I wonder why uPnP would consume that much ?
Dave
| It turns out in my case this is not a virus.
|
| I kept at this and found by using Process Explorer from
http://www.sysinternals.com
|
| that:
| advapi32.dll! createprocesasuserW +0x42e was causing a problem.
|
| check out:
|
http://www.mcse.ms/printthread.php?threadid=23938
|
| This person had good luck stopping the SSDP Discovery Service service
| As soon as I stopped this service, svchost went back down to 0%
| woo hoo!
|
| I hope this helps!
|
| -Dan
|
| (e-mail address removed) (Dan) wrote in message
| > It appears that I have the same problem as Dave.
| >
| > symptoms:
| >
| > svchost.exe is using anywhere from 30 to 80% of CPU usage.
| > The approximate memory usage is 22,000K
| >
| >
| > I have tried the 9 steps(8 steps, plus reporting back) you have
| >
| > listed, but it did not find any viruses. There were a number of system
| >
| > files that it was not able to scan however.
| >
| > NTUSER.DAT": Access is denied.
| > NTUSER.DAT.LOG": Access is denied.
| > UsrClass.dat": Access is denied.
| > UsrClass.dat.LOG": Access is denied.
| > An error was detected on "C:\System Volume Information\*.*": Access is
| >
| > denied.
| > Files in the C:\WINDOWS\Prefetch\ folder also get the access is
| >
| > denied.
| >
| > I have tried the following other programs:
| > 1. Norton Antivirus 2003 professional version
| > 2. Spybot 1.3 w/updates up to 9/30/04 (it can't find any newer ones)
| > 3. Adaware SE Personal
| > 4. Spyware Doctor
| > 5. SpywareBlaster
| > 6. Spybot SD resident
| > 7. Hijackthis.exe
| > 8. Microtrend online virus check
| > 9. Stinger.exe checker
| >
| > I am at a total loss.
| >
| > -Dan
| >
| > > 1) Download the following two items...
| > >
| > > Trend Sysclean Package
| > >
http://www.trendmicro.com/download/dcs.asp
| > >
| > > Latest Trend signature files.
| > >
http://www.trendmicro.com/download/pattern.asp
| > >
| > > Create a directory.
| > > On drive "C:\"
| > > (e.g., "c:\New Folder")
| > > or the desktop
| > > (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
| > >
| > > Download sysclean.com and place it in that directory.
| > > Dowload the signature files (pattern files) by obtaining the ZIP file.
| > > For example; lpt186.zip
| > >
| > > Extract the contents of the ZIP file and place the contents in the same directory as
| > > sysclean.com.
| > >
| > > 2) If you are using WinME or WinXP, disable System Restore
| > >
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
| > > 3) Reboot your PC into Safe Mode
| > > 4) Using the Trend Sysclean utility, perform a Full Scan of your platform and
| > > clean/delete any infectors found
| > > 5) Restart your PC and perform a "final" Full Scan of your platform
| > > 6) If you are using WinME or WinXP,Re-enable System Restore and re-apply any
| > > System Restore preferences, (e.g. HD space to use suggested 400 ~ 600MB),
| > > 7) Reboot your PC.
| > > 8) If you are using WinME or WinXP, create a new Restore point
| > > 9) Please report back your results
| > >
| > > Dave
| > >
| > >
| > >
| > >
| > >
| > > | > > | I ma running WinXP on the three computers on my network
| > > | and I have noticed one of them is showing 100% CPU usage.
| > > |
| > > | I seems that svchost.exe is running multiple times and
| > > | one of them uses any remaining available CPU capability.
| > > |
| > > | I have run Norton Antivirus and Spybot and not problem is
| > > | identified. I noticed a post on the net that described
| > > | this problem and the answer that was given was that a
| > > | virus was present. I downloaded a fix from Norton and
| > > | when used it said the virus was not on the computer.
| > > |
| > > | I know svchost can run multiply times but I don't think
| > > | it is supposed to use all the CPU capacity.
| > > |
| > > | I did find a copy of svchost in a directly other than
| > > | windows/system32
| > > |
| > > | Anyone have any ideas.
| > > |
| > > | Dave
