Anyone else got a SVCHOST hog that is devilishly hard to kill?

peterbaker

Millionare wrote: »

Why not do a complee OS reinstall and start a fresh? Doesnt take long if you know what your doing and your computer will run like new.

just backup all your stuff beforehand.

Now you sound like my girlfriend, Millionare! I taught her almost everything she knows about IT and, being a girl, she annoyingly has assimilated all of it and is now streets ahead of me with that annoyingly canny ability to have her own pc so well organised that she can reformat a windows partition, reinstall windows, and get her pc running again like new AND simultaneously bake perfect cakes AND maintain a beautiful smile all within the space of a tiny fraction of a day packed full of other completely unrelated but tidily completed tasks.

But she has her limits - what goes on under the bonnet of a car is still a mystery to her, and remains in my hunter/gatherer domain thank goodness!

Now then, back to the big bad forest - I may be some time ....

Stephen_Leak

Quite a few people (myself included) have had problems with SVCHOST recently. I suspect that a dodgy Windows update may be the root cause.

Millionare

peterbaker wrote: »

Now you sound like my girlfriend, Millionare! I taught her almost everything she knows about IT and, being a girl, she annoyingly has assimilated all of it and is now streets ahead of me with that annoyingly canny ability to have her own pc so well organised that she can reformat a windows partition, reinstall windows, and get her pc running again like new AND simultaneously bake perfect cakes AND maintain a beautiful smile all within the space of a tiny fraction of a day packed full of other completely unrelated but tidily completed tasks.

But she has her limits - what goes on under the bonnet of a car is still a mystery to her, and remains in my hunter/gatherer domain thank goodness!

Now then, back to the big bad forest - I may be some time ....

Lol, Good Luck! and don't get lost!:D

CHR15

Restore Points

I am on Vista but from memory....

Start => Programs => Accessories => System Tools => System Restore

Or something like that, it's in there somewhere!


Can't say I ever use them much either though. I learned all I know from mistakes!! Best way to learn!

peterbaker

Chris wrote:

Can't say I ever use them much either though. I learned all I know from mistakes!! Best way to learn!

Quite agree! In fact I am back here after a long squawk and all that via an alternative OS on another partition (a bit like being saved when locked out by leaving a spare key buried in the garden to the uninitiated!).

I was a little too enthusiastic with my pruning in the forest! I got complete rid of Bonjour, but that obviously wasn't the problem. And whilst Googling for advice on that I discovered in a Microsoft Knowledge Base article that there really is a related concept called forests and domains! Didn't see anything about big machetes however!

At this current juncture I have almost got an internet connection back after cutting too deep in a registry setting for the Winsock Catalog (Bonjour modifies that!) but I still have the original annoying resource hog as yet undetected! While I was in regedit with the drains up, I noticed a whole load of junk from Google despite, like other posters, being careful not to install toolbars and the like. They are supposed not to do bad things at Google but I am beginning to doubt that!


Edit - well I managed to open the front door again and am back up and running without having had to reinstall Windows, but I am sure I could have done so twice to avoid the kind of tinkering I have been doing! So much so that I can type netsh winsock reset and ipconfig /release /renew /all in my sleep! But I still have the darned unidentified resource hog...Grrrr! Like Stephen Leak, I am beginning to think it is hiding so well because it is from Microsoft!

pchelpman

Hi Peter ... back in post 3 Chippy suggested Process Explorer. Did you ever try that? Did it bring you any closer to the culprit?

peterbaker

Hi pchelpman!

Yes actually I have Faber Toys, Process Explorer and Windows Task Manager in my Start Up group just now ... just hoping I'll glimpse something incriminating! Your prompt has encouraged me to look more closely into the DLLs and handles associated with each process.

The only half clue (possibly) is that I think that Process Explorer indicated that the instance of SVCHOST causing the problem (and which I kill soon after reboot) seems to have one of the Windows Automatic Update files hanging off it .... wuauclt.exe or something like that. In fact earlier in this session I switched off Automatic Updates and meant to try a reboot to see if it made a difference, but got distracted.

I am frankly amazed that I can run Windows XP all day after I kill that one instance which has 150 modules hanging off it, according to Faber Toys, without noticing any ill effects!! What a load of junk we must surely load up unnecessarily on every boot, eh?

peterbaker

pchelpman
I can see two instances of wuauclt.exe hanging off of that dodgy svchost. But I can't see for sure that they are using all the resources. Is there any way you know of in Process Explorer to see which exact dll's are sapping resources? I am not convinced in fact that wuauclt is a culprit ... it could be something else out of the 150 modules linked to that svchost, couldn't it?

Yesterday I tried excluding them one by one in Faber Toys but I got no further clues from that.

Even when I kill the dodgy svchost process, I still have an instance of wuauclt running at the top level (same level that explorer.exe, Windows Explorer is running)

Chippy_Minton

Some good stuff in this thread about using PE to investigate a similar problem with svchost.exe, plus MS fixes related to automatic updates.

peterbaker

Thanks Chippy!

Meantime I have noticed that the heavyweight instance of wuauclt runing in svchost has a lot of c_XXXX.nls files associated with it. The remaining wuauclt at the higher level has no c_XXXXnls files, just three called sortkey.nls, sortbls..nls (did I spot that right?)... and .... crikey, would you believe it, it has just closed of its own accord before I could read the last one!

I mention the cls files because they are about the only ones that have no Description and no Microsoft tag.

Any ideas while I go google for .nls and also read the thread you kindly linked to....?

Edit ... getting a Cannot find server message on your link this morning Chippy .... maybe due to the huge readership of MSE and the prevalence of SVCHOST hogging, every man and his wife are clicking through your post there today:-)