svchost running at 100%

BigDunc

Can any help with a problem I am having with my PC? It started running slowly a couple of weeks or so ago. I checked task manager and found that svchost.exe was running at 100%. After a lot of faffing about it looks like the problem is relating to the Windows Automatic Update service. If I disable the service and restart the computer it runs normally, if not then it slows to a crawl.

I did have a problem before Christmas with an automatically downloaded update from Microsoft. I'm running Win XP Home and as you shut down you occasionally get messages saying something like "installing update 1 of 1, please do not switch off your PC". This update would not install, no matter how long the PC was left on - 4 hours in one case when I forgot I had left it on. It eventually seemed to resolve itself after a couple of weeks, but I now assume the two problems are related.

I'm now in the situation where I cannot load any new updates from Microsoft because of this. Can anyone suggest a way around this?

Many thanks

Duncan

albertross_2

Try a scan..

http://safety.live.com/site/en-US/default.htm

Chippy_Minton

Try changing Automatic Updates so it only notifies you when updates are available. Then if the pop-up appears telling you that updates are available, click to download them and then install them.

If that doesn't fix the problem, disable the Automatic Updates service and download the updates from the Windows Update Catalogue - see How to download updates and drivers from the Windows Update Catalog.

intel

Chippy_Minton wrote:

Try changing Automatic Updates so it only notifies you when updates are available. Then if the pop-up appears telling you that updates are available, click to download them and then install them.

If that doesn't fix the problem, disable the Automatic Updates service and download the updates from the Windows Update Catalogue - see How to download updates and drivers from the Windows Update Catalog.

You know that IE6 can be saved to disk http://www.updatexp.com/download-ie6.html

Well Can you do that with all updates so far to a CDr or RW for later install.?

Rex_Mundi

I would be concerned about svchost running at this level. Although it is a legitimate part of windows, it has been used by a few viruses (they run themselves under this name) and this would be my first concern in this case.

First I would scan with all my antivirus/antispyware software. Then I would do a couple of online scans to double check. Only after this would I look at Windows to make sure that the processes are running and installed correctly.

This process should not be running at this level, and needs to be sorted out.

Chippy_Minton

intel wrote:

You know that IE6 can be saved to disk http://www.updatexp.com/download-ie6.html

That's for IE6 SP1, so it's a bit out of date. I don't think IE6 SP2 can be downloaded separately as it's part of XP SP2.

intel wrote:

Well Can you do that with all updates so far to a CDr or RW for later install.?

Yes, sort of. Automatic Update downloads are saved in C:\WINDOWS\SoftwareDistribution\Download, however I think this folder is automatically purged after a few days, so you'd have to grab them fairly soon. With Windows Update Catalog you can download individual updates and specify a download folder and then you could burn them to CD. Useful if you want to update several PCs, or give the updates to someone without a broadband connection.

pchelpman

Hi BigDunc

Can you find WHERE that suspicious svchost file is running from?

It should be running from the System 32 folder thus ...

C:\windows\system32\svchost.exe

However, if it's running from anywhere else like the WINDOWS folder ...

C:\WINDOWS\SYSTEM\svchost.exe

... you most likely have a malware infection.

If the online scanners don't fix it post a HijackThis log and someone will give you more advice.

BigDunc

Thanks for all of your responses. I followed albertross' suggestion but as soon as I tried to run the online scanner from safety.live.com the svchost process shot up to 100%. It was the same when I had the Windows Update disabled and then tried to install some phone software for my son; it triggered a Microsoft update and that caused svchost to run at 100% too.

So far I have checked my PC with Norton Anti-virus, Microsoft Anti-spyware, Ad-aware and Spybot. All have proved negative. I will download Hijack this and post the results.

A scan of my hard drive shows three copies of svchost.exe, all in subdirectories of c:\windows ; one in system32, one in $NTServicePackUninstall$ and one in ServicePackFiles\i386. Nothing seems out of the ordinary there.

Can anyone recommend a good on-line scanner? It's not something I have come across before.

Many thanks,

Duncan

Toxteth_OGrady

BigDunc wrote:

Can anyone recommend a good on-line scanner?

Here.

:cool:

TOG

Moss5

http://uk.trendmicro-europe.com/consumer/housecall/housecall_launch.php
I had the same problem years ago.
McFee and Norton found no fault during on-line scans.
Trend Micro fixed the problem with their 'House Call' scan. Takes a hour to do (depending on how many files on your C drive), but worth the trouble.
I rewarded them by signing up for PC Cillin.
It is important to take all updates offered by Microsoft.

pchelpman

Moss5 wrote:

http://uk.trendmicro-europe.com/consumer/housecall/housecall_launch.php
Trend Micro fixed the problem with their 'House Call' scan. Takes a hour to do (depending on how many files on your C drive), but worth the trouble.
I rewarded them by signing up for PC Cillin.

PC Cillin isn't as good, I've found, as the free Housecall scan. PC Cillin can be extremely difficult to remove if you want to move away from it to something else.

That said, yes, Housecall is a good online scanner but remember two things about it (and indeed other online scanners) ......

1. Not even Housecall sees everything

and

2. Housecall is changing. There may be some things it finds but won't now "fix" unless you pay for their removal tool.

Don't buy anything at this stage. Just post the HJT log AND details of anything the online scanners won't fix.We'll do the rest from here with manual removal instructions.