svchost.exe 100% CPU Usage
 

I did a system restore about an hour ago, now everytime i reboot the computer svchost.exe uses 100% cpu for about 10 minutes then goes fine.

There are 2 svchost.exe in my process list, the one that is causing the problem is the "NETWORK SERVICE" not the "Local service"

I'm using Windows XP with Service Pack 2 installed.

Anyone know how to sort this issue?

Thanks in advanced.

Re: svchost.exe 100% CPU Usage
 

well ive got 5... there a lot of svchost.exe that are viruses, could be a virus. If you think something went wrong with the resotre and u did not have this problem before go back a bit further

Re: svchost.exe 100% CPU Usage
 

Having a look around sounds like it could be spyware of some description.

Have a look at this
http://irish.typepad.com/irisheyes/2...vchostexe.html
As he appears to have had the same issue.

What was the reason for the system restore if you dont mind me asking?

Re: svchost.exe 100% CPU Usage
 

When i typed certain websites, like www.morpheus.com instead what would come up is www.www.morpheus.com.org and it'd happen on other websites too.

I'm running Webroot Spy Sweeper now, i wonder if anything will come up, thanks for your help.

I'll run AntiVirus after AntiSpyware.

Re: svchost.exe 100% CPU Usage
 

if svchost is in your system32 folder then it is legit. Five occurences of it are quite normal, as it does all sorts of things for the OS from what I've gathered. But it shouldn't run at 100% of the cpu.

Re: svchost.exe 100% CPU Usage
 

As above, SVCHOST is windows service host and is normal. You need to find out where it is though as there was a trojan doing the rounds masquerading as svchost a while back. How many versions of svchost you have running at any one time depends solely on what you are doing and how many are required.
Check the process name to make sure it is the correct file and then search for it on the PC to make sure it's in system32, if it isn't then it may be a problem.

Re: svchost.exe 100% CPU Usage
 

And this would really explain about the speed issues you were complaining to ntl about in your other thread.

Do a search for your hosts file, and if it has a lot of entries in there, or doesn't look like this:

then you probably have spyware/virus/Trojan Horse issues

You may want to try Trojan Hunter as a possible remedy to this problem.

Re: svchost.exe 100% CPU Usage
 

Yeah, i did that after Spy Sweeper complained the Hostfile was to big, so i clearned it up.

There are 2 "HOSTS" in: C:\WINDOWS\SYSTEM32\DRIVERS\ETC

One is a read only with loads of sites in it and it's 1.5MB in size, the other is one i've made which is a text document, how comes it isn't replacing the HOSTS file which is causing the problem?

Re: svchost.exe 100% CPU Usage
 

Good question.

That read only HOSTS file is the one that concerns me, it should not be that big, and if you are able to read it, and it refers to a lot of security web sites, then you definately have a a problem.

What directory is that 1.5MB file in?

DOH!, scrap that question sorry, if the large file is read only, try using system restore to a known good save point. OR, you can drop into safe mode and delete that large hosts file. Windows should build a new hosts file on reboot. However, if after the reboot the file comes back, you will need to resolve the vulnerability first, as it is likely having the corrupted hosts file rebuilt by a dodgy registry entry.

Re: svchost.exe 100% CPU Usage
 

At a guess you are hiding file extensions, and the one you have made is .txt, the file you want is just hosts no extension

Re: svchost.exe 100% CPU Usage
 

It's in C:\WINDOWS\SYSTEM32\DRIVERS\ETC

EDIT:

I've managed to delete all the website's and IP's in that hostfile, this is now what it says, is there anything i need to delete or add to it:

# Hosts in use:
# Block Adverts (http://remember.mine.nu/)
#
################################################## ###################
# The Hosts File Project http://hostsfile.mine.nu
# Global Advert Servers Blocklist - Personal Edition
################################################## ###################
# Release 26/05/2006
# Servers Verified as up and running 04/03/2006 (by dns resolving)
# Updated sorted and maintained by Andrew Short (sh0rtie)
# Contact: wduk10@hotmail.com
################################################## ###################
# A big thank you to all contributers (too many to mention)
# who really have made this project a success, well done :)
# Licensed under the LGPL a copy of the license may be viewed at
# http://www.gnu.org/licenses/lgpl.txt
################################################## ####################
# WARNING:
# This file is *extremely comprehensive* and some sites might be
# included here that you wish to visit, if this is the case you can
# deactivate the block on that site by placing a # (octothorpe)symbol
# before its entry, this will deactivate blocking on that server
# so for example #127.0.0.1 foobar.com
# will enable you to visit foobar.com or you can just simply delete
# the line that contains the site you wish to visit.
# NB:
# For some computer software updates you may need to disable
# this file in order to perform the update, if you have problems
# rename this file from "hosts" to "hosts.txt" reboot then perform
# the update and then rename this file back to "hosts" to re-enable it
################################################## ####################
# You must keep the below lines
127.0.0.1 localhost
#102.54.94.97 rhino.acme.com # source server
#38.25.63.10 x.acme.com # x client host

Re: svchost.exe 100% CPU Usage
 

Nope, that's in top shape, well done.

Re: svchost.exe 100% CPU Usage
 

Thanks, and thanks everyone else in this thread, going to restart and see if browsing speeds improve or websites work again ...

I'll tell you guys in a min if it works :)

EDIT:

All websites are working like they should, svchost.exe isn't using 100% CPU anymore.

I'm still getting slow download speeds, 2.38Mbps on the speed test, but that's better then 56K.

THANK YOU everyone :)

Re: svchost.exe 100% CPU Usage
 

Glad you got it solved mate :)

Re: svchost.exe 100% CPU Usage
 

Hmmm. I would expect the hosts file to make a system faster - some DNS queries would be resolved locally rather than having to query the DNS server :erm: If it happens again, the following DOS command will shed light on what the svchost is up to.

tlist /svc

Re: svchost.exe 100% CPU Usage
 

But wouldn't it attempt to load the hosts file into memory at system start-up ?

Re: svchost.exe 100% CPU Usage
 

It would load it into the DNS cache.

Have symptom. Find a bad thing. Not necessarily the bad thing.

Re: svchost.exe 100% CPU Usage
 

Just for completeness, if you're wondering whether the svchost.exe you see listed in Task Manager is legit or not, you should download the excellent Process Explorer utility from Sysinternals. This gives a whole load more useful info than the Windows bog-standard Task Manager, including which services each instance of svchost.exe is managing. It's a really useful tool to have and it's free :)