Question on svchost.exe

[the Black Prince]

recently, for no apparent reason, one of the svchost system processes has starting running overtime. every so often, starting about 5 minutes after boot, no matter if i start running programs or not, it just kicks in and starts using up 50% of my CPU... and i can't work out why. it does it even if i just boot up and sit there, doing nothing. nothing's been added to system startup recently... so i've no idea why this is doing it, or even what its doing.

if i end task on it, the task finishes, but my soundcard is no longer recognised until i reboot.

it runs for about 5 minutes, then stops. at some point later it restarts...

anyone any ideas?

[kshcshbash]

recently, for no apparent reason, one of the svchost system processes has starting running overtime. every so often, starting about 5 minutes after boot, no matter if i start running programs or not, it just kicks in and starts using up 50% of my CPU... and i can't work out why. it does it even if i just boot up and sit there, doing nothing. nothing's been added to system startup recently... so i've no idea why this is doing it, or even what its doing.

if i end task on it, the task finishes, but my soundcard is no longer recognised until i reboot.

it runs for about 5 minutes, then stops. at some point later it restarts...

anyone any ideas?

Have you booted to Safe Mode yet?

[Freddie]

First of all you have a Dual core CPU. How do I know this? svchost.exe is running at 50% and svchost was built years ago by Microsoft and only works on one thread/affinity hence why 50% of your CPU power is unaffected. If you were running an old Athlon or P4 you would be reporting svchost at 100%.


Anyway, svchost is an integral part of Windows so don’t disable it or delete it, in fact what has happened is that its become infected by a virus so I would run a deep scan using an updated anti virus programme like AVG Anti virus.

[Erik]

Yes, sounds like a virus.

[Aristocrat]

Either that or you have something sitting in your print queue going nowhere.

[the Black Prince]

good analysis freddie

except for the minor matter of me NOT having a dual core PC. i do in fact have an intel P4...

so much for the vaunted F-Secure...

[Freddie]

good analysis freddie

except for the minor matter of me NOT having a dual core PC. i do in fact have an intel P4...

so much for the vaunted F-Secure...

Yes but not all p4's are equal, before dual core there was hyper-threading, if you check the CPU affinity from the task manager programmes will recognise your computer as having two logical cores, hence why it’s running at 50%.

You don’t happen to run a HP printer do you? HP uses a programme called hpqtra08, for some reason it sometimes causes svchost to run wild. Alternatively download and run WinPatrol (its free) and that should tell you what is causing the problem.

[Citizen]

F secure blows - no joke. AVG is decent.

[Arakorn]

F secure blows - no joke. AVG is decent.

No, F-secure has won numerous tests over the last few years. It is also the AV client with fastest respond time to new viruses that has appeared in the world.

Just doing my civic duty and promoting Finnish Quality Wares.

[the Black Prince]

i do have an HP printer, but i'm just puzzled as to why the problem would only just have started occurring, given this computer is 2 years old, and the printer 3...


i'm doing the virus and spyware checks now though, see what that turns up.

[Freddie]

i do have an HP printer, but i'm just puzzled as to why the problem would only just have started occurring, given this computer is 2 years old, and the printer 3...


i'm doing the virus and spyware checks now though, see what that turns up.

It might just be easier to use the system restore to set the computer back to when it was working properly.

[Tacticalwithdrawal]

Avast is good too (and free)

If virus scan doesn't pick it up try running Spywareblaster and Spybot Search and destroy - I've had a few things hide from one of these but not from all three.

[Tacticalwithdrawal]

if that doesn't find anything, might be worth rolling back any driver upgrades you have had, one of them may have triggerred it?

[the Black Prince]

well, no virus, there was some spyware though, it doesn't appear to have been related, but we'll see when i next reboot...

[Adam the VIth]

What if I have lots of copies of SVCHOST.exe running? Am I virus ridden? Jeez, I getting a rash just thinking about it.

[Citizen]

Well I have 7 running.

[Aristocrat]

There is more than one svchost process, different ones handle different operations within windows.

[the Black Prince]

i have 5 running, one of them with 84 modules loaded when the system is in overdrive, but only 80 when its not. i'm still trying to isolate precisely what is causing it... those 80 processes normally use up less than a % of CPU usage...

[the Black Prince]

bump this one back up

still have the problem intermittently.

downloaded processexplorer to view the threads for svchost

its one thread thats running that causing the problem
ntdll.dll in particular ntdll.dll!RTlAllocateHeap
runs at 47.69%CPU to 50%CPU.

killing svchost in question solves the issue, but because that svchost is running a number of other functions including my soundcard and wireless monitor its not desired. Killing the dll in process explorer also solves the problem, with, as yet, no identified issues.

however, i'd rather stop it from occurring in the first place, and still have no idea why it started doing it...

had a look on the web, but the one page that relates directly to the problem i have, even so far as mentioning AllocateHeap was an old microsoft support centre page that said the problem affected only windows 2000 and was fixed in a service pack in 2003. I have XP...

any ideas?

[sdjenkyn]

bump this one back up

still have the problem intermittently.

downloaded processexplorer to view the threads for svchost

its one thread thats running that causing the problem
ntdll.dll in particular ntdll.dll!RTlAllocateHeap
runs at 47.69%CPU to 50%CPU. .

killing svchost in question solves the issue, but because that svchost is running a number of other functions including my soundcard and wireless monitor its not desired. Killing the dll in process explorer also solves the problem, with, as yet, no identified issues.

however, i'd rather stop it from occurring in the first place, and still have no idea why it started doing it...

had a look on the web, but the one page that relates directly to the problem i have, even so far as mentioning AllocateHeap was an old microsoft support centre page that said the problem affected only windows 2000 and was fixed in a service pack in 2003. I have XP...

any ideas?

Google your ntdll.dll and find out what program that is. Im probably wrong here but I thought ntdll was part of the nvidia driver pack. Anyway there are sites that can explain that dll string for you and that way you can fix it