svchost.exe taking up 100% of systme resources

[Doug T]

About a week or so ago, I started having problems with
one of the svchost.exe processes taking up 100% of the
system resources. This causes the pc to run slowly and
certain things don't work how they are supposed to. I
have tried every virus scan and spyware removal tool
known man and have found nothing. Here is the
tasklist/svc, any alarms?

Image Name PID Services
========================= ======
=============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 760 N/A
csrss.exe 836 N/A
winlogon.exe 860 N/A
services.exe 904 Eventlog, PlugPlay
lsass.exe 916 Netlogon, PolicyAgent,
ProtectedStorage,
SamSs
svchost.exe 1092 RpcSs
svchost.exe 1240 AppMgmt, AudioSrv,
Browser, CryptSvc, Dhcp,
dmserver, ERSvc,
EventSystem, helpsvc,
HidServ, lanmanserver,
lanmanworkstation,
Messenger, Netman, Nla,
RasMan, Schedule,
seclogon, SENS,
SharedAccess,
ShellHWDetection,
srservice, TapiSrv,
TermService, Themes,
TrkWks, uploadmgr,
W32Time, winmgmt,
wuauserv, WZCSVC
svchost.exe 1492 Dnscache
svchost.exe 1524 LmHosts, RemoteRegistry,
SSDPSRV, WebClient
spoolsv.exe 1796 Spooler
alg.exe 1936 ALG
ati2evxx.exe 1952 Ati HotKey Poller
svchost.exe 1976 BthServ
gearsec.exe 2012 GEARSecurity
AppServices.exe 372 Iomega App Services
McShield.exe 428 McShield
myAgtSvc.exe 460 myAgtSvc
svchost.exe 596 stisvc
explorer.exe 340 N/A
Apoint.exe 456 N/A
atiptaxx.exe 784 N/A
rundll32.exe 1152 N/A
Switcher.exe 1300 N/A
HKServ.exe 1340 N/A
ezSP_Px.exe 1360 N/A
tgcmd.exe 1284 N/A
NtsAgent.exe 1224 N/A
HKWnd.exe 1632 N/A
Sktempdm.exe 1424 N/A
iTunesHelper.exe 1712 N/A
SKDAEMON.EXE 1872 N/A
iPodService.exe 2064 iPodService
Imgicon.exe 2072 N/A
hpcmpmgr.exe 2096 N/A
hpwuSchd2.exe 2104 N/A
WCESCOMM.EXE 2112 N/A
PcfMgr.exe 2216 N/A
ApntEx.exe 2228 N/A
SKSMAILD.EXE 2536 N/A
hptskmgr.exe 2752 N/A
myAgtTry.exe 3992 N/A
WCESMGR.EXE 2340 N/A
nlnotes.exe 2768 N/A
ntaskldr.exe 2700 N/A
Acrobat.exe 3476 N/A
AOM.exe 3528 N/A
act.exe 1748 N/A
POWERPNT.EXE 1700 N/A
WINWORD.EXE 2916 N/A
IEXPLORE.EXE 3644 N/A
cmd.exe 4080 N/A
tasklist.exe 3184 N/A
wmiprvse.exe 3608 N/A


Any ideas?? Thanks.

 

[Chuck]

About a week or so ago, I started having problems with
one of the svchost.exe processes taking up 100% of the
system resources. This causes the pc to run slowly and
certain things don't work how they are supposed to. I
have tried every virus scan and spyware removal tool
known man and have found nothing. Here is the
tasklist/svc, any alarms?

<SNIP Tasklist>

Doug,

Which svchost.exe process is taking up cpu? 1092, 1240, 1492, 1524 (of course
the pid may have changed, so you'd need to repeat the list).

Which spyware tools did you try?

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Guest]

-----Original Message-----


<SNIP Tasklist>

Doug,

Which svchost.exe process is taking up cpu? 1092, 1240, 1492, 1524 (of course
the pid may have changed, so you'd need to repeat the list).

Which spyware tools did you try?

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
.

Thanks for the response.

It looks as though this is the problem child:

svchost.exe -1528- LmHosts, RemoteRegistry, SSDPSRV,
WebClient

As far as the spy ware removal, I have ran ad aware,
spybot search and destroy and a couple others that I
don't remeber the names of. I removed them after using
them because I think some of them will interfere with
each other. Are there any that you'd recommend?

 

[Chuck]

Thanks for the response.

It looks as though this is the problem child:

svchost.exe -1528- LmHosts, RemoteRegistry, SSDPSRV,
WebClient

As far as the spy ware removal, I have ran ad aware,
spybot search and destroy and a couple others that I
don't remeber the names of. I removed them after using
them because I think some of them will interfere with
each other. Are there any that you'd recommend?

SSDPSRV. Try turning off SSDP Discovery Service (Control Panel - Administrative
Tools). I had to do that with my XP systems.

AdAware and Spybot complement each other. As long as you don't try to run them
at the same time, it's perfectly OK to leave them installed. I run both a
couple times weekly. And HijackThis at least monthly.

But there are other tools which you should know about.

First, download LSP-Fix and WinsockXPFIx from <http://www.cexx.org/lspfix.htm>,
and CWShredder from <http://www.majorgeeks.com/download4086.html>. All are
free.

Next, close all Internet Explorer and Outlook windows, then run CWShredder.
Have it fix all variants.

Now check for, and remove, spyware. Get HijackThis
<http://www.majorgeeks.com/download.php?det=3155>, also free.
1) Install and run HijackThis. Do NOT make any changes immediately. Save the
HJT Log.
2) Have your HJT log interpreted by experts at one or more of the following
forums (and post it here):
<http://forums.net-integration.net/>
<http://www.spywareinfo.com/forums/>
<http://forums.tomcoyote.org/>
<http://www.wilderssecurity.com/>

If removal of any spyware affects your ability to access the internet (some
spyware builds itself into the network software, and its removal may damage your
network), run LSP-Fix and / or WinsockXPFIx.

Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.