svchost.exe Uses 60%+ of CPU

[David Fleener]

I use Windows XP Professional and svchost.exe uses at
least 60% percent of the CPU. There are several
svchost.exe processes, but if one is terminated then the
system shuts down due to a RPC error. I know that this
incident has been posted, but none of the feedback was
helpful to my specific need(s). I prefer feedback to go
to my personal e-mail: (e-mail address removed). Thank
you.

 

[Tim]

-----Original Message-----
I use Windows XP Professional and svchost.exe uses at
least 60% percent of the CPU. There are several
svchost.exe processes, but if one is terminated then the
system shuts down due to a RPC error. I know that this
incident has been posted, but none of the feedback was
helpful to my specific need(s). I prefer feedback to go
to my personal e-mail: (e-mail address removed). Thank
you.
.

I just ran into this file myself. It is a virus. You can
check it out at Symantec (Norton Anti-virus). Search for
the Backdoor Litmus virus. You'll find it in the list as
Backdoor Litmus 203b. And then you can get rid of it.

 

[Jack E Martinelli]

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.litmus.203.b.html
Systems Affected: Windows 95, Windows 98, Windows Me, Windows NT,
Windows 2000, Windows XP
Systems Not Affected: Windows 3.x, Microsoft IIS, Macintosh, UNIX,
Linux

Backdoor.Litmus.203.b is a variant of Backdoor.Litmus.203.
When Backdoor.Litmus.203.b runs, it performs the following actions:
It copies itself as %windir%\Random\Svchost.exe.

 

[jjjj]

I don't know if this will help as svchost.exe should not
be using 60%+ CPU but you can try to download a .pdf file
from this
http://www.blackviper.com/WinXP/Files/XPServices.zip
address. There you can see which services you can disable,
but use the "SAFE mode" described in the file. You can
view the services by going to "Controlpanel" -

"Administrative tools" -> "Services". To view the

options as Automatic, Manuel and Inactive just doubleclick
the service you want do configure and select an option,
when you are done just restart your computer.

 

[Guest]

Before you go killing those services...make sure you have
accurate knowledge
The below is from this URL:
http://www.winnetmag.com/Article/ArticleID/20609/20609.htm
l

A. Svchost is a generic host process that hosts services
run from DLLs. During development, it's customary to
separate new or changing services to increase the
reliability and ease of troubleshooting; thus, on a beta
OS version, you see more svchost processes running than
on a release version.

To find out what's inside each copy of svchost.exe, use
the Resource Kit Support Tools' tlist.exe (with the -s
switch). (You need to install the Support Tools from
\support\tools on your product CD-ROM; they don't install
by default.) Below is sample output from the tlist
command:


C:\>tlist -s
0 System Process
4 System
176 smss.exe
208 csrss.exe Title:
172 winlogon.exe Title: NetDDE Agent
256 services.exe Svcs: Eventlog,PlugPlay
268 lsass.exe Svcs:
Netlogon,PolicyAgent,ProtectedStorage,SamSs
320 svchost.exe Svcs: RpcSs
420 svchost.exe Svcs:
AudioSrv,Browser,CryptSvc,Dhcp,dmserver,
EventSystem,FastUserSwitchingCompatibilityServices,helpsvc
,HidServ,
lanmanserver,lanmanworkstation,Netman,Nla,Schedule,seclogo
n,SENS,
ShellHWDetection,TermService,ThemeService,TrkWks,uploadmgr
,W32Time,
WmdmPmSp,wuauser
480 svchost.exe Svcs: Dnscache
500 svchost.exe Svcs:
LmHosts,Messenger,RemoteRegistry,SSDPSRV,WebClient
544 spoolsv.exe Svcs: Spooler
660 DKService.exe Svcs: Diskeeper
800 svchost.exe Svcs: winmgmt
1092 explorer.exe Title: Program Manager
1244 ctfmon.exe Title:
900 ISATRAY.EXE Title: IsaTray
1344 NAVAPW32.EXE Title: Norton AntiVirus Auto-Protect
1212 FRONTPG.EXE Title: Microsoft FrontPage - D:\asp
www.ntfaq.com\NTFAQ\5apr2001.htm
428 NAVAPSVC.EXE Svcs: NAV Auto-Protect
1376 ALERTSVC.EXE Svcs: NAV Alert
1372 PowerDVD.exe Title: PowerDVD
444 OUTLOOK.EXE Title: Tasks - Microsoft Outlook
1268 msmsgs.exe Title:
1436 MDM.EXE Title: OleMainThreadWndName
632 WINWORD.EXE Title: DDE Server Window
1404 IEXPLORE.EXE Title: Q250320 - Description of
Svchost.exe -
Microsoft Internet Explorer
1348 cmd.exe Title: E:\WINDOWS\System32\cmd.exe - tlist -s
1428 tlist.exe


Many services, drivers, and modules load at system
startup and are essential to system operation. Even
though they show up in Task Manager, they're still
critical.

The svchosts are defined in the registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Svchost.