svchost on 99%

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

plz help me. the process "svchost.exe" is taking all the CPU with 99%. It is
a SYSTEM process and when i close it windows makes a 50 sec countdown on
restaring itself.
please help.
3 answers Last reply
More about svchost
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    1) Download the following three items...

    McAfee Stinger
    http://vil.nai.com/vil/stinger/

    Trend Sysclean Package
    http://www.trendmicro.com/download/dcs.asp

    Latest Trend signature files.
    http://www.trendmicro.com/download/pattern.asp

    Create a directory.
    On drive "C:\"
    (e.g., "c:\New Folder")
    or the desktop
    (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

    Download SYSCLEAN.COM and place it in that directory.
    Download the Trend Pattern File by obtaining the ZIP file.
    For example; lpt434.zip

    Extract the contents of the ZIP file and place the contents in the same directory as
    SYSCLEAN.COM.

    2) Disable System Restore
    http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
    3) Reboot your PC into Safe Mode and shutdown as many applications as possible
    4) Using both the Trend Sysclean utility and Stinger, perform a Full Scan of your
    platform and clean/delete any infectors found
    5) Restart your PC and perform a "final" Full Scan of your platform using both.
    6) Re-enable System Restore and re-apply any System Restore preferences,
    (e.g. HD space to use suggested 400 ~ 600MB),
    7) Reboot your PC.
    8) Create a new Restore point


    * * * Please report back your results * * *

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html


    "Mike" <Mike@discussions.microsoft.com> wrote in message
    news:26EEFD84-E98C-47FB-8A41-4BF23905E2BE@microsoft.com...
    | plz help me. the process "svchost.exe" is taking all the CPU with 99%. It is
    | a SYSTEM process and when i close it windows makes a 50 sec countdown on
    | restaring itself.
    | please help.
    |
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    thank you for posting David, but it didnt help. i have downloaded the tools,
    scanned my pc with the "stinger" and "sysclean" and found no viruses. This
    time it was all normal for almost 1 day (pc was connected to internet all the
    time) but suddenly "svchost" went 99%. I just don't know what do do anymore ..


    "David H. Lipman" wrote:

    > 1) Download the following three items...
    >
    > McAfee Stinger
    > http://vil.nai.com/vil/stinger/
    >
    > Trend Sysclean Package
    > http://www.trendmicro.com/download/dcs.asp
    >
    > Latest Trend signature files.
    > http://www.trendmicro.com/download/pattern.asp
    >
    > Create a directory.
    > On drive "C:\"
    > (e.g., "c:\New Folder")
    > or the desktop
    > (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
    >
    > Download SYSCLEAN.COM and place it in that directory.
    > Download the Trend Pattern File by obtaining the ZIP file.
    > For example; lpt434.zip
    >
    > Extract the contents of the ZIP file and place the contents in the same directory as
    > SYSCLEAN.COM.
    >
    > 2) Disable System Restore
    > http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
    > 3) Reboot your PC into Safe Mode and shutdown as many applications as possible
    > 4) Using both the Trend Sysclean utility and Stinger, perform a Full Scan of your
    > platform and clean/delete any infectors found
    > 5) Restart your PC and perform a "final" Full Scan of your platform using both.
    > 6) Re-enable System Restore and re-apply any System Restore preferences,
    > (e.g. HD space to use suggested 400 ~ 600MB),
    > 7) Reboot your PC.
    > 8) Create a new Restore point
    >
    >
    > * * * Please report back your results * * *
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    >
    >
    >
    >
    >
    >
    >
    > "Mike" <Mike@discussions.microsoft.com> wrote in message
    > news:26EEFD84-E98C-47FB-8A41-4BF23905E2BE@microsoft.com...
    > | plz help me. the process "svchost.exe" is taking all the CPU with 99%. It is
    > | a SYSTEM process and when i close it windows makes a 50 sec countdown on
    > | restaring itself.
    > | please help.
    > |
    >
    >
    >
  3. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Mike wrote:

    > thank you for posting David, but it didnt help. i have downloaded the
    > tools, scanned my pc with the "stinger" and "sysclean" and found no
    > viruses. This time it was all normal for almost 1 day (pc was
    > connected to internet all the time) but suddenly "svchost" went 99%. I
    > just don't know what do do anymore ..
    >
    Since you've already scanned - in Safe Mode, presumably - with the tools
    that David suggested, continue scanning for non-viral malware. Do
    everything with updated tools in Safe Mode. After you've done this, if
    your computer is clean and the problem persists, look in Event Viewer
    for clues (Start>Run eventvwr.msc [enter]) and try a clean boot in case
    this is a legitimate program or process that isn't working properly.

    Clean Boot - http://support.microsoft.com/default.aspx?kbid=310353

    Remove malware:

    1) Scan in Safe Mode with current version (not earlier than 2004)
    antivirus using updated definitions. NOTE: if you don't have a
    full-featured av installed, get one, install it and update its
    definitions. The av tools David gave you are a *first-line* defense.
    You *must* have an av installed on your hard drive.

    Before you remove malware, get LSPFix (or WinSockFix for XP which you
    can get from MajorGeeks) - see links below.

    2) Remove spyware with Spybot Search & Destroy and Ad-aware. These
    programs are free, so use them both since they complement each other.
    There is a new version of CWShredder from Intermute. I would not
    install the other Intermute programs, however. Alternately, there are
    CoolWebSearch malware removal steps at SilentRunners.

    Be sure to update these programs before running, and it is a good idea
    to do virus/spyware scans in Safe Mode. Make sure you are able to see
    all hidden files and extensions (View tab in Folder Options).

    If the malware remains even after you used Ad-aware and Spybot, you can
    scan with HijackThis. HijackThis is an excellent tool to discover and
    disable hijackers, but it requires expert skill. See below for
    HijackThis links, including sites where you can post your HJT logs. A
    combination of HijackThis and About:Buster works well in removing the
    About:Blank homepage hijacker. Again, this is an expert tool and
    novices should get help with it.

    3) If you are running Windows ME or XP, you should disable/enable System
    Restore after the system is clean because malware will be in the
    Restore Points. With ME, you must disable System Restore completely.
    With XP, you can delete all but the most recent (presumably clean)
    System Restore point from the More Options section of Disk Cleanup
    (Run>cleanmgr).

    4) Make sure you've visited Windows Update and applied all security
    patches. Do not install driver updates from Windows Update.

    5) Run a firewall.

    Links to help with malware:

    Software/Methods:
    http://www.safer-networking.org - Spybot Search & Destroy
    http://www.lavasoftusa.com - Ad-aware
    http://www.majorgeeks.com - good download site
    http://www.intermute.com/spysubtract/cwshredder_download.html
    http://www.silentrunners.org/sr_cwsremoval.html. - SilentRunners
    http://www.cexx.org/lspfix.htm - Repair Winsock 2 settings after
    removing spyware
    http://www.spychecker.com/program/winsockxpfix.html - WinsockXPFix.exe

    HijackThis:
    http://www.aumha.org/a/hjttutor.htm - HijackThis tutorial by Jim
    Eshelman
    http://aumha.net - forums
    http://spywarewarrior.com/viewforum.php?f=5 - Spyware Warrior HijackThis
    forum
    http://www.wilderssecurity.com/
    http://forums.tomcoyote.org/

    General:
    http://aumha.net - look under "Security" for various forums
    http://rgharper.mvps.org/cleanit.htm
    http://mvps.org/winhelp2002/unwanted.htm
    http://www.aumha.org/a/parasite.htm - The Parasite Fight
    http://www.spywarewarrior.com/rogue_anti-spyware.htm

    Malke
    --
    MS MVP - Windows Shell/User
    Elephant Boy Computers
    www.elephantboycomputers.com
    "Don't Panic!"
Ask a new question

Read More

Security Microsoft Windows XP