svchost.exe high cpu usage

[Ankur]

The svchost.exe is always running with 95% plus CPU
usgage all the time. After trouble shooting following
Microsoft Help and Support I found that Remote Procedure
Call (RPC) is the Service which is responsible for it.
I came to this conclusion as the Process ID number of the
svchost from the task manager is the same as the PID
number of it from command promt tasklist /svc

Please help me understand why is this service churning up
the CPU all the time and what can I do to fix this
problem.
Thanks
Regards
Naina

 

[Rick \Nutcase\ Rogers]

Hi Naina,

One possibility is that you are infected with a virus, possibly welchia,
msblaster or lovesan. It creates a "fake" svchost.exe file under
C:\Windows\system32\wins. If you have this directory and that file in it,
you are most likely affected. Information:

http://www.pchell.com/virus/welchia.shtml
http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://vil.nai.com/vil/content/v_100499.htm
http://www.symantec.com/avcenter/venc/data/w32.blaster.worm.html
http://www.bigblackglasses.com/Article.aspx?Article=342

You need the patch described here to protect against it:

MS03-039: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious
Programs
http://support.microsoft.com/?kbid=824146

Problem is, you needed to install the patch BEFORE you got infected to avoid
it.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!

Associate Expert - WinXP - Expert Zone