Re: WinXP SE: SvcHost (SYSTEM) process takes most of CPU

From: Arvi Laanemets (garbage_at_hot.ee)
Date: 01/27/05 

Date: Thu, 27 Jan 2005 15:38:41 +0200

Hi

Thanks! I downloaded it. I'll give it a try today or tomorrow evening.

I agree that this don't look like virus. Maybe something is trying to
connect to somewhere outside, but can't. P.e. some trojan or spyware
component, which was partially removed. Or firewall doesn't let it to
connect. It look like some process is desperately trying to connect at
start, and when convienced that this isn't possible, runs some check after
every 20-30 seconds. 

-- 
When sending mail, use address arvil<at>tarkon.ee
Arvi Laanemets
"PaddyBob" <PaddyBob@discussions.microsoft.com> wrote in message
news:ON63usGBFHA.3336@TK2MSFTNGP11.phx.gbl...
> Hi Arvi,
>
> It would come in handy to know exactly which process of the SVCHost is
> giving you problems, as svchost is controlling loads and loads of
processes.
> (Just to name a couple: DNSCache, Eventsystem, Seclogon, WinMgmt, etc...
> there's more than 20 on a normal Domain Networked XP-Pro machine. On a HE
> machine, there will be a couple less, but still an impressive amount)
>
> Check if you're able to download the process explorer from
> http://www.sysinternals.com
> Let us know what you finally find out which exact SVCHost process is
giving
> you trouble. To be quite honest with you, I don't think this is a virus,
> however, it might be malware or a rogue service...
>
> Cheers,
>
> Robert
>
>
> "Arvi Laanemets" <garbage@hot.ee> wrote in message
> news:OSCkJYFBFHA.2156@TK2MSFTNGP10.phx.gbl...
> > Hi
> >
> >
> > "Kelly" <kelly@mvps.org> wrote in message
> > news:uxoSV0EBFHA.2192@TK2MSFTNGP14.phx.gbl...
> >> Pretty much normal.  What does System Idle read?
> >
> > 100% - SvcHost% - taskmgr%(~4%) - RemainingProcesses%(~2%...3%), i.e.
> > something between 70% and 0% mostly, average will be somewhere between
> > 30%-40%, I think, but ~10% of time it's less than 10% System Idle CPU -
> > with
> > only Task manager opened.
> >
> >> http://www.google.com/search?hl=en&q=SvcHost&btnG=Google+Search
> >>
> >> In the meantime, run this combo:
> >>
> >> Run Ad-Aware SE, Spybot and HijackThis:
> >> http://www.majorgeeks.com/downloads31.html
> >
> > Runned both Ad-Aware and Spybot (both updated). I didn't use HijackThis,
> > because I have tried it once only on my own computer, and I was not sure
> > about results it returned. There was a bunch or registry entries which
> > were
> > defined as changed, but I didn't have such entries in my registry at all
> > !?
> >
> >
> >>
> >> Note:   Update each program, once installed, before running.
> >>
> >> Free Online Virus Scan
> >> http://housecall.trendmicro.com/housecall/start_corp.asp
> >
> > It was one of 3 various antiviruses I used to scan the computer with. It
> > was
> > too late for me yesterday to try the second another online scanner, I
use
> > sometimes (www.bitdefender.com).
> >
> >
> > -- 
> > When sending mail, use address arvil<at>tarkon.ee
> > Arvi Laanemets
> >
> >
> >
>
>

Relevant Pages

  • Re: WinXP SE: SvcHost (SYSTEM) process takes most of CPU
    ... I agree that this don't look like virus. ... > It would come in handy to know exactly which process of the SVCHost is ... > Check if you're able to download the process explorer from ... >> Arvi Laanemets ...
    (microsoft.public.windowsxp.general)
  • Re: WinXP SE: SvcHost (SYSTEM) process takes most of CPU
    ... Exactly why you need to trust HijackThis! ... use address arviltarkon.ee> Arvi Laanemets ... >> It would come in handy to know exactly which process of the SVCHost is>> giving you problems, as svchost is controlling loads and loads of> processes. ... To be quite honest with you, I don't think this is a virus,>> however, it might be malware or a rogue service... ...
    (microsoft.public.windowsxp.general)
  • Re: WinXP SE: SvcHost (SYSTEM) process takes most of CPU
    ... Exactly why you need to trust HijackThis! ... use address arviltarkon.ee> Arvi Laanemets ... >> It would come in handy to know exactly which process of the SVCHost is>> giving you problems, as svchost is controlling loads and loads of> processes. ... To be quite honest with you, I don't think this is a virus,>> however, it might be malware or a rogue service... ...
    (microsoft.public.windowsxp.basics)
  • Re: computer virus usegroups
    ... New Virus Stealing Information from Computer Users ... You can infect ... attempt to download from a Russian website. ... Internet Explorer to protect users of its Internet Explorer browsers ...
    (sci.med.diseases.lyme)
  • Re: hacktool.rootkit
    ... In addition to "what is a rootkit". ... > mode virus scanning, registry entry purging, etc.). ... Norton Antivirus reported the following: ... >> You can choose to go to each menu item and just download the needed files ...
    (microsoft.public.security.virus)