TechSpot

svchost running 8 times!

By Danstar10
Nov 7, 2006
  1. Hi,
    i followed a help on the topic mssvchost found here if it helps:

    http://www.geekstogo.com/forum/index.php?showtopic=99775&hl=mssvchost

    and got a little stuck. i follwed it up to where i use Services.msc to disable the three items, did that no probs, (although 'ssms' was already stoped and just needed diabling) but then after reboot i did not find the 4 items in "hijack this" that was listed should be displayed so i could go no further. Now i do not get the "An error occured and mssvchost.exe now needs to close" when i start up anymore, but should i do anything else? There are 8 schost.exe items running in my task mannager at once now, is this a wory?
    i have attached the hijack this logfile.
    thanks for your time
    Daniel
     

    Attached Files:

  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    I can find no info on this service Msscsbdm, therefore you should temporarily disable it and see what happens.

    Click start/run and type services.msc into the run box and press the enter key.

    When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

    Msscsbdm

    Close the services window.


    Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;<local>

    O8 - Extra context menu item: Search with Wanadoo - res://C:\PROGRA~1\Wanadoo\WSBar\WSBar.dll/VSearch.htm

    O23 - Service: Msscsbdm - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvnrm.sys

    Click on the fix checked button.

    Close HJT.

    Reboot your system.

    As for muliple instances of the svchost.exe file running, they`re probably legit. However, if you download and run the Systernals Process Explorer, you should be able to find out what each svchost.exe file is associated with.

    Regards Howard :wave: :wave:

    This thread is for the use of Danstar10 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Danstar10

    Danstar10 TS Rookie Topic Starter

    Hmm

    Thanks for the reply but where did you get "Msscsbdm" from? i didnt write about this...

    i got the Systernals Processor Explorer - cheers for that, and it tells me they are all 'generic host process for win32 services' by 'microsoft corporation'. so this is ok?

    its just that they appeared recently thats got me worried. Any more action i should take then?

    thanks for your time

    Daniel
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    This entry in your HJT log is where I got the Msscsbdm service from.

    O23 - Service: Msscsbdm - NVIDIA Corporation - C:\WINDOWS\system32\drivers\nvnrm.sys

    Like I said, I can`t find any info for that service. Typically the C:\WINDOWS\system32\drivers\nvnrm.sys file is associated with the I2tfdisounsn service. Therefore I think it looks a little suspicious.

    The svchost.exe files you have running seem to be fine and are nothing to worry about.

    Other than what I advised you to fix, your HJT log looks clean.

    Regards Howard :)

    This thread is for the use of Danstar10 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Danstar10

    Danstar10 TS Rookie Topic Starter

    Ahh...

    ok,
    that clears that up. But 'Msscsbdm' doesnt come up in the services.msc thing, so wadya reckon, still dodgy?

    Daniel
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The truth is mate, I don`t know. It could be legit, but I couldn`t find any info for that service.

    Maybe I`m just suspicious by nature lol. The nvnrm.sys file is normally associated with the Nvidia network/lan drivers.

    I think you should keep an eye on it for a while and see if it causes any problems.

    Regards Howard :)

    This thread is for the use of Danstar10 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. Danstar10

    Danstar10 TS Rookie Topic Starter

    Will do, thanks alot for your help.
    Dan
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...