svchost.exe uses all system resources

[hans]

svchost.exe uses alot of system resource on my other computer (with XP Pro
SP1), so that it cannot be used anymore. I thought it might be a virus, but
I Norton Antivirus is installed and it said nothing. What do you recommend
to do?

I tried killing the svchost.exe process, but there are many of them. If I
kill them all, XP shuts down the system. svchost.exe has something to do
with Remote Procedure Calls, but is it really necessary?

thanks in advance.

 

[Carey Frisch [MVP]]

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

What is svchost, and why is there more than one copy running?
http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html

Why does svchost access the internet?
http://ask-leo.com/why_does_svchost_access_the_internet.html

Download Ad-aware SE and scan your PC for the presence of spyware:
http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

Symantec Security Check
http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/?id=827315

Dealing with Unwanted Spyware and Parasites
http://www.mvps.org/winhelp2002/unwanted.htm

--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User

Be Smart! Protect Your PC!
http://www.microsoft.com/athome/security/protect/default.aspx

--------------------------------------------------------------------------

:

| svchost.exe uses alot of system resource on my other computer (with XP Pro
| SP1), so that it cannot be used anymore. I thought it might be a virus, but
| I Norton Antivirus is installed and it said nothing. What do you recommend
| to do?
|
| I tried killing the svchost.exe process, but there are many of them. If I
| kill them all, XP shuts down the system. svchost.exe has something to do
| with Remote Procedure Calls, but is it really necessary?
|
| thanks in advance.

 

[David H. Lipman]

1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (personal free version)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download sysclean.com and place it in that directory.
Dowload the signature files (pattern files) by obtaining the ZIP file.
For example; lpt202.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adware with the latest definitions.
3) If you are using WinME or WinXP, disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) If you are using WinME or WinXP, create a new Restore point
10) Please report back your results

Dave






"hans" <v> wrote in message | svchost.exe uses alot of system resource on my other computer (with XP Pro
| SP1), so that it cannot be used anymore. I thought it might be a virus, but
| I Norton Antivirus is installed and it said nothing. What do you recommend
| to do?
|
| I tried killing the svchost.exe process, but there are many of them. If I
| kill them all, XP shuts down the system. svchost.exe has something to do
| with Remote Procedure Calls, but is it really necessary?
|
| thanks in advance.
|
|
|
|
|

 

[Rick \Nutcase\ Rogers]

Hi Hans,

Open Windows Explorer to this folder:

C:\Windows\system32\wins

Is there a copy of svchost.exe here? If so, then you are infected with a
virus. This page explains it:
http://www.pchell.com/virus/welchia.shtml

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org