1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: svchost problem

Discussion in 'Windows XP' started by rubi, Feb 6, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    When I start my computer svchost (one of the many!) goes crazy pushing CPU up to 100% and it's mem usage to about 90k. At the same time, wuaclt goes up to about 30k, which is also not normal. How can I find out what is causing this?
    Thanks,
    rubi
     
  2. techkid

    techkid

    Joined:
    Sep 1, 2004
    Messages:
    2,339
    First Name:
    David
    Well, wuauclt is your Automatic Update service. It could be doing its update checks, which can also explain your svchost (Service control program) issue, but I cannot say for certain.

    To assist in your problem, we need you to download HijackThis (http://www.merijn.org/files/hijackthis.zip). Extract it to a folder like C:\Program Files\HijackThis. Run it, and select 'Scan'. Do not fix anything yet, just select 'Save log', and copy the contents of the log to your next post.

    An expert will be along shortly to review your log.
     
  3. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    Thanks for the quick response(y) I know what the processes are, but I don't understand why they are killing the CPU and mem usage since I never had this issue before. Anyway, if it will help here is the HJT log.
    rubi

    Logfile of HijackThis v1.99.1
    Scan saved at 11:51:09, on 06/02/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Barak013\Barak013_L2TP\fts.exe
    C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\Program Files\Novatix\Cyberhawk\CHTray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Network Associates\Common Framework\McTray.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    C:\Program Files\Common Files\Novatix\Cyberhawk\CHService.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Barak013\Barak013_L2TP\FWPortal.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    E:\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [%FP%Barak013 L2TP fts.exe] "C:\Program Files\Barak013\Barak013_L2TP\fts.exe"
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
    O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [Cyberhawk] C:\Program Files\Novatix\Cyberhawk\CHTray.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Golden Palace Poker - {40B2063F-DB01-4962-BE63-59435C01283C} - C:\PROGRA~1\GOLDEN~1\client.exe
    O9 - Extra button: ???? - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167051583734
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1141628019343
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca04.rightnowtech.com/7020-b369h/rnl/java/RntX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F5056D05-EF6A-468C-A81C-3DA447573F26}: NameServer = 212.150.49.10 62.90.42.110
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
    O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
    O23 - Service: Cyberhawk - Unknown owner - C:\Program Files\Common Files\Novatix\Cyberhawk\CHService.exe" service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
     
  4. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    can someone check the HJT log and then offer some suggestions as to why svchost is going crazy with the windows update client. How and where can I check this out on my computer.
    Thanks,
    rubi
     
  5. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    The svchost problem is often associated with failed automatic updates -- and that appears to be the case here.

    Disable Automatic Updates in the Control Panel for now -- and manualy go to Windows Update and install any needed updates; once that is done you can try re-enabling Automatic Updates.

    It's possible you may also need to temporarily disable the Automatic Updates service itself in services.msc -- or at least stop it until you have installed the needed updates manually.
     
  6. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    I appreciate the advice. Tried it, installed ALL outstanding updates incl. IE7 (which I don't use except for updates) but the problem still persists especially at startup. Any more suggestions would be gratefully received.
    Thanks,
    rubi
     
  7. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    As a test run services.msc and double click the Automatic Updates service and set it to disabled and reboot.

    Does the problem still occur?
     
  8. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    Well, I disabled Automatic Updates and the problem has stopped. But, one silly question, how do I update my computer now? I tried a manual update at the MS website but guess what! If AU is off, no service available. So what do I do now?
    rubi
     
  9. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
  10. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    Rollin' Rog, I tried the tips suggested in the link you posted, but unfortunately I'm still having the same problem. I really don't understand this. There are no error messages, no warnings about missing dll's or stuff like that. AU and svchost just go crazy, killing the memory and cpu. I have now, yet again, disabled AU. I am really frustrated by this. Can you please offer some other ideas?
    Thanks in advance,
    rubi
     
  11. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Honestly, if you followed ALL the steps in that link, which is designed to fix problems with Automatic Updates, I don't know what else to suggest.

    Have you tried doing a System Restore to a date prior to this problem?

    They can be undone if not helpful.

    One thing you might check into is to run services.msc and ensure the BITS (Background Intelligent Transfer Service) is set to automatic. This is a required service for AU to function properly.
     
  12. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    I followed ALL the steps, and still no luck. I also set BITS to Automatic, but when I restart the computer it is always back to Manual. I can't do a system restore because this all started after a Repair install of Windows XP, though not immediately. Would another Repair help maybe? I'm willing to pay the price of having to download all the MS updates again, IF this will help. What do you think?
    Thanks,
    rubi
     
  13. rubi

    rubi Thread Starter

    Joined:
    May 5, 2006
    Messages:
    36
    Out of pure frustration, and desperation, I decided to try another Repair install. This time everything is back to normal!! I don't quite know why it got messed up last time, and I don't really care. My system is running normally again (for now!). I appreciate all the help and advice though. Keep up the good work.
    Thanks,
    rubi
     
  14. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Great I'm glad that worked out. Keep your fingers crossed because Windows will be wanting to do a lot of updates now.
     
  15. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/541640

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice