svchost question

[Guest]

About 2 weeks ago many of our Clients starting experiencing computer
slowdowns, lockups, Outlook freezing etc. When I look at the process
running on these problematic computers, svchost is always taking up at least
100MB of memory... The services it is controlling are

AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
EventSystem, helpsvc, HidServ, lanmanserve
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, ShellHWDetection
TapiSrv, Themes, TrkWks, W32Time, winmgmt,
wuauserv

The only thing new in our environment is WSUS and configuring a few users to
the newly revived Microsoft Update ...

Has anyone seen any issues surrounding these services that might explain
what is happening in our environments... this is an issue that is being seen
in numerous locations and more than one domain...

Thanks in advance

 

[Guest]

First I'd suspect a virus.

Next, not all of the services running are familiar to me. I'd suggest
downloading the free program Process Explorer from
http://www.sysinternals.com This program will let you see what's going on
underneath the hood of svchost.exe.

As a last resort, you can terminate the services running under that svchost
process one by one (it's easy to do with Process Explorer) in order to
isolate the culprit.

- John

 

[Guest]

thanks usasma...

I did as you suggested a wk ago but was unable to find the culprit... We run
a corporate version of Trend Micro so I'd be surprised if it didn't find a
virus on at least one of these machines... I'll research this further but I
still have a feeling from various reports I've read that it has something to
do with Windows update

thanks.

 

[Chuck Davis]

CJZ,

Check closely, a malware process named scvhost does exist. Notice the slight
difference in spelling. svchost is correct.

 

[Guest]

thank you ... I confirmed that it was not malaware. What is happening is and
it's happening on my computer at the moment too is svchost is growing .. if I
leave my computer on without rebooting it will continue to grow until my
machine bogs down making a reboot necessary.

tasklist /svc, process analyzer and autoruns have been used to look into
this issue to no avail.