svchost is out of control

[Gary Nastrasio]

I'm having problems with the number of handles on my Win2000 machine
growing out of control. When I first boot up I'm at ~3500. If I just
let my computer sit the number keeps growing and growing. In the
Process list in Task Manager I see that one of my three instances of
svchost.exe is the problem; the handle count goes up and up. Now, when
I reach ~13000 total handles I get a Winsock error saying too many
sockets are open and my queue may be full. So this leads me to believe
some DLL is trying to access the Internet over and over, but how can I
track this down? My anti-virus is up to date and a spyware scan just
caught browser cookies. Besides anti-virus and nVidia display
configuration the only other background processes running are normal
Windows 2000 ones...

Help!

 

[David H. Lipman]

Please go to one or more of the below online scanners and perform a scan of your platform
then report back your results.

Trend:
http://housecall.antivirus.com
http://housecall.trendmicro.com

McAfee:
http://www.mcafee.com/myapps/mfs/default.asp

Panda:
http://www.pandasoftware.com/activescan/

Symantec:
http://security.symantec.com/

Dave




| I'm having problems with the number of handles on my Win2000 machine
| growing out of control. When I first boot up I'm at ~3500. If I just
| let my computer sit the number keeps growing and growing. In the
| Process list in Task Manager I see that one of my three instances of
| svchost.exe is the problem; the handle count goes up and up. Now, when
| I reach ~13000 total handles I get a Winsock error saying too many
| sockets are open and my queue may be full. So this leads me to believe
| some DLL is trying to access the Internet over and over, but how can I
| track this down? My anti-virus is up to date and a spyware scan just
| caught browser cookies. Besides anti-virus and nVidia display
| configuration the only other background processes running are normal
| Windows 2000 ones...
|
| Help!

 

[Gary Nastrasio]

Hi! Panda doesn't report anything and Symantec said I should close port
1025 and use a newer version of anti-virus than 2002. Everything else
was clean. When I came in this morning after running Panda Activescan
last night the handle count in svchost is up to 44,000 and my memory
usage is up to 212MB! Using a tool from Jeff Richter's Win32
programming book here are a list of DLL's that the 44K handle instance
of svchost.exe is using:

ntdll, kernel32, advapi32, rpcrt4, comctl32, gdi32, user32, lz32, ole32,
oleaut32, shell32, shlwapi, msvcrt, urlmon, version, wininet, crypt32,
msasn1, wsock32, ws2_32, ws2help, msafd, wshtcpip, rnr20, dnsapi,
iphlpapi, icmp, mprapi, samlib, netapi32, secur32, netwrap, wldap32,
activeds, adsldpc, rtutils, setupapi, userenv, rasapi32, rasman, tapi32,
dhcpsvc, winrnr, rasadhlp

Unfortunately I can't see which DLL is opening all the handles.

Thanks for any further help...