Strange resource hogging svchost?

Lately I've found for minutes at a time that my computer will stop responding. I opened the processes manager and found that among other things, there are about 6 svchost.exe instances and one of them is taking up 99% of the cpu time. Disabling the process doesn't cripple my system, although I just tried to watch a Youtube video and there was no sound. Not sure if that's because of the process or something else (I recently opened msconfig and deactivated lots of startup items to try to improve performance).

I know that svchost is a normal system process, but why should one of them start taking up the whole cpu for a few minutes?

http://repair-svchost.org/?gclid=CP7exM2KlYoCFSJ0MAodGiuxfg ?

A lot of spyware/malware is known to create it's own illegit copies of svchost.

Do a search for SVCHost.exe and see where they are all stored on your HD. If any show up in a folder besides \Windows\System32 or \Windows\ServicePackFiles\i386 it's probably an illegitimate copy.

Well that was a big fat waste of $30! Just bought that RepairSVCHost program, ran it, fixed all the errors, and it made no difference whatsoever. Bugger. Oh well, thanks for the link anyway.

Curiously there are three svchost.exe's on my hard drive, one in \Windows\System32, one in \Windows\ServicePackFiles\i386 and one in \Windows\$NtServicePackUninstall$. But in the Processes Manager, there are seven instances! What's all that about?

Ooops. Didn't realize you had to pay for it - didn't investigate that far. :/

I had this problem months ago and it turned out to be something to do with Windows automatic updates. If its on, turn it off.

I found info after a bit of googling, but I can't find the link again now.

Cool, I'll try that. Cheers.

Don't worry about the issue having more as processes.


I wish I had posted my suspicions regarding Repair Svchost.exe earlier.

The guy who has that site has other sites that are like that site - example:
http://fix-csrss.org/

I'm going to study this "Jason Green" a bit more closely - a bit closer than he may like.

I have this problem too. Try download Process Explorer from SysInternals (Freeware), where you can find what service within svchost.exe that is causing high CPU usage. When you find out, report back here...

The first thing I notice is in his licence it starts with 'ParetoLogic Inc'

this all branches off:
http://www.regcure.com/
http://paretologic.com/

I've sent them an email expressing my disappointment with the software and asking for a refund - worth a try but obviously it's unlikely. In the meantime turning off auto updates seems to have done the trick: I haven't had a freeze since...

Puki, what's your suspicion about Jason Green? Do you have reason to believe that Regcure itself is malware?

I'm suspicious of it - nothing more than that. I find it odd that he has several sites that do not mention the parent company. His sites would appear to falsely report the products as being updated based on on 'returnDate();'.

Potentially, I think he is some kind of rodent.

Not too sure - yet.

I personally would never trust a piece of, supposedly ace software, that didn't have a single review on a known, trusted site.

The only sites that offer reviews of RegCure look *really* suspicious, to me. Take a look at this site:

http://customers-say.com/

So RegCure is the #1 registry cleaner, eh? And the relatively unheard of "Pareto Logic AS" is the #1 anti-spyware program out there too? Wow, that seems like a huge coincidence. Notice it also pushes XoftSpySe, another Pareto product.

If you click on either the "NoAdware" or "Monitoring Software links" and then scroll down to the bottom of those pages, you'll find links to information for affiliates. Hmm - that just seems a *bit* suspect, no?

Yeah, it was kind of dumb of me to buy it. But do you think it's just duff crap or do you think there's actually something sinister in it?

Even better, check this site out.

http://www.betterreviews.org/registrycleanerreviews/

Again, notice how the page pushes 2 pareto products. RegCure and Xoftspy.

That in and of itself isn't hugely suspicious. However, if you just try going to www.betterreviews.org you'll find that the page doesn't even exist Oh wait, it's "down for maintenance" ...mmhmm, yeah.

What's even more suspicious is the small text at the bottom of the site.


Okay, note how they have "As seen on" and then have AOL's logo, Yahoo, TLC, msn, etc...well, now re-read that small text.

"As Seen On" logos and trademarks are owned by their respective companies. One or more of the services we review has been previously written about of featured by those companies."

So, I guess that makes it pretty clear why they decided to include Error Killer in the reviews.

Here's some info about their spyware program...

http://www.adwarereport.com/mt/archives/000014.html

Actually, read all of the comments here, too

http://netrn.net/spywareblog/archives/2004/04/29/webhelper-review/

Do a google search for Xoft Spy scam (it's their AV software). Oh man.

I'd do a credit card chargeback IMMEDIATELY my friend. Then uninstall RegCure, fire up any other anti-spyware anti-virus programs you have, and hope that it isn't too deeply rooted in your system.

If they give anyone any trouble - then I shall lesson them.

They've given tons of people trouble. Strap on those boots and get to work, Puki!

OK I know extensively about this sucker (original post, not tangent;). svchost controls all of Windows' most important networking functions - the only one that has ever hung it is BITS. You know, that super excellent transferring system MS use for ... well, most people will only use it for Windows Update.

If automatic updates are turned on, simplest thing is to turn them off. You can also terminate the process within Task Manager quite safely. While there is no hard info on the cause of this, I have a theory.

BITS hangs when a connection times out <rolls eyes>.

This most commonly happens after patch Tuesday, for those that don't know MS have taken to batching their updates to once a month. Usually the first Tuesday of the month. Or was it second... whatever. Depending on how large/critical/generally popular the updates are, Windows Update can effectively be denied access for up to two weeks in some cases.

Basically, both BITS and the Windows Update servers are not up to scratch. The WU servers can't handle the load and BITS is programmed terribly. If a timeout occurs, BITS does not respond well. In fact it seems to go into some sort of infinite loop. This usually happens while scanning your machine for updates, but if you make it far enough, it can also happen while downloading the updates.

Thanks for all the info guys - damn, wish I hadn't installed Regcure... I'll try to stop payment going from my card but I have a feeling I'll get charged even more than the cost of the software!

Actually svchost is the service host, for any Windows Services that are implemented as a Dynamic Link Library, and thus can be running pretty much anything.