Thank you...when it happens again I will check if it is sychost or svchost.
I have run the Malware program and it found nothing.
Does this happen randomly, when you shutdown, or usually when you are
doing some specific thing - browsing (what browser?), reading a PDF
file maybe?
Please provide additional information about your system:
Click Start, Run and in the box enter:
msinfo32
Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste
the information back here.
There will be some personal information (like System Name and User
Name), and whatever appears to
be private information to you, just delete it from the pasted
information.
This will minimize back and forth Q&A and eliminate guesswork.
Look in the Event Viewer for clues around the time of the incident.
Here is a method to post the specific information about individual
events.
To see the Event Viewer logs, click Start, Settings, Control Panel,
Administrative Tools, Event Viewer.
A shortcut to Event Viewer is to click Start, Run and in the box
enter:
%SystemRoot%\system32\eventvwr.msc /s
Click OK to launch the Event Viewer.
The most interesting logs are usually the Application and System.
Some logs may be almost or completely empty.
Not every event is a problem, some are informational messages that
things are working okay and some are warnings.
No event should defy reasonable explanation.
Each event is sorted by Date and Time. Errors will have red Xs,
Warnings will have yellow !s.
Information messages have white is. Not every Error or Warning event
means there is a serious issue.
Some are excusable at startup time when Windows is booting. Try to
find just the events at the date
and time around your problem.
If you double click an event, it will open a Properties windows with
more information. On the right are
black up and down arrow buttons to scroll through the open events. The
third button that looks like
two pages on top of each other is used to copy the event details to
your Windows clipboard.
When you find an interesting event that occurred around the time of
your issue, click the third button
under the up and down arrows to copy the details and then you can
paste the details (right click, Paste
or CTRL-V) the detail text back here for analysis.
To get a fresh start on any Event Viewer log, you can choose to clear
the log (backing up the log is offered),
then reproduce your issue, then look at just the events around the
time of your issue.
If you are planning on replacing your svchost.exe with that patch,
hopefully you will include a plan for putting the original one back if
you need to. svchost.exe is a pretty fundamental XP process, so if
you break it, you need to be able to fix it.
