svchost.exe is eating full cpu

girardo

Hello guys,

I have this problem with schost.exe. it uses full cpu and it slows down all other activities on my computer. When can I do against it? Is it some sort of error or is a virus?

I ve tried to get the solution from internet but it seems to me that nobody exactly knows what it is.

Do you have any idea what iit is and how I can let my computer function properly again?

thanks

Tex

You use Kaaza by any chance? They have several worms that work with peer 2 peer sharing related software. Disable or remove your NIC and reboot. I bet its fine when you have no nic/modem to access the web

girardo

Tex wrote:

You use Kaaza by any chance? They have several worms that work with peer 2 peer sharing related software. Disable or remove your NIC and reboot. I bet its fine when you have no nic/modem to access the web

thanks for your reply. i indeed use kazaa. could you tell me more specific how to remove nic and what is? I am not really an computerexpert, sorry.

Tex

NIC is your network card. There is a "worm" a sort of virus spread through Kaaza and other P2P sites. Its running and uploading stuff off your system. The symptoms are having svchost nailing your system at 100 percent cpu usage. Removing or disabling the NIC doesnt cure the problem but will give you a good idea of whats causing the grief.

Tex

Tex

It can also be spyware and adware. coolwebsearch has shown the same symptoms at times. Have you run cwshredder and adaware and spybot? Start there and try posting a hijack log down in the virus/spyware section would be a good place to start.

svshost is more of a service that controls starting other services/dll's its not svchost itself thats killing you its the service or program its launching

Tex

girardo

Tex wrote:

It can also be spyware and adware. coolwebsearch has shown the same symptoms at times. Have you run cwshredder and adaware and spybot? Start there and try posting a hijack log down in the virus/spyware section would be a good place to start.

svshost is more of a service that controls starting other services/dll's its not svchost itself thats killing you its the service or program its launching

Tex

I frequently use adaware and spybot. I will try cwshredder also. Thanx for your advise. Would the problem be fixed if I removed kazaa from my computer?

Tex

Can't answer that one. You have good virus software thats virus defs are uptodate right?

Go run hijack this and post in the forum below where I pointed ya and I bet they solve your problem. I know some folks love Kaaza. More crap and malacious stuff gets spread through them I forbid it in my house anyway.

Tex

pitputin

Dummy description of svchost.exe is that it acts as an agent for different applications. It fetches or gets its "manual" and does what it's told. This means that if its manual is corrupted ( due to some biterror somewhere along the path) it can loop, get nowhere, ask for more and more resources and never finish.
In that case it is possible to run msconfig from /Run and type "tasklist /svc" and figure out which processses that asks for its help, and by trial-and-error detect which process that is the cause of the problem. ( Important thing is that its not the process that calls svchost that is corrupted, most likely it is the "manual" it presents for svchost) Good ol' reinstallment of the application that runs the process is nr1 thing to do... if you detect the process that is.
Deleting the svchost.exe file will most likely not solve your problem and is neither advisable as it is being used by multiple applications on your system ranging from detecting network channels to displaying nice fonts..The problem is most likely not the svchost.exe itself.

The "manual" I mention is a .dll file

Case 2 is trickier:

Hackers can design a process or thread that calls svchost.exe to do certain instructions, then imediatly it will shut itself down, making it harder to detect it in tasklist, as the process is already terminated and maybe designed to cover its identity as even being seen as a process to the operating system.

Svchost.exe though has not terminated, it either does heavy amounts of work that leads to nowhere but eats resources ( picture you get put to dig a hole in the ground, and when it is deep enough , you are instructed to fill it), or it can easily enough be asked to ask CPU for loads of resources ( "o'boy mr CPU.. heavy shipment coming in, I need your full attention") but no work is ever being done. This can explain the reason why it jumps from 10% to100% back and forth. Regardless of the two ways a hacker can "trick" svchost.exe to do work w/o any goal other than to eat CPU resources, problem is still the fact that it gets initiated by a process or thread no longer running. If you can find a suspicious process in your pc, sure.. it might be it, but a virus program will never find these as it has no similarity to any virus. Format the computer and reinstall :/

DanG

Anyone still having this problem can fix it with these 2 updates. It's a new issue with windows update.
http://www.microsoft.com/downloads/details.aspx?familyid=7A81B0CD-A0B9-497E-8A89-404327772E5A&displaylang=en

http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe

Qeldroma

pitputin wrote:

If you can find a suspicious process in your pc, sure.. it might be it, but a virus program will never find these as it has no similarity to any virus. Format the computer and reinstall :/

No.

Perhaps this is a waste of webspace bandwidth, but I guess I’m struggling with this because:

1. It resurrects a nearly 3-year dead thread,
2. In the Emergency section by someone who clearly doesn’t have one and,
3. Has nothing better to do than write a long-winded post that incorrectly suggests that a reformat is the way to handle this.

Am I the only one? May I suggest at least a split or a move?

DanG

hahaha, I never even looked at the date on the original post.