Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svhost Slowing Down My Computer


  • Please log in to reply
7 replies to this topic

#1 Arbriel

Arbriel

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Location:Portland, Oregon
  • Local time:09:00 AM

Posted 04 September 2006 - 02:04 PM

I sent this on June 25th, 06:

My computer is running slow. When I go to taskmanager, there are multiples of svchost.exe with bits of over 10,000 in my system log. When I delete all but one, my computer runs better & so does my internet which is a lousy connection thru msn which I am in the process of changing. I run spyware blaster. Spybot, Ad- aware, The Shield Virus Protection, & Zone Alarm. I have recently gone thru a series of helps from bleeping computer.com for malware that was concluded to my complete satisfaction. This is an independent question.
I thank you for your help.
Sincerely,
Arbriel

I have since changed to comcast and I have run all the virus scans and other things several times and I still have lugging on my computer (which does need more memory). When I look at the Task manger, I see that several svhosts are running tens of thousands of bites. When I delete them, the computer jumps to life and does what I have been asking it to do. It happens always at start-up & after the computer has been left on and inactive for a long while.
Any more ideas, please, please!?
Thanks,
Arbriel

Edited by Arbriel, 04 September 2006 - 02:05 PM.


BC AdBot (Login to Remove)

 


m

#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 50,606 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:00 PM

Posted 04 September 2006 - 04:21 PM

Svchost.exe is a generic host process name for services that are run from dynamic-link libraries called DLLs. This is a valid system process that belongs to the Windows Operating System which handles processes executed from DLLs. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. The legit Svchost.exe file is located in the %SystemRoot%\System32 folder.

If its running as a startup/shows in msconfig, this can be bad. See here and here.
Also make sure of the spelling. If its scvhost.exe this a trojan. See here and here.

Use Tasklist to view the list of services processes that are running in Svchost. The /SVC switch shows the list of active services in each process.
1. Click Start > Run
2. In the Open box, type CMD
3. Then press ENTER.
4. Type: Tasklist /SVC
5. Then press ENTER.

For more information about a process, type the following command, and then press ENTER:
Tasklist /FI "PID eq processID" (with the quotes)

For information about tasklist.exe, type the following at the XP command prompt: tasklist /?

You can also download and use Process Explorer by Sysinternals to investigate all processes and gather additional information to identify and resolve problems. This tool will show the process CPU useage, a description and its path.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Arbriel

Arbriel
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Location:Portland, Oregon
  • Local time:09:00 AM

Posted 04 September 2006 - 06:46 PM

I did have the spelling wrong. My dislexia is showing.
Okay, I tried to do the tasklist thing in CMD and it said that Tasklist was not "recognized as an internal orexternal command"
I ran a trust e pest system scan, which would not erase the pests unless I purchased, so I quarantined them, and the process explorer, which is still going. Are there any other ways to get this stuff off my computer without having to buy a $90 program?
Thanks again for your help
Arbriel

#4 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:12:00 PM

Posted 04 September 2006 - 08:34 PM

Yes - you have come to the right place!

Run both Adaware and Spybot Search and Destroy from safe mode, updating each program’s malware definitions before you scan and allowing both to fix what they find.

If you do not already have these freeware aps installed on your computer, you can get them at the following sites:

*AdAware SE: http://www.majorgeeks.com/download506.html

*Spybot S&D: http://www.safer-networking.org/en/index.html

Following that that I suggest you post a “HijackThis” log for expert assistance with your malware infection.

Read the pinned post in our “HijackThis” forum,
here
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Carefully read and follow all directions explicitly.

Following instructions create a HJT log, and POST THE HJT LOG YOU CREATED IN OUR HJT FORUMnot in this forum, at the following link.

http://www.bleepingcomputer.com/forums/posthjtlog.html

Include the specs for your computer (IE, brand and model of computer, what processor, amount of installed RAM or the brand and model of the motherboard, etc, and briefly describe the problem you are experiencing.)

Unless you are expert at editing and altering and writing to the registry, Do not use the Hijack This program to attempt to fix anything by yourself as even what may seem to be a small mistake can render your operating system inoperable and totally useless.

Some files when in the correct folder for them may be appropriate and valid but if in another may be malware hiding.


A member of our expert HJT Team will analyze your log, make recommendations and offer assistance, walking you through the complete repair process with specific instructions.

It may take a period of time to get a response to the log you posted because the members of our HJT Team are kept very busy.
Please be patient as this team, although comprised of experts, is manned by volunteers. They will help you in order received as soon as possible.

NOTE
Once you have posted your HJT log, please DO NOT make any additional posts in the HJT forum thread you created until you get a response from a member of our HJT expert team, and once your log is posted do not make any additional changes to your system (changes, including any further attempted repairs, will cause your computer to be different than how it is represented and displayed in the log you posted and therefore make your log inaccurate and useless).

The first criteria the HJT Team has when looking for logs that need replies are posts showing 0 replies. If you make an additional post, it will show as having had 1 reply.
A team member, looking for a new log that requires assistance might well assume another HJT Team member is already assisting you and might not even open the thread to respond.

So, post your HJT Log in our HJT Forum (not here in this forum) and wait for a response from a HJT team member.

If , even though it would be very unusual, after 5 days you have not had a response, post a re-request and a link to your HJT log in the following link:
http://www.bleepingcomputer.com/forums/topic14717.html

Edited by Enthusiast, 04 September 2006 - 08:56 PM.


#5 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,720 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:12:00 PM

Posted 04 September 2006 - 08:41 PM

I tried to do the tasklist thing in CMD and it said that Tasklist was not "recognized as an internal or external command"


Tasklist is not available on Windows XP Home.

Please follow Enthusiast's instructions above, and if you run into difficulties before posting your HJT log, add a response to this thread.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,077 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:12:00 PM

Posted 05 September 2006 - 09:32 AM

You can use the freeware program Process Explorer from http://www.sysinternals.com/ to see the same info that TASKLIST would have given you.

FWIW - I have 8 instances of svchost.exe running on my system. One is at 29,000 K while the others are below 10,000 K (but my system is highly customized - your mileage may vary). Terminating the svchost.exe processes may result in your system behaving strangely when you try and do something (an example is the BITS service - if you stop it's svchost.exe process - you'll experience trouble with downloads).

Here's a list of the svchost.exe services on my system from Tasklist /svc

svchost.exe 1244 DcomLaunch, TermServices

svchost.exe 1332 RpcSs

svchost.exe 1496 AudioSrv, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
lanmanserver, lanmanworkstation, Netman,
Nla, RasMan, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv

svchost.exe 1668 Dnscache

svchost.exe 1788 Alerter, LmHosts, RemoteRegistry, SSDPSRV,
WebClient

svchost.exe 516 stisvc

Hmmm....found some problems with my own install here - BITS isn't running and I've disabled Fast User Switching but it's still running. :thumbsup:

Edited by usasma, 05 September 2006 - 09:34 AM.

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 manik1013

manik1013

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:00 PM

Posted 11 October 2006 - 09:40 PM

Hey all, This is my first post, i came here because i have registry problems, i know windows, i dont really need the hijack this program, i know it all already....ive been trying to find the problem for a while. I have 7 copies of svchost.exe running, one or 2 comes and goes, but here they are....

Svchost.exe--1448--is a local service, using about 6000k mem, with 12 threads, no cpu time not a big prob,

Svchost.exe--1444--is a system process, using about 5000k mem, and only 5 threads, no cpu time,

Svchost.exe--1336--is a network service, using about 4000k mem, and has 4 threads, and no cpu time.

Svchost.exe--1168--is a system process, using about 27000k mem, has 64 threads, and 15 seconds of cpu.... I thought that was weird, 64 threads?

Svchost.exe--1128--another network service, using 6000k mem, has 8 threads, and no cpu time.

Svchost.exe--1064--a system process, using about 6000k mem, with 20 threads, and 1 second cpu time.

Now my computer has been on for 1 hr. 17 minutes, with 33 processes running. my idle cpu usage is about 20-30%, running Zone alarm, Free ram XpPro, Weatherbug(holds onto my internet connection(wifi) so it dosent drop), and spyware doctor. (active processes in task mgr.)

i want to know why does my computer boot up for 5 minutes, and only loads my Zone alarm, and my wireless icon. it takes forever!!! and i pride myself on how my comp runs, i play alot of games..

Now, its not that my services arent loading, they are in the task mgr., i dont get my systray icons, or full functionality. what i have to do is wait for the OS to load, then i open my command prompt, and logoff. I have it set to go straight to windows, with no logon screen. so it takes about 2 minutes to exit and enter.

My big problem is I am the owner and only user of this comp. its not an old computer, but it seems to run like a slug, even after i run my virus, spyware, etc. programs, wich are.....
Zone Alarm (registered and updated)
Ashampoo WinOptimizer Platinum (registered and updated)
AdAware Se personal(not registered but updated)
RegistryFix3.0(rarely use not updated)
Spyware Doctor(registered and updated)
XoftSpy (registered and updated).... and i even use Tweak Xp(i dont really like or use it alot)

My specs are simple--Windows XP sp2, build 2600, on 2.8 ghz intel with 704 mb. of ram and 128 mb ATI, Thanks in advance if anybody could help

#8 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:12:00 PM

Posted 12 October 2006 - 05:17 AM

First of all, disable the Ashampoo "memory manager".

Windows XP memory management was designed by Microsoft to make the best use of Ram possible, and third part "memory management" aps defeat it.
They push aps out of ram into pagefile creating holes in the ram and by doing so slow down your computer. Unused ram is wasted ram and the pagefile is far slower than ram.

Your usage is not indicative of system needs, especially if you disable services Microsoft had on by default. Windows uses resources for its own needs and maintenance when not being preempted by other aps you are running, so your usage will go up and down depending on the needs of your system at a given time.

There are about five million lines of code in Windows XP. Very few people can outperform Microsoft's system engineers and programmers when it comes to how the system needs to operate and what functions are dependent on others.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users