svchost.exe 100% CPU Usage

Zee · 01-06-2006, 20:15

I did a system restore about an hour ago, now everytime i reboot the computer svchost.exe uses 100% cpu for about 10 minutes then goes fine.

There are 2 svchost.exe in my process list, the one that is causing the problem is the "NETWORK SERVICE" not the "Local service"

I'm using Windows XP with Service Pack 2 installed.

Anyone know how to sort this issue?

Thanks in advanced.

bilal · 01-06-2006, 20:36

well ive got 5... there a lot of svchost.exe that are viruses, could be a virus. If you think something went wrong with the resotre and u did not have this problem before go back a bit further

mhuggett · 01-06-2006, 20:37

Having a look around sounds like it could be spyware of some description.

Have a look at this
http://irish.typepad.com/irisheyes/2...vchostexe.html
As he appears to have had the same issue.

What was the reason for the system restore if you dont mind me asking?

Zee · 01-06-2006, 20:43

When i typed certain websites, like www.morpheus.com instead what would come up is www.www.morpheus.com.org and it'd happen on other websites too.

I'm running Webroot Spy Sweeper now, i wonder if anything will come up, thanks for your help.

I'll run AntiVirus after AntiSpyware.

grubbymitts · 01-06-2006, 20:44

if svchost is in your system32 folder then it is legit. Five occurences of it are quite normal, as it does all sorts of things for the OS from what I've gathered. But it shouldn't run at 100% of the cpu.

Paul K · 01-06-2006, 20:49

As above, SVCHOST is windows service host and is normal. You need to find out where it is though as there was a trojan doing the rounds masquerading as svchost a while back. How many versions of svchost you have running at any one time depends solely on what you are doing and how many are required.
Check the process name to make sure it is the correct file and then search for it on the PC to make sure it's in system32, if it isn't then it may be a problem.

Toto · 01-06-2006, 20:58

Quote:

Originally Posted by Jack001

When i typed certain websites, like www.morpheus.com instead what would come up is www.www.morpheus.com.org and it'd happen on other websites too.

I'm running Webroot Spy Sweeper now, i wonder if anything will come up, thanks for your help.

I'll run AntiVirus after AntiSpyware.

And this would really explain about the speed issues you were complaining to ntl about in your other thread.

Do a search for your hosts file, and if it has a lot of entries in there, or doesn't look like this:

Code:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost

then you probably have spyware/virus/Trojan Horse issues

You may want to try Trojan Hunter as a possible remedy to this problem.

Zee · 01-06-2006, 21:05

Quote:

Originally Posted by Toto

And this would really explain about the speed issues you were complaining to ntl about in your other thread.

Do a search for your hosts file, and if it has a lot of entries in there, or doesn't look like this:

Code:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
 
127.0.0.1       localhost

then you probably have spyware/virus/Trojan Horse issues

You may want to try Trojan Hunter as a possible remedy to this problem.

Yeah, i did that after Spy Sweeper complained the Hostfile was to big, so i clearned it up.

There are 2 "HOSTS" in: C:\WINDOWS\SYSTEM32\DRIVERS\ETC

One is a read only with loads of sites in it and it's 1.5MB in size, the other is one i've made which is a text document, how comes it isn't replacing the HOSTS file which is causing the problem?

Toto · 01-06-2006, 21:25

Quote:

Originally Posted by Jack001

Yeah, i did that after Spy Sweeper complained the Hostfile was to big, so i clearned it up.

There are 2 "HOSTS" in: C:\WINDOWS\SYSTEM32\DRIVERS\ETC

One is a read only with loads of sites in it and it's 1.5MB in size, the other is one i've made which is a text document, how comes it isn't replacing the HOSTS file which is causing the problem?

Good question.

That read only HOSTS file is the one that concerns me, it should not be that big, and if you are able to read it, and it refers to a lot of security web sites, then you definately have a a problem.

What directory is that 1.5MB file in?

DOH!, scrap that question sorry, if the large file is read only, try using system restore to a known good save point. OR, you can drop into safe mode and delete that large hosts file. Windows should build a new hosts file on reboot. However, if after the reboot the file comes back, you will need to resolve the vulnerability first, as it is likely having the corrupted hosts file rebuilt by a dodgy registry entry.

mmm · 01-06-2006, 21:30

Quote:

Originally Posted by Jack001

Yeah, i did that after Spy Sweeper complained the Hostfile was to big, so i clearned it up.

There are 2 "HOSTS" in: C:\WINDOWS\SYSTEM32\DRIVERS\ETC

One is a read only with loads of sites in it and it's 1.5MB in size, the other is one i've made which is a text document, how comes it isn't replacing the HOSTS file which is causing the problem?

At a guess you are hiding file extensions, and the one you have made is .txt, the file you want is just hosts no extension

Zee · 01-06-2006, 21:32

Quote:

Originally Posted by Toto

Good question.

That read only HOSTS file is the one that concerns me, it should not be that big, and if you are able to read it, and it refers to a lot of security web sites, then you definately have a a problem.

What directory is that 1.5MB file in?

It's in C:\WINDOWS\SYSTEM32\DRIVERS\ETC

EDIT:

I've managed to delete all the website's and IP's in that hostfile, this is now what it says, is there anything i need to delete or add to it:

# Hosts in use:
# Block Adverts (http://remember.mine.nu/)
#
################################################## ###################
# The Hosts File Project http://hostsfile.mine.nu
# Global Advert Servers Blocklist - Personal Edition
################################################## ###################
# Release 26/05/2006
# Servers Verified as up and running 04/03/2006 (by dns resolving)
# Updated sorted and maintained by Andrew Short (sh0rtie)
# Contact: wduk10@hotmail.com
################################################## ###################
# A big thank you to all contributers (too many to mention)
# who really have made this project a success, well done

# Licensed under the LGPL a copy of the license may be viewed at
# http://www.gnu.org/licenses/lgpl.txt
################################################## ####################
# WARNING:
# This file is *extremely comprehensive* and some sites might be
# included here that you wish to visit, if this is the case you can
# deactivate the block on that site by placing a # (octothorpe)symbol
# before its entry, this will deactivate blocking on that server
# so for example #127.0.0.1 foobar.com
# will enable you to visit foobar.com or you can just simply delete
# the line that contains the site you wish to visit.
# NB:
# For some computer software updates you may need to disable
# this file in order to perform the update, if you have problems
# rename this file from "hosts" to "hosts.txt" reboot then perform
# the update and then rename this file back to "hosts" to re-enable it
################################################## ####################
# You must keep the below lines
127.0.0.1 localhost
#102.54.94.97 rhino.acme.com # source server
#38.25.63.10 x.acme.com # x client host

Druchii · 01-06-2006, 21:37

Nope, that's in top shape, well done.

Zee · 01-06-2006, 21:39

Quote:

Originally Posted by Druchii

Nope, that's in top shape, well done.

Thanks, and thanks everyone else in this thread, going to restart and see if browsing speeds improve or websites work again ...

I'll tell you guys in a min if it works

EDIT:

All websites are working like they should, svchost.exe isn't using 100% CPU anymore.

I'm still getting slow download speeds, 2.38Mbps on the speed test, but that's better then 56K.

THANK YOU everyone

Druchii · 01-06-2006, 21:49

Glad you got it solved mate

greencreeper · 01-06-2006, 22:08

Hmmm. I would expect the hosts file to make a system faster - some DNS queries would be resolved locally rather than having to query the DNS server

If it happens again, the following DOS command will shed light on what the svchost is up to.

tlist /svc