TechSpot

Svchost and 100% CPU usage

By DrazharLn
Jul 7, 2009
Topic Status:
Not open for further replies.
  1. Svchost and 100% CPU usage [Resolved]

    On startup, between 3 and 6 .NET process instances of svchost are spawned in addition to maybe 1 or 2 svchost processes from explorer.

    The .NET svchosts proceed to consume all available CPU time after about 10 minutes. A snapshot from process explorer with details of one instance are provided [attachment "pe_svc_snap.txt"].
    An screenshot of the guilty processes as seen from process explorer is also attached.

    I also include a log file from hijackthis taken at the same time.

    Notes:
    My system runs a legal copy of windows xp home 32bit and is fully patched up. Including those patches concerning the windows update update from ~2006.
    I run avast anti-virus and COMODO internet security (with AV disabled on COMODO).
    I do run msn messenger (or rather, windows live messenger) so topic53887 may be relevant, however I would like to consult before I delete as I recognize only about half the items in the hijackthis log.

    Currently, I simply load process explorer at startup and then kill all the .NET svchosts, and this solves the problem.
    If someone could help me find the root of the problem, however, that would be most appreciated.

    Thanks in advance
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

  3. DrazharLn

    DrazharLn TS Rookie Topic Starter

    That doesn't make sense, this problem was occurring way before I installed live mesh.

    Every time I start the computer, I kill all the .NET svchost processes and everything on the PC still works fine.

    Thanks for the reply, though
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    But I don't know that!

    I don't use Live Mesh, but a great deal of searching resulted in what I left for you.

    Can you explain this?
    If you're just going to kill them, why don't you just stop them from starting up in the first place?
  5. DrazharLn

    DrazharLn TS Rookie Topic Starter

    **Previous post removed**

    I had a trogan masquerading as windows update's svchost running a spambot operation on my computer. At each runtime, it was resurrected by a modified userinit.exe.

    Thanks for reminding me to check the startup entries. I'd done it before, but I missed that one of the entries resurrected itself upon deletion.

    Sorry if I offended you with my second post, it was not meant in an argumentative manner.
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Too bad you didn't just go through the Virus and Malware Removal in the first place! It might have saved some frustration. Trying to outguess a computer system rarely works.

    If you decide to do the cleaning: http://www.techspot.com/vb/topic58138.html
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.