100 % CPU and svchost process

[Fred]

Hi,

My PC is always running at 100 % CPU and is slow.
When I kill the process svchost process, the system comes back to normal and
I can run all of my applications.
I have run all the spy, virus, performance software, but can not find
anything wrong.

I have read that killing the svchost process is bad but it seems it is the
only temp solution I have.

Any recommendation?

Fred
(to send email, get the lead out)

 

[Leonard Grey]

"Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/

Viruses and other malicious software (collectively known as malware) can
be very hard to detect, and even harder to remove. Sometimes, malware is
impossible to remove, no matter what you try. (More on that later.)

If you suspect your computer is infected, follow these steps:

1) If you have anti-virus and anti-spyware programs already installed on
your computer, update the programs and scan your computer. With luck,
the programs will detect and remove the problem.

2) If the scan doesn't produce results, contact the program's technical
support. Most of the major anti-virus/spyware programs will help you to
remove an infection that their software did not detrect.

3) Scan your system with /several/ of the better free online scanners,
such as:

Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
NOD32 (http://www.eset.com/download/index.php) - free 30-day trial
Trend Micro Housecall (http://housecall.trendmicro.com)
Panda ActiveScan (http://www.pandasoftware.com/activescan)
Sophos
(http://www.sophos.com/products/free-tools/sophos-threat-detection-test.html)
McAfee Free Scan (http://us.mcafee.com/root/mfs/default.asp)
Symantec Security Check (http://security.symantec.com)
Avast! (http://www.avast.com/eng/avast-virus-cleaner.html)
GrisSoft AVG (http://www.grisoft.com/doc/34/ww/crp/0)

4) HijackThis (http://www.spywareinfo.com/~merijn/programs.php) is an
advanced scanner for spyware. You can post its logs to
http://spywarewarrior.com/viewforum.php?f=5 (among other places) and get
expert analysis of what's on your computer.

5) Finally, if none of the above remove the malware, it's time to show
the computer to a professional.

Here's a sobering thought: There may be nothing at all that you can do
to remove an infection, no matter what you try. That's because some
infections compromise your computer to the point where you can no longer
rely on what the operating system is telling you. Rootkits are an
example of this kind of infection. In that case, your only way out is to
erase your hard disk and reinstall everything from scratch.

"Help I Got Hacked. Now What Do I Do?"
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

"So how did I get infected in the first place?"
http://forums.spywareinfo.com/index.php?showtopic=60955

 

[Guest]

I've had a simular problem and had to do the same to the service that caused
the problem but I just switched it to manual mode not disabled. That way if
the system needs it, the system can start it. I think the problem is related
to system board and the MS OS. I found one website the was supposed to tell
which MS OS services were not needed by that was too must trouble.

 

[Guest]

How do you erase your hard drive?

"Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/

Viruses and other malicious software (collectively known as malware) can
be very hard to detect, and even harder to remove. Sometimes, malware is
impossible to remove, no matter what you try. (More on that later.)

If you suspect your computer is infected, follow these steps:

1) If you have anti-virus and anti-spyware programs already installed on
your computer, update the programs and scan your computer. With luck,
the programs will detect and remove the problem.

2) If the scan doesn't produce results, contact the program's technical
support. Most of the major anti-virus/spyware programs will help you to
remove an infection that their software did not detrect.

3) Scan your system with /several/ of the better free online scanners,
such as:

Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
NOD32 (http://www.eset.com/download/index.php) - free 30-day trial
Trend Micro Housecall (http://housecall.trendmicro.com)
Panda ActiveScan (http://www.pandasoftware.com/activescan)
Sophos
(http://www.sophos.com/products/free-tools/sophos-threat-detection-test.html)
McAfee Free Scan (http://us.mcafee.com/root/mfs/default.asp)
Symantec Security Check (http://security.symantec.com)
Avast! (http://www.avast.com/eng/avast-virus-cleaner.html)
GrisSoft AVG (http://www.grisoft.com/doc/34/ww/crp/0)

4) HijackThis (http://www.spywareinfo.com/~merijn/programs.php) is an
advanced scanner for spyware. You can post its logs to
http://spywarewarrior.com/viewforum.php?f=5 (among other places) and get
expert analysis of what's on your computer.

5) Finally, if none of the above remove the malware, it's time to show
the computer to a professional.

Here's a sobering thought: There may be nothing at all that you can do
to remove an infection, no matter what you try. That's because some
infections compromise your computer to the point where you can no longer
rely on what the operating system is telling you. Rootkits are an
example of this kind of infection. In that case, your only way out is to
erase your hard disk and reinstall everything from scratch.

"Help I Got Hacked. Now What Do I Do?"
http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx

"So how did I get infected in the first place?"
http://forums.spywareinfo.com/index.php?showtopic=60955

 

[Leonard Grey]

There are many ways to erase a hard disk. For example: If it's your plan
to reinstall all the software that was on your hard disk when it shipped
to you, you could use the recovery disk or recovery partition that came
with your computer. Just keep in mind that when you erase a hard disk,
everything on it is permanently gone.

 

[Fred]

How do I change the process to manual mode?

I've had a simular problem and had to do the same to the service that
caused
the problem but I just switched it to manual mode not disabled. That way
if
the system needs it, the system can start it. I think the problem is
related
to system board and the MS OS. I found one website the was supposed to
tell
which MS OS services were not needed by that was too must trouble.

 

[Gerry]

Fred

I think Larry is referring to setting a Service Start-Up type to manual
but given you have not identified which copy of svchost.exe is running
at 100% you are not going to be able to do that. In any event I doubt
that is the solution. You need to identify which svchost.exe it is and
this could be a step towards identifying the nature of the problem.

You need to identify which application is generating excessive use of
svchost.exe. Process Explorer provides more information than Task
Manager.

Download Process Explorer.

For further information about Process Explorer see here:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

To ascertain which service is causing the problem select the svchost
producing the high CPU usage, right click, select Properties, Services.
Note there are the full names and some explanation of what each service
does.

You will find further information on Services here:
http://majorgeeks.com/page.php?id=12

To trace the particular Service involved you need to turn off each
service in turn and then restore it noting what effect it has on CPU
usage. However, you need to take care and watch what other Services are
dependent on that service. When you click on the Dependencies tab allow
it a little time to display the information.

It would be helpful if you could post the Command Line of the svchost
process generating the excessive CPU usage. In Process Explorer place
cursor on Process and select Properties, Image.

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~