SVCHOST

[PDJ]

How come several of these processes are running and taking
up lots of processor resources? I read a string earlier
suggesting it was to do with the MSBlast virus - is this
true? I used to have this virus, but I've got rid of the
virus (i think) now - but the Svchost processes are still
there. My pc is running rather slowly... (I'm running win
xp)

 

[Bruce Chambers]

Greetings --

It's perfectly normal to have several instances of Svchost.exe
running simultaneously.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

However, if Svchost.exe is using a large portion of your CPU
cycles, it has most likely been "hijacked" by a worm or Trojan. Have
you tried using a decent antivirus application with the most
currently-available virus definition files? A strong candidate would
be W32.Welchia.Worm.

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

Because many of the newer viruses and worms can disable antivirus
applications whose definitions weren't up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. -- RAH

 

[Alex Nichol]

How come several of these processes are running and taking
up lots of processor resources? I read a string earlier
suggesting it was to do with the MSBlast virus - is this
true?

Svchost is the interface program used to load and handle a whole slew of
services for the system - maybe forty or so. They get loaded in batches
- hence multiple instances. When you add them together they may amount
to 30 or even 40 MBytes of memory; but should not need much, if any, CPU
use if things are normal.

If you see heavy CPU use in Task Manager, leave it open, and use Control
Panel - Admin Tools - Services to select individual ones that show as
Started - very cautiously - and click Stop to see if it affects the
matter. If not, Start that service again, and move on.

Ones I regard as candidates to stop are
Background Intelligent Transfer (used by Automatic Update, but Windows
Update will run manually without it)
Routing and Remote Access
Indexing Service
Messenger Service (which is not the Instant Messenger, but is the route
Blast strikes through)
and the pair
SSDP Discovery
Universal Plug and Play

If you do find one of these causing heavy CPU use, double click it and
set startup type to Manual and Apply - then if it really is needed it
*can* start up