svchost cpu 100% usage

Discussion in 'NOD32 version 2 Forum' started by cism, Aug 23, 2006.

Thread Status:
Not open for further replies.
  1. cism

    cism Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    6
    ey guys
    have any of you encountered this problem?
    I scanned using in depth analysis but still unable to find any viruses or spyware.
    searched google but still no definite answer, people are still guessing on what causes it.

    currently, the only way for me to use the workstation properly is to end the process. Also searched through the msconfig>startup and all seems in order. Might it be starting up as a service? sigh
     
  2. ctrlaltdelete

    ctrlaltdelete Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    318
    Location:
    NL
  3. ctrlaltdelete

    ctrlaltdelete Registered Member

    Joined:
    Oct 16, 2005
    Posts:
    318
    Location:
    NL
  4. cism

    cism Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    6
    ok i used the program
    The service that hogs is
    C:\WINDOWS\System32\svchost.exe -k netsvcs
     
  5. NOD32 user

    NOD32 user Registered Member

    Joined:
    Jan 23, 2005
    Posts:
    1,766
    Location:
    Australia
    A bit of general info for svchost.exe -k netsvcs:
    This is normally used to launch many dll based services on your PC in one process and itself being located at C:\WINDOWS\System32\ should be the normal part of your Windows. Some of these normal windows services use network connectivity to function properly. Aparently one of the dll based services is choking.

    Of the many possible causes for this I would suggest first checking that your software firewall (if you have one) permits internal traffic for this service ie. you haven't got svchost.exe completely blocked, since at a minimum internal communication is necessary for the proper operation of windows.

    Then I would suggest repairing IMON and winsock as detailed by Blaskpear in post #81 here.

    Please let us know what difference that makes if any and we may look at some other things after that if needed.

    EDIT: If you're running on a Server OS then IMON should be completely disabled by default with the IMON icon grey in colour.

    Cheers :)
     
    Last edited: Aug 24, 2006
  6. haxrnick

    haxrnick Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    1
    Hello everyone, this is my first post here! I had the same problem too. I came to find out it ate all my system resources when I have automatic updates enabled. No more than 10 seconds after turning the automatic updates off my pc was at top speed. Hope this helps.
     
  7. cism

    cism Registered Member

    Joined:
    Aug 10, 2006
    Posts:
    6
    come to think of it. the 2 workstations have the same problem after deleting some spyware or trojan.
    Is it normal for nod32 to miss some? but when I used in depth analysis the viruses were found. I am also using the blackspear settings.

    I have already repaired the winsock, and currently monitoring it. I also disabled system restore. The problem seems to occur when restarting the system.

    nod32 user, won't the server be susceptible to attacks if imon is disabled?
     
  8. NOD32 user

    NOD32 user Registered Member

    Joined:
    Jan 23, 2005
    Posts:
    1,766
    Location:
    Australia
    With Blackspears extra settings even something dormant should get picked up during the scheduled weekly scan. The only difference I can think of between that and the maxed out configuration of AMON that Blackspears settings also covers is that some of the advanced detection options are only implemented for newly created or modified files as pictured here since pausing the OS like that may result in severe compatability issues.
    still sounds like it could be IMON used on a server...
    IMON will not be present in v3 when it is released and it is expected to be replaced by something far better. For the time being it provides a valuable first defence against infiltrations for individual PC's and workstations but it is not designed to be used on a server OS (or a workstation running server applications or services) due to the nature of the internal traffic these type of applications generate and use. For a secon opinion you may find this recent post useful.
    That said I have seen elsewhere here somewhere I think a thread where one user reported with configuration they were able to use it, but it is not supported in this case.
    Just test first by temporarily disabling IMON so that they icon is grey (not red) and then reboot. See if your problem is gone then and let us know.

    Otherwise we'll check something else.

    Cheers :)
     
    Last edited: Aug 24, 2006
  9. mmartinez

    mmartinez Registered Member

    Joined:
    Feb 5, 2007
    Posts:
    1
    svchost high CPU occurs when svchost is processing Windows update related tasks, such as checking your computer for updates, downloading updates from microsoft. Give it a couple minutes to complete what it's doing, and it'll be back to normal.

    Michael
     
  10. Stephanos G.

    Stephanos G. Registered Member

    Joined:
    Mar 29, 2005
    Posts:
    720
    Location:
    Cyprus
Thread Status:
Not open for further replies.