Svchost.exe using 50% of cpu

[hedera]

I've seen several threads on cases where SVCHOST.EXE was using 100% of CPU.
Has anyone see it use 50% of CPU?? I have a WinXP Pro system, updated using
automatic Windows Update, running ZoneAlarm Internet Security Suite which
checks for both viruses and spyware weekly. Earlier this week I also updated
SpyBot and LavaSoft AdAware Personal, and ran both of them. I'm behind a NAT
router.

Yesterday I noticed that 1 of my multiple SVCHOST.EXE processes was using
50% of CPU - I'm sensitive to CPU because I run BOINC for Rosetta@home and I
expect BOINC to be using 95% of CPU.

It's still doing this today, and I checked it during boot before Rosetta
started, and it was using 50% CPU then when it had no competition. This is
forcing Rosetta down to 45-50% of CPU and limiting the work I can do for
them. Following a suggestion here, I downloaded and ran ProcessExplorer, but
it just says that copy is:

SVCHOST.EXE SVCHOST.EXE 328 50.00 Generic Host Process for Win32
Services Microsoft Corporation

Can somebody help here?? I'm hoping I don't have a virus.

 

[John Wunderlich]

I've seen several threads on cases where SVCHOST.EXE was using
100% of CPU. Has anyone see it use 50% of CPU?? I have a WinXP
Pro system, updated using automatic Windows Update, running
ZoneAlarm Internet Security Suite which checks for both viruses
and spyware weekly. Earlier this week I also updated SpyBot and
LavaSoft AdAware Personal, and ran both of them. I'm behind a NAT
router.

Yesterday I noticed that 1 of my multiple SVCHOST.EXE processes
was using 50% of CPU - I'm sensitive to CPU because I run BOINC
for Rosetta@home and I expect BOINC to be using 95% of CPU.

It's still doing this today, and I checked it during boot before
Rosetta started, and it was using 50% CPU then when it had no
competition. This is forcing Rosetta down to 45-50% of CPU and
limiting the work I can do for them. Following a suggestion here,
I downloaded and ran ProcessExplorer, but it just says that copy
is:

SVCHOST.EXE SVCHOST.EXE 328 50.00 Generic Host
Process for Win32 Services Microsoft Corporation

Can somebody help here?? I'm hoping I don't have a virus.

There can be several "svchost.exe" programs running. In process
Explorer, hover your cursor over the svchost.exe that is consuming the
CPU. A pop-up window will list the services connected to that item.
Then,
start->run->services.msc
and find the service(s) listed and try to stop them one-by-one by
right-clicking on them and selecting "stop". It shouldn't take too
long to find the one using the resources.

HTH,
John

 

[hedera]

Pardon me while I go stick a couple of pins in my voodoo doll labeled
"Hewlett Packard." The mouse hover trick discloses that this instance is
doing just one thing: HP NETWORK DEVICES SUPPORT.

Key fact here: we recently bought an HP Photosmart C7280 all-in-one printer,
at least partly so we could have a networked printer. Guess it's time to go
talk to HP about why their device driver upgrade is eating my CPU. Must be a
recent change because we've had the thing for a month or so and I only
noticed this yesterday.

 

[Gerry]

Download Process Explorer.

For further information about Process Explorer see here:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[PA Bear [MS MVP]]

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[hedera]

Gerry,
Certainly, here is the command line call:

C:\WINDOWS\system32\svchost.exe -k HPService

And by the way, what a wonderful tool is ProcessExplorer!!