Svchost and 100% CPU usage

[DrazharLn]

Svchost and 100% CPU usage [Resolved]

On startup, between 3 and 6 .NET process instances of svchost are spawned in addition to maybe 1 or 2 svchost processes from explorer.

The .NET svchosts proceed to consume all available CPU time after about 10 minutes. A snapshot from process explorer with details of one instance are provided [attachment "pe_svc_snap.txt"].
An screenshot of the guilty processes as seen from process explorer is also attached.

I also include a log file from hijackthis taken at the same time.

Notes:
My system runs a legal copy of windows xp home 32bit and is fully patched up. Including those patches concerning the windows update update from ~2006.
I run avast anti-virus and COMODO internet security (with AV disabled on COMODO).
I do run msn messenger (or rather, windows live messenger) so topic53887 may be relevant, however I would like to consult before I delete as I recognize only about half the items in the hijackthis log.

Currently, I simply load process explorer at startup and then kill all the .NET svchosts, and this solves the problem.
If someone could help me find the root of the problem, however, that would be most appreciated.

Thanks in advance

 

[Bobbye]

It's Live Mesh. Looks like you either run it and put up with the high CPU usage- or you don't. It's your call. The HijackThis log is full of entries for this program.

See the Q&A here:
http://social.microsoft.com/Forums/en-US/LiveMesh/thread/dd73d3cf-e9c7-4b6e-a3d4-d67abab12024

 

[DrazharLn]

That doesn't make sense, this problem was occurring way before I installed live mesh.

Every time I start the computer, I kill all the .NET svchost processes and everything on the PC still works fine.

Thanks for the reply, though

 

[Bobbye]

That doesn't make sense, this problem was occurring way before I installed live mesh.

But I don't know that!

I don't use Live Mesh, but a great deal of searching resulted in what I left for you.

Can you explain this?

I kill all the .NET svchost processes

If you're just going to kill them, why don't you just stop them from starting up in the first place?

 

[DrazharLn]

**Previous post removed**

I had a trogan masquerading as windows update's svchost running a spambot operation on my computer. At each runtime, it was resurrected by a modified userinit.exe.

Thanks for reminding me to check the startup entries. I'd done it before, but I missed that one of the entries resurrected itself upon deletion.

Sorry if I offended you with my second post, it was not meant in an argumentative manner.

 

[Bobbye]

Too bad you didn't just go through the Virus and Malware Removal in the first place! It might have saved some frustration. Trying to outguess a computer system rarely works.

If you decide to do the cleaning: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/