Svchost and 100% CPU usage

By DrazharLn ยท 5 replies
Jul 7, 2009
  1. Svchost and 100% CPU usage [Resolved]

    On startup, between 3 and 6 .NET process instances of svchost are spawned in addition to maybe 1 or 2 svchost processes from explorer.

    The .NET svchosts proceed to consume all available CPU time after about 10 minutes. A snapshot from process explorer with details of one instance are provided [attachment "pe_svc_snap.txt"].
    An screenshot of the guilty processes as seen from process explorer is also attached.

    I also include a log file from hijackthis taken at the same time.

    My system runs a legal copy of windows xp home 32bit and is fully patched up. Including those patches concerning the windows update update from ~2006.
    I run avast anti-virus and COMODO internet security (with AV disabled on COMODO).
    I do run msn messenger (or rather, windows live messenger) so topic53887 may be relevant, however I would like to consult before I delete as I recognize only about half the items in the hijackthis log.

    Currently, I simply load process explorer at startup and then kill all the .NET svchosts, and this solves the problem.
    If someone could help me find the root of the problem, however, that would be most appreciated.

    Thanks in advance
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

  3. DrazharLn

    DrazharLn TS Rookie Topic Starter

    That doesn't make sense, this problem was occurring way before I installed live mesh.

    Every time I start the computer, I kill all the .NET svchost processes and everything on the PC still works fine.

    Thanks for the reply, though
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

    But I don't know that!

    I don't use Live Mesh, but a great deal of searching resulted in what I left for you.

    Can you explain this?
    If you're just going to kill them, why don't you just stop them from starting up in the first place?
  5. DrazharLn

    DrazharLn TS Rookie Topic Starter

    **Previous post removed**

    I had a trogan masquerading as windows update's svchost running a spambot operation on my computer. At each runtime, it was resurrected by a modified userinit.exe.

    Thanks for reminding me to check the startup entries. I'd done it before, but I missed that one of the entries resurrected itself upon deletion.

    Sorry if I offended you with my second post, it was not meant in an argumentative manner.
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,334   +36

Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...