself. Until I realised when I did a search for mcbuilder.exe, it was listed in a few places including a recursive listing of "application data" i.e "C:\users\username\application data\application data\application data..........."
What had happened sometime was the permissions of application data had been replaced allowing it to be opened like a normal folder, when it's meant to be access denied as the folder that actually contains your application data is located at "C:Users\username\AppData\Roaming" and the other link is provided for backwards compatability.
Anything trying to access the wrongly permissioned shortcut is going to enter an infinite loop trying to scan things inside, which is why these programs are trying to consume the entire processor and generate lots of hard drive activity.
FIX:- Deleting the application data shortcut fixed this as windows recreated a new link with permission denied on the new link which stops it from being accessed via normal activity.
- CHRISTOPHER MANDELL replied on March 21, 2013: » I have the EXACT same problem. I had assumed it was the NLA (Network Location Awareness) doing it, but upon reading this, I agree, it's CryptSvc, at least it appears so. I've had this problem for quite some time now, and any time I try to install something, I have to wait with the Task Manager open, watch for the svchost.exe process to hop to the top, and end it, else it simply prevents the install from continuing. Please, this has become very frustrating, and time consuming. If a bugfix is needed, please, tell me where I can get it.
- BARBARA BUTLER replied on March 23, 2013: » I kept the firewall part of comodo when switching anti-virus, and later on I have found out that the defence+ part of it which was ticked as being fully disabled still has effects on programs (I was using vmware player and adding exceptions to the disabled defence+ portion of comodo fixes the issue).
I have removed comodo fully now and have not experienced this problem since. Just using MS firewall for now, since I am behind a nat based firewall in my router anyway.
You may be able to fix this problem by adding exceptions for mcbuilder and svchost to comodo if you don't want to uninstall it. I just didn't want a program on my system that lies when it says it's disabled.
DLL Q & A You Might Like:
- Atbroker.exe Error »
- Keep Or Remove Jucheck.exe »
- Svchost.exe Problem With CPU Usage »
- Dwm.exe System Error During Startup »
- NMIndexStoreSvr.exe Stealing Focus From Other Apps »
- Problem With High Cpu Usage And Audiodg.exe »
- Windows Keeps Creating Srvchost.exe Files »