Re: CPU usage at 100% for no apparant reason

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Bruce Chambers (bchambers_at_nospamcableone.net)
Date: 02/07/04 

Date: Sat, 7 Feb 2004 11:10:19 -0700

Greetings --

    It's perfectly normal to have several instances of Svchost.exe
running simultaneously.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

    However, if Svchost.exe is using a large portion of your CPU
cycles, it has most likely been "hijacked" by a worm or Trojan. Have
you tried using a decent antivirus application with the most
currently-available virus definition files? A strong candidate would
be W32.Welchia.Worm.

W32.Welchia.Worm a.k.a. W32/Nachi.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

    There is also a legitimate service called "lsass.exe," which is
the LSA Shell. Is this what you meant, or is the process you have
really named "LSAS.EXE?" If the latter, it's probably a Trojan or
Worm component.

  Because many of the newer viruses and worms can disable antivirus
applications whose definitions weren't up-to-date, try using one or
more of the free on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp

Bruce Chambers 

--
Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html
You can have peace.  Or you can have freedom.  Don't ever count on
having both at once. -- RAH
"Matt" <anonymous@discussions.microsoft.com> wrote in message
news:c71301c3ed99$47aa7b00$a501280a@phx.gbl...
> Bruce,
> There are some 34 processes ongoing yet I have only 4
> IE windows open and task manager. Many of these
> processes register as 00 under cpu. The big users are:
> System
> SVCHOST.exe (there are two of these)
> LSAS.exe
>
> I am trying to install Norton Internet security and i
> need to open MSCONFIG via run. When I do the window
> gets closed for no apparant reason.
>
> Appreciate any help you can give.
>
> Matt
>
> >-----Original Message-----
> >Greetings --
> >
> >    Perhaps, but only if you first tell us what specific
> process(es)
> >is(are) consuming those CPU cycles.
> >
> >Bruce Chambers
> >
> >--
> >Help us help you:
> >http://dts-l.org/goodpost.htm
> >http://www.catb.org/~esr/faqs/smart-questions.html
> >
> >You can have peace.  Or you can have freedom.  Don't
> ever count on
> >having both at once. -- RAH
> >
> >
> >"Matt" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:bcd501c3ed91$6d96dc30$a301280a@phx.gbl...
> >> CPU usage at 100% for no apparant reason
> >> Can someone tell me what cause this to happen
> >
> >
> >.
> >

Relevant Pages

  • Re: Ive been hurt by an e-mail virus ! What virus is it ? - BadTrans - REMOVAL INSTRUCTIONS AND INFO
    ... Run your Windows Updates. ... This mass mailing worm attempts to send itself using ... backdoor trojan), ... type %WINDIR% and hit ENTER ...
    (Security-Basics)
  • Re: Firewall software.
    ... > I block outgoing just in case a virus, trojan, or worm does get onto my ... > all Internet traffic originated or received by my other machine ... When running Windows, that machine can send only to ...
    (comp.os.linux.networking)
  • Re: Firewall software.
    ... > I block outgoing just in case a virus, trojan, or worm does get onto my ... > all Internet traffic originated or received by my other machine ... When running Windows, that machine can send only to ...
    (comp.os.linux.setup)
  • FW: Actions for the Blaster Worm - Special Edition, TechNet Flash
    ... Actions for the Blaster Worm - Special Edition, ... You are receiving this message because you are a Microsoft newsletter ... Presence of the file msblast.exe in the WINDOWS SYSTEM32 directory ... antivirus vendor and scan your machine. ...
    (Focus-Microsoft)
  • Re: Cant apply KB835732 on various Win2k systems
    ... So these machines have the Sasser worm? ... Microsoft has learned about a worm identified as "W32.Sasser.worm" that is ... Windows XP Professional ... > AnalyzePhaseOne: used 7691 ticks ...
    (microsoft.public.win2000.security)