SVCHOST.EXE hogs my CPU

[Mermaidman]

Once every few days, when I boot up my computer and log into WinXP Pro, SVCHOST.EXE would tie up my CPU at 99%. There are a few SVCHOST.EXE processes, but only one is at 99%. In order to resolve the issue, I have to force a shutdown (i.e. press the power button) and then restart. If I do a normal shutdown and restart, the problem remains. Again, on the occasions that this problem occurs, it's only when I boot up; it never crops up when I'm in the middle of using the PC.

How do I find out what program is causing this?

Why am I able to make it go away by forcing a shutdown?

Can it be a CPU hardware problem? I say this because the computer makes a loud "motherboard" beep sometimes. Temperatures are fine.

Someone suggested it was spyware or virus, but the harddrive is clean.

Off to dinner. Hope to see some suggestions when I'm back t.i.a.

 

[4dm]

what happens if you try to end the svchost.exe task from task manager? does it give you a force shutdown screen?

 

[DetroitSportsFan]

Can you check to see what folder your svchost.exe file is in? That file should reside in the system32 folder. If you find it elsewhere, its something up to no good.

 

[Archman]

Well, after doing a search I found it in three places on my system:

C:\i386
C:\Windows\system32
C:\Windows\ServicePackFiles\i386

I noticed that I usually have 4 svchost.exe things running in the task manager

ideas?

 

[mechBgon]

You might try a quick online antivirus scan at Housecall or Panda, and also...

1. ...make a folder C:\HJT on your hard drive
2. Download Hijack This, there's a link in DetroitSportsFan's signature there, and extract hijackthis.exe from the Zip file into your C:\HJT folder, and run it.
3. Hit the Save log button and save the log from the Hijack This scan, then post it here for an analysis.

Bigger picture: how's your system security? You might look at the Ongoing prevention suggestions on my page here. I'll bet a there's at least one "best practice" there that you aren't up to speed on

 

[Archman]

well, I use Panda and have been for a year without any issues. Suddenly though, the scans will not work on my system.

When I do a scan of my 'C:' drive it just scans the first 6 files in the boot sector, and then says the scan is complete... it does not go on to scan the rest of the hard drive.

Any ideas? I was perplexed, and went to trend micro to do an online scan (shut down panda) and the online trend micro scan caught two viruses. Panda is updated daily.. so I am a little lost as to what is wrong with panda now.

I did a HJT log and posted it to a forum, and my system is clean... I am so frustrated with all the issues my PC is giving me lately from all the Malware, Spyware, and Viruses out there that the Apple powerbooks are starting to really appeal to me... not sure.

I try to keep on top of everything with As-Aware, Spybot, and Spyblaster... but this malware just seems to be rapidly out pacing viruses for problems on PCs now a days

 

[DetroitSportsFan]

Originally posted by: Archman
Well, after doing a search I found it in three places on my system:

C:\i386
C:\Windows\system32
C:\Windows\ServicePackFiles\i386

I noticed that I usually have 4 svchost.exe things running in the task manager

ideas?

I'm puzzled .... why do you have a C:\i386 folder? Thats not a typical location for it.

Maybe you have a logical explaination .... but without one, I'd be wondering about i386 at C:

 

[tshock22]

Originally posted by: Archman
Well, after doing a search I found it in three places on my system:

C:\i386
C:\Windows\system32
C:\Windows\ServicePackFiles\i386

I noticed that I usually have 4 svchost.exe things running in the task manager

ideas?

Svchost is the process that manages execution of your enabled services in windows. Multiple svchost's are ok to run and can show processor usage for any of the services running under them......ie, tough to pinpoint the actual culprits.

 

[mechBgon]

Originally posted by: Archman
well, I use Panda and have been for a year without any issues. Suddenly though, the scans will not work on my system.

When I do a scan of my 'C:' drive it just scans the first 6 files in the boot sector, and then says the scan is complete... it does not go on to scan the rest of the hard drive.

Any ideas? I was perplexed, and went to trend micro to do an online scan (shut down panda) and the online trend micro scan caught two viruses. Panda is updated daily.. so I am a little lost as to what is wrong with panda now.

What two viruses exactly? Has Panda been running with all its options enabled (such as using heuristics, scanning within compressed files, no exceptions to the scan)? Was there a "include subfolders" checkbox to make the C:\ scan include all the folders on C:\ as well, perhaps?

I've found that most antivirus software needs a thorough configuration before it's really set up to play hardball, so maybe take another run through Panda's menus and make sure. Also make sure it's scanning the hard drives periodically (daily gets my vote) to catch stuff that arrived infected before the definitions were able to detect it.

 

[djpolstee]

Working at a IT on a Univ, we have seen a couple virii that infect svchost.exe . In a command prompt do a netstat -an and see if you have any weird, high numbered ports open. Then use this prog fport to see what apps are using those ports. If your svchost.exe is using the odd ports, then theres some virii that you need to investigate.

 

[Archman]

Originally posted by: mechBgon
What two viruses exactly? Has Panda been running with all its options enabled (such as using heuristics, scanning within compressed files, no exceptions to the scan)? Was there a "include subfolders" checkbox to make the C:\ scan include all the folders on C:\ as well, perhaps?

I've found that most antivirus software needs a thorough configuration before it's really set up to play hardball, so maybe take another run through Panda's menus and make sure. Also make sure it's scanning the hard drives periodically (daily gets my vote) to catch stuff that arrived infected before the definitions were able to detect it.

There were two trojans, I think I saved the file log somewhere (I will have to dig for it).

Panda was working perfectly for several months, it is just within the last few couple of months that I noticed it doesn't scan properly anymore, and I did not make any changes to Panda what so ever. The only thing I noticed is several programs no longer worked properly after XP SP2... I did configure Panda to play hardball, and it worked great, until I was up late one night and noticed the scan only scanning the boot sector and nothing more. I went in to check the settings, and everything was the same as it was before... again the only major change to my system in the last couple of months was XP SP2 being added.

Panda is set up to do a daily scan at about 2:30 am Pacific Time when I am asleep, and the computer is not busy. Still, Panda only scans the boot sector and 6 files.

I am stumped on this one.

djpolstee thanks for the heads up, will check it out and get back to you on that one

 

[Jeff7]

I've found that most antivirus software needs a thorough configuration before it's really set up to play hardball, so maybe take another run through Panda's menus and make sure. Also make sure it's scanning the hard drives periodically (daily gets my vote) to catch stuff that arrived infected before the definitions were able to detect it.

I hate how the programs do that - disable so many of the thorough searches, like only scanning executable files, and having heuristics disabled. I imagine they do it to make their product look faster than the rest.

 

[mechBgon]

Originally posted by: Jeff7

I've found that most antivirus software needs a thorough configuration before it's really set up to play hardball, so maybe take another run through Panda's menus and make sure. Also make sure it's scanning the hard drives periodically (daily gets my vote) to catch stuff that arrived infected before the definitions were able to detect it.

I hate how the programs do that - disable so many of the thorough searches, like only scanning executable files, and having heuristics disabled. I imagine they do it to make their product look faster than the rest.

Hehe, yep The last time I installed McAfee's home stuff, it didn't do too badly, so maybe there's hope.

Mermaidman, how about this: select all the contents of C:\ and then right-click them and have Panda scan them, then and there, and see if it gets to their insides that way. Not a true solution, but it'll get your files scanned (maybe). Or try an online antivirus scan with TrendMicro Housecall's or Panda's free online scanners perhaps.

 

[Archman]

Still, is there any reason why when it scans my C: drive that it just scans the boot sector and then skips the rest of the HD?

I've played with all the settings, and as far as I am concerned methinks that XP SP2 had a hand in changing the way a few programs work on my system

 

[JackMDS]

The issue is Not svhost; svhost is a Windows service that is essential to Windows operation.

You probably have some ?Junk? that uses it.

Log to this page there is a description of a tool that can help you ID the culprit (middle of the page Process Explorer) as well as other info concerning Internet ?Junk?.

Link to: Internet infestation -Or, how you are getting Internet "Junk" in and compromise your Computer/Network?

Link to: Basic Steps in cleaning Internet "Junk".

:sun:

 

[Jynx980]

Great site for Windows XP services.

 

[Maskclone2k]

Hey Archman, I have the same problem with Panda. I had Platinum 7.0 and started to have the problems with that version. So I thought I would upgrade to the new 2005 solution, Panda Internet Security 2005. Well everything went ok, first full system scan and all (scanned all drives every file). However, now the new version is giving me the same problem, it only scans the boot sector and some random files. I noticed that in the exclusions area of the settings that the directories of all my drives are listed. So I remove them close the settings window and open it again and the directories are back in the exclusions area! Even using the Defualt settings provided by the Defualt button it won't work! I emailed Panda about this....let's see how long it takes for a response.