svchost.exe hogs resources

[MartynB]

I hope the following may help if you notice sluggish performance.

I'm running XP Pro SP2 on a home network.

I found that whilst browsing the internet, the CPU usage would sometimes
stick at 100% for what seems like ages. This was traced to one of the
svchost processes taking more than it's fair share of resources. After
exhaustive investigation I found the service responsible - it was the DNS
Cache Service. I also noted the following error numerous times in the System
Event Log:-

Error Source: Service Control manager
Error Event ID: 7011
Error Description: "Timeout (30000 milliseconds) waiting for a transaction
response from the Dnscache service."

Flushing the DNS Cache using ipconfig /flushdns didn't really help. However
when I used ipconfig /displaydns, I noticed that the dns cache had a list of
entries of websites pointing to the local host address 127.0.0.1. That gave
me the clue. I opened the hosts file (size: 332Kb) and found a long list of
spyware blocking entries that had been inserted by Spybot - Search &
Destroy.

After I had deleted these entries, the DNS Cache Service behaviour returned
to normal.

I used to run Spybot - Search & Destroy which I found quite useful, but have
since installed Microsoft AntiSpyware - which seems to work fine and doesn't
need to use the hosts file to block spyware. Looking at the FAQ on the
Spybot web site gave me this link:- "Why does my network react very slowly
after inserting the Hosts File?" http://www.spybot.info/en/faq/12.html .

I recommend that anyone who has a large hosts file should review the need
for the method of blocking spyware sites by pointing them to the local host
address.

Martyn

 

[Chuck]

I hope the following may help if you notice sluggish performance.

I'm running XP Pro SP2 on a home network.

I found that whilst browsing the internet, the CPU usage would sometimes
stick at 100% for what seems like ages. This was traced to one of the
svchost processes taking more than it's fair share of resources. After
exhaustive investigation I found the service responsible - it was the DNS
Cache Service. I also noted the following error numerous times in the System
Event Log:-

Error Source: Service Control manager
Error Event ID: 7011
Error Description: "Timeout (30000 milliseconds) waiting for a transaction
response from the Dnscache service."

Flushing the DNS Cache using ipconfig /flushdns didn't really help. However
when I used ipconfig /displaydns, I noticed that the dns cache had a list of
entries of websites pointing to the local host address 127.0.0.1. That gave
me the clue. I opened the hosts file (size: 332Kb) and found a long list of
spyware blocking entries that had been inserted by Spybot - Search &
Destroy.

After I had deleted these entries, the DNS Cache Service behaviour returned
to normal.

I used to run Spybot - Search & Destroy which I found quite useful, but have
since installed Microsoft AntiSpyware - which seems to work fine and doesn't
need to use the hosts file to block spyware. Looking at the FAQ on the
Spybot web site gave me this link:- "Why does my network react very slowly
after inserting the Hosts File?" http://www.spybot.info/en/faq/12.html .

I recommend that anyone who has a large hosts file should review the need
for the method of blocking spyware sites by pointing them to the local host
address.

Martyn

Martyn,

This is a known issue. The recommended precaution, if you're going to use Hosts
for website blocking, is to disable the service. It isn't needed on computers
on LANs without a DNS server.
<http://nitecruzr.blogspot.com/2005/07/local-name-and-address-resolution-on.html>

MSAS is a good protective tool, but it's not 100% effective. Many folks use a
Hosts file for backup - it's easy to use, works without any install procedures,
and is universally usable across all operating systems. Both tools are just a
portion of a layered defense strategy though.
<http://nitecruzr.blogspot.com/2005/05/please-protect-yourself-layer-your.html>