SVCHOST.EXE High Utilization

[Guest]

I'd like to ask for some troubleshooting assistance on an unusual problem I
have with one of my users.

I have a user that was reporting her system bogging down and hanging up.
When I got there and looked at the Task Manager utilization was pegged at
100% and stayed there. Looking at the Processes tab there was one process
holding utilization at max, SVCHOST.EXE. I couldn't kill it so I downloaded
SysInternals Process Explorer to see what the service in question was up to.
It was not linked to any other process and, looking at the DLLs and Handles
it appeared it was attached to the network adapters and Internet traffic.

I tried killing the process from here and immediately received the diallog
box indicating that the RPCSS service ended unexpectedly and the system would
restart. Once the system restarted, the problem was gone.

We've already scanned the system and it's completely clean of any virus'
Spyware or Malware.

Does anyone out there have some tips on getting a better handle on what is
causing the high utilization or on what might fix it? It's starting to
frustrate the user and I'm stumped.

Thanks in Advance
Ray Beckwith
Network Administrator
California Credit Union League

 

[Guest]

This is most often a result of a virus, usually the blaster worm. Make sure
your virus definitions are up to date, and then scan again. Also, make sure
the computer has all patches from windows update.

 

[David Probett]

You may be right about the Blaster worm in some circumstances but I
get this problem after the PC has been on constantly for more than
(say) 4 or 4 days.

The PC is virus scanned daily and Pest Patrol and Ad-Aware run every
couple of days. All updates are invariable installed within a couple
of days of release.

FreeRAM Pro releases 'frozen' RAM every 15 minutes.

It seem as id 'something' get bogged down or 'full'. and only a forced
'power off' (using the 'Off' switch can cure it.

DavidP

This is most often a result of a virus, usually the blaster worm. Make sure
your virus definitions are up to date, and then scan again. Also, make sure
the computer has all patches from windows update.

David Probett
(e-mail address removed)