SVCHOST problem (I think)

[mharper]

My wife’s computer goes into never land after XP boots. The second she clicks on something it starts. After 15 minutes of the hour glass and hearing the disk thrash, it seems to come back to reality and everything she had clicked on, including ctrl-alt-del seems to open. Once she got a window open with ctrl-alt-del before it all started and it appeared that SVCHOST was taking up 100% of the CPU. This happens every time the computer is turned on. After she waits out the first 15 minutes things seem to be fine. Any thoughts?

 

[gbhall]

svchost is very commonly hijacked by nasties, and you are almost certainly a case. Try a house call from trendmicro www.trendmicro.com/hc_intro/default.asp

 

[mharper]

Tried Trend-Micro

Thanks for your suggestion. We tried Trend-Micro and it found a few things, Weather Bug was one, that didn't seem to amount to much. It did note possible problems with MS Office 2003. There is a list updates that won't install for Office 2003. Do you suppose uninstalled updates are part of the problem?

 

[howard_hopkinso]

Go and read this thread HERE and post a HJT log as an attachment into this thread. If it turns out your system is infected, I`ll move this thread to our Security and the Web forum.

Regards Howard

 

[mharper]

HJT log file

I hope this is what you were talking about. If this can tell you anything I'd love to know what it means.

Thanks

 

[howard_hopkinso]

I`d like you to have a couple of files checked out over at Jotti`s

Please visit this link http://virusscan.jotti.org/
* Click the Browse... button
* Navigate to the following file C:\Program Files\LDS Media\LDS Library\6.0.0\LDSLibQuickStart.exe
* Click Open
*Then do the same for this file. c:\program files\moveminute\05091201\movemedia.exe
* Please let me know the results.

Regards Howard

 

[gbhall]

Another thought

A PC 'trying do start' can occasionally be a symptom of a very bad spot or spots on the hard-disk surface, which eventually (after many tries) is read - perhaps when the drive warms up.

To eliminate this possibility, it is worth running something more capable than Scandisc. Download your HDD manufacturers test software, or other thorough testers available off the web

 

[mharper]

Conclusion to the SVCHOST problems (I think)

I did check out the things Howard suggested in his last post (thank you, Howard, for your suggestions), but nothing seemed malicious. We just lived with the problem and allowed an hour for boot up every day.
We recently installed MS Office 2007 but for a week we kept MS Office 2003 version installed as well. When we uninstalled the 2003 version the SVCHOST problems disappeared.
AHA! Months ago we had updates from MS that didn't install properly and didn't allow the system to shut down properly. We had tried several things and felt we had narrowed that down to Office 2003 updates. What ever we did we got the system shutting down OK. I didn't put the uninstalled updates together with the SVCHOST thing because I don't remember a specific time relation between shut down problems and boot up problems. I'm now guessing that SVCHOST was thrashing about with the updates not installing properly on boot up rather than shutdown.
I'm not 100% sure this is the case, but we don't have to wait an hour after boot up to actually use the computer.
Hmmmm, since things are working well now I wonder if I should cancel the order I just placed for a dual core system with 4 gigs of DDR2 memory??
...nah, I don't think so.