svchost.exe

[Kevin]

After about a hour of fine performance, an instance of
svchost.exe begins hogging CPU time ~100%. Any thoughts?

I have not made any recent hard/software changes.
Adaware, Spybot, and Norton are regularly updated and
run. No help so far on this website


Thanks,
Kevin

 

[Guest]

-----Original Message-----

After about a hour of fine performance, an instance of
svchost.exe begins hogging CPU time ~100%. Any thoughts?

I have not made any recent hard/software changes.
Adaware, Spybot, and Norton are regularly updated and
run. No help so far on this website


Thanks,
Kevin
.

Agreed, I am having the same problem. I was getting
somewhere with Jason Hall's last post, but the last line
of instructions he gave did not work. I want to find out
what process in svchost.exe is causing the utilization so
I can root it out. My laptop has been like this going on
two weeks now. I am about ready to re-install Windows, but
I hate losing.

kmcdowell

 

[Tim Holbrook]

After about a hour of fine performance, an instance of
svchost.exe begins hogging CPU time ~100%. Any thoughts?

I have not made any recent hard/software changes.
Adaware, Spybot, and Norton are regularly updated and
run. No help so far on this website

Ditto - same for me. It only happens when I try and connect to the
Internet via ICS then svchost.exe goes and stays at 100%.

All scans reveal nothing.

I've uninstalled KB835732 & then KB828741 but no difference. Some
post said uninstalling KB828035 may help but when trying to remove
this it claimed it would break a load of apps so I quit the uninstall.

I'm pulling my hair out. Anyone got any ideas?

Tim

 

[Bruce Chambers]

Greetings --

It's perfectly normal to have several instances of Svchost.exe
running simultaneously.

A Description of Svchost.exe in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q250320

However, if Svchost.exe is using a large portion of your CPU
cycles, as you report, it has most likely been "hijacked" by a worm or
Trojan. Have you tried using a decent antivirus application with the
most currently-available virus definition files? A strong candidate
would be W32.Welchia.Worm.

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

Because many of the newer viruses and worms can disable antivirus
applications whose definitions weren't up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp


Bruce Chambers

--
Help us help you:




You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Tim Holbrook]

Thanks Bruce; but I've done all that...

I know there are 'n' instances meant to be running but it shouldn't go
(and never has done before) 100% upon getting an internet connection.

Google is awash with many others complaining about the same thing. On
google groups, just search for: svchost 100 cpu

Adaware, SpyBot S&D, TrendMicro housecall, Stinger, NAV2003, etc all
turn up nothing. I've manually checked the registry & services. All
looks normal.

Its got to be an unknown virus/worm OR a recent MS Critical Update
such as another KB835732 horror story.

Going bald...
Tim

 

[kmcdowell]

-----Original Message-----

Thanks Bruce; but I've done all that...

I know there are 'n' instances meant to be running but it shouldn't go
(and never has done before) 100% upon getting an internet connection.

Google is awash with many others complaining about the same thing. On
google groups, just search for: svchost 100 cpu

Adaware, SpyBot S&D, TrendMicro housecall, Stinger, NAV2003, etc all
turn up nothing. I've manually checked the registry & services. All
looks normal.

Its got to be an unknown virus/worm OR a recent MS Critical Update
such as another KB835732 horror story.

Going bald...
Tim
.

I am already bald, but if I had hair, I would be losing it
too. I have been working on fixing the same issue for
almost two weeks now. If I could find the thread process
within the svchost.exe process, I would be set, but there
seems to be no way to do that. Jason Hall had a great post
last week (in here) in response to my posts about a way to
find the culprit thread, but the last step in his
directions was not correct, and did not work. I do not
know his email address, so I can not reach him to discuss,
and further posts paging him here have not been answered.

I am working on this diligently, and if I find the culprit
and/or a cure, I will post here.

kmcdowell