5-6 instances of svchost.exe

[Happyfeet]

In my task manager it shows many svchost.exe running. Also some of the processes that usually have low memory usage have higher memory usage, thus slowing down my computer. Also there are 2-3 iexplore.exe running when only 1 is actually running. Sometimes the iexplore.exe uses up 30-70k memory. I have used Hijackthis to scan and attached it to this post. Please read the log. Thanks.

 

[Matthew DeCarlo]

Sounds quite normal. Svchost.exe is a Windows process used to host services/DLLs. By having them spread across multiple instances of scvhost.exe, the risk of a single process crashing your system is significantly reduced.

Recent versions of Internet Explorer employ a similar tactic to improve stability/security. It takes a "sandbox" approach via LCIE, which essentially runs the browser frame and tabs in separate processes. Google Chrome uses a similar feature and I believe Mozilla is actively working toward process isolation for Firefox as well.

I haven't taken a look at your HJT log, but I'm sure someone else will.

 

[Happyfeet]

Ok well now I really know that I do have a virus. A I've scanned multiple times with Malwarebytes and have taken out Koobface, Fakealert, and a few other bad things, but I hear a worm could be causing the slowing down of my computer. Now explorer.exe uses up 125,000k of memory, mcshield.exe 50-60k memory, 3x iexplore.exe using from 20-30k memory, etc. Usually all these dont use that much memory so something must be up.

 

[Rick]

Usually all these dont use that much memory so something must be up.

I disagree.

 

[snowchick7669]

All my svchost.exe's added up use around 59,000 K of my CPU (didn't add up correctly, just did the lazy way ).

Besides office/firefox, my svchost.exe's are the biggest memory users.

Its normal for them to use that much, doesn't mean they are virus related

 

[Happyfeet]

Well my computer has never been this slow and usually doesn't randomly freeze. Im attaching another updated HJT log, and a malwarebytes log.

 

[Rick]

I don't see anything indicative of an infection.

What kind of system do you have? (Model, RAM, CPU speed etc..) and when your system freezes, do you have to reset it or does it 'unstick' itself after a few seconds?

 

[Happyfeet]

Intel Pentium Dual CPU
3.25 RAM.
2.20 GHz.
Windows XP SP3.
Ask for more system details if you want.
Oh and I see you havent looked at my HJT log. Can you look at it for me please?

 

[Happyfeet]

Sorry for the double post, but I think this maybe a symptom of the koobface worm even though I removed it already. When I login to my myspace profile it keeps closing and restarting the tab 2 times and then says the problem is caused by the website which I highly doubt. This has never happened before. Help please?

 

[LookinAround]

just fyi... here's an easy way to at least find out just what's running within each instance of svchost you see running:
> Simply install Process Explorer
> Then hover your mouse above each instance of svchost for a list of what it's running.

 

[Rick]

I did look at both of your logs earlier... I didn't see anything.

Of course, just because your logs *appear* to be clean, doesn't mean you don't have a problem though.

 

[Happyfeet]

Okay maybe your right. Thanks for checking out the logs.

 

[Bobbye]

I have 7-9 entries for svchost.exe whenever I'm running. Some of these entries are from Services that are running.

P2P Warning:

I notice you using a P2P or file sharing program:

Limewire, uTorrent.

File sharing and malware go hand and hand. I strongly suggest you uninstall Limewire and uTorrent and any other file sharing program you're using.

You have a Koobface infection. This is a polymorphic Worm that is difficult to remove- the reason is because it becomes a new variant as you get rid of one variant.