SVCHOST taking up to 99% CPU

[Guest]

When I turn on the computer one of the copies of svchost takes over and
starts using up to 99% of the CPU. There is, of course, a virus that attaches
to this process and starts spinning wheels and makes the use of the computer
impossible. All I can do is to press the “end process†button in Task
Manager. The result is that then I can use the computer but I loose the use
of sound.
I have used Pc-cillin, Spyware, McCafee, Ad-aware to scan my computer and
all of them say my computer does not have a virus.
Is there a way to intercept the loading of processes and figure out what is
and where this parasite is? So far deleting all cookies, deleting all
Internet temporary files, deleting the MRU list does not produce any results.
I will appreciate any help very much.

Al

 

[R. McCarty]

Svchost instances have "Bundled" internal member services. You can
examine what runs in each by opening a command prompt and type
Tasklist /Svc
( usually the list extends beyond a page of text, so best to view in a
window size of at least 50 lines ).
Each SvcHost entry will show it's PID (Process ID) using that info
you can monitor TaskMgr to see which SvcHost is "Hogging" the CPU.
On most XP instances you'll have one SvcHost that contains a number
of internal services such as Browser, W32Time which consumes
around ~22Megabytes of memory.
You can edit the Services table of the Registry to set member services
to a Start mode of 4 (Disabled).

Not easy, certainly a Sherlock Holmes level PC investigation.

 

[db]

seems you are like the
fifth posting on this file
issue. obviously it is a
result of an update or
something...

try renaming the file to
something like svchost.bak

seems that renaming it
solves the issue at hand...


When I turn on the computer one of the copies of svchost takes over and
starts using up to 99% of the CPU. There is, of course, a virus that attaches
to this process and starts spinning wheels and makes the use of the computer
impossible. All I can do is to press the “end process†button in Task
Manager. The result is that then I can use the computer but I loose the use
of sound.
I have used Pc-cillin, Spyware, McCafee, Ad-aware to scan my computer and
all of them say my computer does not have a virus.
Is there a way to intercept the loading of processes and figure out what is
and where this parasite is? So far deleting all cookies, deleting all
Internet temporary files, deleting the MRU list does not produce any results.
I will appreciate any help very much.

Al

 

[R. McCarty]

Svchost.exe is a module protected by Windows File Protection.
If you move/rename or delete it - XP quietly replaces it automatically.

"db" <databaseben.discussions.microsoft.com> wrote in message
seems you are like the
fifth posting on this file
issue. obviously it is a
result of an update or
something...

try renaming the file to
something like svchost.bak

seems that renaming it
solves the issue at hand...


"Computer logon password"
When I turn on the computer one of the copies of svchost takes over and
starts using up to 99% of the CPU. There is, of course, a virus that
attaches
to this process and starts spinning wheels and makes the use of the
computer
impossible. All I can do is to press the "end process" button in Task
Manager. The result is that then I can use the computer but I loose the
use
of sound.
I have used Pc-cillin, Spyware, McCafee, Ad-aware to scan my computer and
all of them say my computer does not have a virus.
Is there a way to intercept the loading of processes and figure out what
is
and where this parasite is? So far deleting all cookies, deleting all
Internet temporary files, deleting the MRU list does not produce any
results.
I will appreciate any help very much.

Al

 

[Uncle Grumpy]

Tasklist /Svc

Why doesn't my system accept "tasklist" as a command?

 

[R. McCarty]

XP Home edition doesn't include the executable file Tasklist.Exe.
There are however, free downloadable alternatives for getting the
information that Tasklist provides.

 

[Jim Byrd]

Hi CLP - How knowledgable about doing things are you? Do you know how to
start and stop services? How to run a .cmd file? If not, you'll need
access to someone who does to avoid problems. The following assumes you're
on Windows XP but will probably work OK for Win2k as well. If you're
confident about what you're doing, then try the following first - only if it
doesn't work, then there's another level of stuff that can be done
following:

1. Stop and Disable Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.
2. Rename the folder %SystemRoot%\SoftwareDistribution to
%SystemRoot%\OldSoftwareDistribution
3. Open Notepad and create a file containing the following:

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


Save this file as 'Wudll.cmd' (without the quotes) to any convenient
location then exit Notepad and double click on the file you just saved. You
should get a 'Sucess' mesage for each of the .dll's listed above.

4. Now Re-enable to Automatic status and then Start each of the services
you stopped before - Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.

5. Now Reboot. Now Reboot Again. (Yes, twice.)

See if that solves it - give it a couple of days. If so, then you can
delete 'OldSoftwareDistribution'. I would request that you post back with
your results. _Only if the problem does re-occur_, then do the following
_exactly_:

1. Go to http://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
v0.60.0.24 (2006-10-27)

2. Unzip it to a new folder at root with any name, e.g.
c:\Dial-a-fix-v0.60.0.24

3. Double click on Dial-a-fix.exe in that folder.

4. Click on the following:
Options/tooltips (just to get an idea of what it does in each section.
)
Both boxes under Prep
The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
be set when you check 3)
In Section 5, 'Programming cores/runtimes' and
'Explorer/IE/OE/shell/WMP' only.
Click 'Go' . (Some of the re-registrations may take what seems like a
long time for some .dll's - Don't be impatient.)

5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
Reboot Again. (Yes, twice.)


See if that does the trick, and, again please post back with your
experience.



MS is well aware of the problem and has provided privately two different
responses concerning a fix:

"I regret to say that I was told that this known issue requires too much
change to be implemented in a hotfix. A change will instead be implemented
in the next Automatic Updates client, which we are planning to release in Q2
this year."

"According to the feedback from Product Development team, this fix will be
published as a security update on the Windows Update site and the relevant
KB article will also be released by us. Therefore, we just need to keep the
system on the network up to date. In addition, the Product Development team
also indicates that the WSUS 3.0 client may contain this patch if this fix
can released timely. At that moment, we can also attempt to upgrade to the
WSUS client 3.0 to test the issue."

--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In Computer logon password <[email protected]>
typed:
|| When I turn on the computer one of the copies of svchost takes over
|| and starts using up to 99% of the CPU. There is, of course, a virus
|| that attaches to this process and starts spinning wheels and makes
|| the use of the computer impossible. All I can do is to press the
|| "end process" button in Task Manager. The result is that then I can
|| use the computer but I loose the use of sound.
|| I have used Pc-cillin, Spyware, McCafee, Ad-aware to scan my
|| computer and all of them say my computer does not have a virus.
|| Is there a way to intercept the loading of processes and figure out
|| what is and where this parasite is? So far deleting all cookies,
|| deleting all Internet temporary files, deleting the MRU list does
|| not produce any results. I will appreciate any help very much.
||
|| Al

 

[PA Bear]

See http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check).

Does this behavior persist now?

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/downloads/maincatalog.aspx

 

[db]

interesting...

i use a similar batch
file buy i have also
added

regsvr32 jscript.dll


Hi CLP - How knowledgable about doing things are you? Do you know how to
start and stop services? How to run a .cmd file? If not, you'll need
access to someone who does to avoid problems. The following assumes you're
on Windows XP but will probably work OK for Win2k as well. If you're
confident about what you're doing, then try the following first - only if it
doesn't work, then there's another level of stuff that can be done
following:

1. Stop and Disable Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.
2. Rename the folder %SystemRoot%\SoftwareDistribution to
%SystemRoot%\OldSoftwareDistribution
3. Open Notepad and create a file containing the following:

REGSVR32 WUAPI.DLL
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL


Save this file as 'Wudll.cmd' (without the quotes) to any convenient
location then exit Notepad and double click on the file you just saved. You
should get a 'Sucess' mesage for each of the .dll's listed above.

4. Now Re-enable to Automatic status and then Start each of the services
you stopped before - Automatic Updates, Background Intelligent Transfer
Service and the Cryptographic Service.

5. Now Reboot. Now Reboot Again. (Yes, twice.)

See if that solves it - give it a couple of days. If so, then you can
delete 'OldSoftwareDistribution'. I would request that you post back with
your results. _Only if the problem does re-occur_, then do the following
_exactly_:

1. Go to http://wiki.djlizard.net/Dial-a-fix and download Dial-a-fix
v0.60.0.24 (2006-10-27)

2. Unzip it to a new folder at root with any name, e.g.
c:\Dial-a-fix-v0.60.0.24

3. Double click on Dial-a-fix.exe in that folder.

4. Click on the following:
Options/tooltips (just to get an idea of what it does in each section.
)
Both boxes under Prep
The 'all' (top) box for Sections 2, 3 and 4 (which will automatically
be set when you check 3)
In Section 5, 'Programming cores/runtimes' and
'Explorer/IE/OE/shell/WMP' only.
Click 'Go' . (Some of the re-registrations may take what seems like a
long time for some .dll's - Don't be impatient.)

5. Reboot (if Dial-a-fix doesn't do it automatically at the end). Now
Reboot Again. (Yes, twice.)


See if that does the trick, and, again please post back with your
experience.



MS is well aware of the problem and has provided privately two different
responses concerning a fix:

"I regret to say that I was told that this known issue requires too much
change to be implemented in a hotfix. A change will instead be implemented
in the next Automatic Updates client, which we are planning to release in Q2
this year."

"According to the feedback from Product Development team, this fix will be
published as a security update on the Windows Update site and the relevant
KB article will also be released by us. Therefore, we just need to keep the
system on the network up to date. In addition, the Product Development team
also indicates that the WSUS 3.0 client may contain this patch if this fix
can released timely. At that moment, we can also attempt to upgrade to the
WSUS client 3.0 to test the issue."

--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In Computer logon password <[email protected]>
typed:
|| When I turn on the computer one of the copies of svchost takes over
|| and starts using up to 99% of the CPU. There is, of course, a virus
|| that attaches to this process and starts spinning wheels and makes
|| the use of the computer impossible. All I can do is to press the
|| "end process" button in Task Manager. The result is that then I can
|| use the computer but I loose the use of sound.
|| I have used Pc-cillin, Spyware, McCafee, Ad-aware to scan my
|| computer and all of them say my computer does not have a virus.
|| Is there a way to intercept the loading of processes and figure out
|| what is and where this parasite is? So far deleting all cookies,
|| deleting all Internet temporary files, deleting the MRU list does
|| not produce any results. I will appreciate any help very much.
||
|| Al

 

[Guest]

Dear Jim:
I thank you very much for your very thorough reply. I have managed to live
with the nuisance for almos a month. I will try the suggestions that look
simpler and if nothing works, I will try your solutions.
When I try your approach, I will get on your blog.

Thanks, and warm regards,
Al

 

[Guest]

My reply was not processed. Sorry,
Thank you
Al

See http://www.bleepingcomputer.com/blogs/mowgreen/index.php?showentry=1071

Workaround: Change the default from Microsoft Update to Windows Update: Go
to Microsoft Update > Click on Change Settings in left pane > Scroll to
bottom of page > To Stop Using Microsoft Update > Disable Microsoft Update
software and let me use Windows Update only (check).

Does this behavior persist now?

With Windows Update as your default, you will need to check in at Office
Update to keep your Office applications fully patched:
http://office.microsoft.com/en-us/downloads/maincatalog.aspx

 

[PA Bear]

Huh?

My reply was not processed. Sorry,
Thank you
Al

 

[Guest]

Dear PA Bear:
I never have automatic updates I always want to know what is being done to
my computer. I have not accepted updates since the problem started.
Al

 

[PA Bear]

I never have automatic updates I always want to know what is being done to

my computer

Then I suggest re-enabling Automatic Updates and selecting the "Notify Only"
option.

Description of the Automatic Updates feature in Windows:
http://support.microsoft.com/kb/294871

How to configure and use Automatic Updates in WinXP:
http://support.microsoft.com/?kbid=306525

Then, if Microsoft Update is your default when you do to
http://windowsupdate.microsoft.com (website), change the default to Windows
Update (website) and your SVCHOST/99% CPU issue will most likely be
resolved. If you do so, remember to check in at Office Update website to
keep your MS Office installation fully patched.

If the problem is being caused by an imcompatibility between your Realtek
audio card software and a recent critical update, when you re-enable
Automatic Updates you'll most likely be offered a patch for this.

Realtak also has a patch. See this realted thread in AumHa Forums:
http://aumha.net/viewtopic.php?t=26217