Solved: svchost problem

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
When I start my computer svchost (one of the many!) goes crazy pushing CPU up to 100% and it's mem usage to about 90k. At the same time, wuaclt goes up to about 30k, which is also not normal. How can I find out what is causing this?
Thanks,
rubi
 

techkid

David
Joined
Sep 1, 2004
Messages
2,339
Well, wuauclt is your Automatic Update service. It could be doing its update checks, which can also explain your svchost (Service control program) issue, but I cannot say for certain.

To assist in your problem, we need you to download HijackThis (http://www.merijn.org/files/hijackthis.zip). Extract it to a folder like C:\Program Files\HijackThis. Run it, and select 'Scan'. Do not fix anything yet, just select 'Save log', and copy the contents of the log to your next post.

An expert will be along shortly to review your log.
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
Thanks for the quick response(y) I know what the processes are, but I don't understand why they are killing the CPU and mem usage since I never had this issue before. Anyway, if it will help here is the HJT log.
rubi

Logfile of HijackThis v1.99.1
Scan saved at 11:51:09, on 06/02/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Barak013\Barak013_L2TP\fts.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Novatix\Cyberhawk\CHTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
C:\Program Files\Common Files\Novatix\Cyberhawk\CHService.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Barak013\Barak013_L2TP\FWPortal.exe
C:\Program Files\Mozilla Firefox\firefox.exe
E:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [%FP%Barak013 L2TP fts.exe] "C:\Program Files\Barak013\Barak013_L2TP\fts.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Novatix\Cyberhawk\CHTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Golden Palace Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\GOLDEN~1\client.exe
O9 - Extra button: ???? - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167051583734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1141628019343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.rightnowtech.com/7020-b369h/rnl/java/RntX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5056D05-EF6A-468C-A81C-3DA447573F26}: NameServer = 212.150.49.10 62.90.42.110
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
O23 - Service: Cyberhawk - Unknown owner - C:\Program Files\Common Files\Novatix\Cyberhawk\CHService.exe" service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
can someone check the HJT log and then offer some suggestions as to why svchost is going crazy with the windows update client. How and where can I check this out on my computer.
Thanks,
rubi
 
Joined
Dec 9, 2000
Messages
45,855
The svchost problem is often associated with failed automatic updates -- and that appears to be the case here.

Disable Automatic Updates in the Control Panel for now -- and manualy go to Windows Update and install any needed updates; once that is done you can try re-enabling Automatic Updates.

It's possible you may also need to temporarily disable the Automatic Updates service itself in services.msc -- or at least stop it until you have installed the needed updates manually.
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
I appreciate the advice. Tried it, installed ALL outstanding updates incl. IE7 (which I don't use except for updates) but the problem still persists especially at startup. Any more suggestions would be gratefully received.
Thanks,
rubi
 
Joined
Dec 9, 2000
Messages
45,855
As a test run services.msc and double click the Automatic Updates service and set it to disabled and reboot.

Does the problem still occur?
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
Well, I disabled Automatic Updates and the problem has stopped. But, one silly question, how do I update my computer now? I tried a manual update at the MS website but guess what! If AU is off, no service available. So what do I do now?
rubi
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
Rollin' Rog, I tried the tips suggested in the link you posted, but unfortunately I'm still having the same problem. I really don't understand this. There are no error messages, no warnings about missing dll's or stuff like that. AU and svchost just go crazy, killing the memory and cpu. I have now, yet again, disabled AU. I am really frustrated by this. Can you please offer some other ideas?
Thanks in advance,
rubi
 
Joined
Dec 9, 2000
Messages
45,855
Honestly, if you followed ALL the steps in that link, which is designed to fix problems with Automatic Updates, I don't know what else to suggest.

Have you tried doing a System Restore to a date prior to this problem?

They can be undone if not helpful.

One thing you might check into is to run services.msc and ensure the BITS (Background Intelligent Transfer Service) is set to automatic. This is a required service for AU to function properly.
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
I followed ALL the steps, and still no luck. I also set BITS to Automatic, but when I restart the computer it is always back to Manual. I can't do a system restore because this all started after a Repair install of Windows XP, though not immediately. Would another Repair help maybe? I'm willing to pay the price of having to download all the MS updates again, IF this will help. What do you think?
Thanks,
rubi
 

rubi

Thread Starter
Joined
May 5, 2006
Messages
36
Out of pure frustration, and desperation, I decided to try another Repair install. This time everything is back to normal!! I don't quite know why it got messed up last time, and I don't really care. My system is running normally again (for now!). I appreciate all the help and advice though. Keep up the good work.
Thanks,
rubi
 
Joined
Dec 9, 2000
Messages
45,855
Great I'm glad that worked out. Keep your fingers crossed because Windows will be wanting to do a lot of updates now.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top