Anyone else got a SVCHOST hog that is devilishly hard to kill?

peterbaker

I am a very very good PC driver ... and sound like Dustin Hoffman in RAINMAN, don't I?:-) ... I think I drive a bit like him too!

I have worked in IT and am not scared to hack around in my PC.

Anyway, that means that I have used all kinds of Spyware and Malware and Antivirus and Hijackthis and have trawled through umpteen forum articles over the last two or three years in occasional attempts to get rid of trojans and other malware. I have frequently hacked around in regedit like a demented brain surgeon (don't do that at home, boys and girls!) yet my PC (a Pentium III with 1GB RAM) is still going strong.

Generally I nail the nasty viruses, bugs, whatever in the end.

However, I know I have something wrong in my PC at the moment which I am pretty certain I picked up maybe a couple of months ago.

As I write this, there is no problem with my PC's performance because I have found a workaround, but the symptoms are these:

1) The common "my computer runs very very slowly"
2) The Taskbar freezes for minutes at a time, making it totally useless and then suddenly all becomes ok again for a while. Desktop items still work but only after a very long delay.
3) If (and only if) I can get an instance of Windows Task Manager to appear on screen, it shows that my CPU is being overloaded and the main culprit is an instance of SVCHOST.exe.
4) If I reboot, I notice that it takes a while for this SVCHOST.exe item to get into its stride, and therefore if I am quick off the mark, I can open Windows Task Manager and spot it winding up through 20, 30, 50, 60, 90% use of CPU resources ...
5) The workaround - I nail it from Windows Task Manager with End Process even though I have no idea what it is. I have seen no ill effect from doing so and my PC is immediately back to its old self when I do so. And until I reboot again, I have no further problem.

Anyone else seen this/got any ideas of how to
(a) identify what is calling up this particular instance of SVCHOST (there are of course several perfectly legitimate instances of SVCHOST running and it is only my recklessness that nails the right one!)
(b) cure it permanently?

CHR15

Download fabertoys and have a look at the dependencies of that particular instance


http://www.faberbox.com/fabertoys.asp?action=info

Once you can see which specific file/app is being loaded, you have a chance of stopping it.

Chippy_Minton

Download Process Explorer, which tells you the command line of the particular svchost.exe, and from there you can see what its purpose is.

peterbaker

Thanks guys.

I have fired up Faber Toys for the moment and it seems I am homing in on the culprit.

I believe it is something to do with ..Program Files\Bonjour\mdnsNSP.dll which I suspected yesterday after finding a couple of entries in HijackThis.

However, there is little written about it on Google, and I was thrown off the scent a bit by the suggestion that it is a legit Apple Inc. file (I guessed maybe something to do with Quicktime).

Interestingly I see that no less than 3 out of 5 instances of SVCHOST.exe have the Bonjour file at the top of the dependencies list in Faber Toys.

One is the big memory/CPU hog which again I seem to be able to terminate with no ill effects from within Faber Toys or from within Windows Task Manager. The other two use only modest amounts of memory/CPU resource. I can also kill one of those apparently without ill effect, but killing the other causes the machine to go into a delayed but controlled Windows NT shutdown mode.

Anyone point me in a new direction?

Meantime I am going back into Google to checkout this Bonjour thing...

CHR15

For me it would be a no brainer, delete it along with the whole bonjour folder.

Depends if you need Apple Air-Tunes for music sharing.

Configure the firewall to block it or simply disable the whole process from starting.

Millionare

CHR15 wrote: »

For me it would be a no brainer, delete it along with the whole bonjour folder.

Depends if you need Apple Air-Tunes for music sharing.

Configure the firewall to block it or simply disable the whole process from starting.

I almost certain the "bonjour" is part of the Apple itunes setup and part of the "Apple updates" package that you can choose to download with itunes or not.

Maybe reinstalling itunes without the "apple updates" option might sort out your problem. you can uncheck it on the install.

peterbaker

CHR15 wrote: »

For me it would be a no brainer, delete it along with the whole bonjour folder.

Depends if you need Apple Air-Tunes for music sharing.

Configure the firewall to block it or simply disable the whole process from starting.

Yeah of course I thought of that Chris but I don't have an IPod or share I-Tunes so I am intrigued as to how it got "installed" in the first place. It is not in my CP Add/Remove Programs list.

Irrespective of how it got there, I am still not actually sure that Bonjour IS the culprit. Using Faber Toys I have excluded Bonjour\mdnsNSP.dll so that the big instance of SVCHOST is still running. It has improved the CPU overload by a small amount so that at least I retain use of the Windows taskbar and can open Windows Task Manager without too much delay, but it is still a resource hog.

That big instance of SVCHOST.exe actually has no less than 150 dependencies so I am wondering if there is another or a better candidate for extermination:-)


Edit: How about this one: ..\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll ?

It's the only one with a huge path and there are other instances of comctrl32.dll with much shorter and more typical paths.

CHR15

Installers are getting worse and worse these days for installing crap alongside the prog you actually want.

Even previously Safe, progs tend to insist on installing a Search bar or addtional Toolbar claiming it is Highly Recommended and will improve your PC experience or some such nonsense.

I only ever choose advanced installs in case I get the option but some do get through.

You are on the right lines, just trial and error now until you find the biggest culprit (make a system restore point before wading in with the axe!)

peterbaker

CHR15 wrote: »

You are on the right lines, just trial and error now until you find the biggest culprit (make a system restore point before wading in with the axe!)

Ha! You know me too well Chris! I am in the forest slashing away with my machete as we speak ... been right through and out to the sunshine the other side!

I have an irrational aversion to system restore points - something keeps telling me that my computer has always been crap and that restoring to older crap is likely to annoy me! However, pls be good enough just to remind me how to set the restore point before I plunge into the sweaty forest again:-)

Millionare

CHR15 wrote: »

Installers are getting worse and worse these days for installing crap alongside the prog you actually want.

Even previously Safe, progs tend to insist on installing a Search bar or addtional Toolbar claiming it is Highly Recommended and will improve your PC experience or some such nonsense.

I only ever choose advanced installs in case I get the option but some do get through.

I agree, I only use Custom or advanced options when installing stuff so I can install only stuff that I need or want and dump the rest of the garbage that is added in.

Millionare

peterbaker wrote: »

Ha! You know me too well Chris! I am in the forest slashing away with my machete as we speak ... been right through and out to the sunshine the other side!

I have an irrational aversion to system restore points - something keeps telling me that my computer has always been crap and that restoring to older crap is likely to annoy me! However, pls be good enough just to remind me how to set the restore point before I plunge into the sweaty forest again:-)

Why not do a complee OS reinstall and start a fresh? Doesnt take long if you know what your doing and your computer will run like new.

just backup all your stuff beforehand.