Text 23524, 100 rader
Skriven 2006-11-11 20:12:59 av Charles Scaglione (1:123/789.0)
  Kommentar till text 23523 av Jeff Guerdat (1:275/311)
Ärende: SVCHOST
===============
On Sat, 11 Nov 2006 16:14:10 -0500, "Jeff Guerdat -> Charles
Scaglione" <1:275/311> wrote:


 >> Got a mysterious one for you....

 >> When I first boot up my desktop I have a process running (XP Home)
 >> called SVCHOST.  Actually there are several processes running with the
 >> same name (svchost.exe).

 >> One of those svchost processes is eating up 100 per cent of my CPU and
 >> does so for about 5 minutes or so.  The process is called svchost.exe
 >> and is listed under "system".

 >> While that is going on, the machine is like a zombie.  If I use Task
 >> Manager and kill the process, the machine comes to life again.  I
 >> can't figure out for the life of me what's causing it.

 >> I've stopped services, uninstalled IE7, set some services to manual,
 >> etc.  Still no joy.  This only happens right after I boot up.  Once
 >> that process stops, the machine is normal.  This zombie like thing
 >> started around a week or so ago.  I haven't installed any new programs
 >> but have installed recommended security updates from MS.

 JG> Should have asked me a while ago when I was fighting with it.  ;)  There
 JG> are, as you noticed, several svchost processes running.  One has
 JG> virtually all the startup services using it while others are caused by
 JG> some service that kicks off when you start another app.  I think this is
 JG> basically the same thing as using inetd in *nix but don't know that for
 JG> sure (inetd is a process that runs, listening for requests and starting
 JG> the appropriate child process).  Here's a link to the MS KB article
 JG> about it:

 JG> http://support.microsoft.com/?kbid=314056

Good article.  Thanks.

 JG> A key command to check things out is "tasklist /svc" from a DOS prompt.
 JG>   Locate the process ID (PID) of the offending process in task manager
 JG> by clicking on the Processes tab and then View, Select Columns, checking
 JG> off the PID (Process Identifier) checkbox.  Use that ID to correlate
 JG> with what process(es) have started that particular invocation of
 JG> svchost.exe.  That may give you a clue as to what is ACTUALLY chewing up
 JG> the CPU.  Note also that the process name is svchost.exe and not
 JG> scvhost.exe (note the transposition of the "c" and "v") which would be
 JG> indicative of a potential virus or other Bad Thing.

Since I'm running XP Home, the file "tasklist.exe" is not available.
Only included with XP Pro.   However, I was easily able to find a copy
on the net and promptly downloaded it.  Works well.  Also grabbed hold
of the free System Internals "Process Explorer" which gives a bit more
detail about what's going on.  BTW, all the free stuff from System
Internals is now found at the MS download page.  (MS now owns System
Internals)

 JG> What I had found, IIRC, was that the first PID of svchost was the one
 JG> causing problems since it had damned near every service that starts up
 JG> during boot in it.  To get things back to normal I started disabling
 JG> services I didn't need (I found lists on the Internet and went through
 JG> them one at a time to figure out if I wanted/needed them, disabling them
 JG> if I didn't).  Obviously, you can screw things up with this so following
 JG> recommendations as well as thinking it through will keep you from
 JG> disabling a critical service.  Keep the DOS window open so you can use
 JG> the output from the query to stop/modify services in the management
 JG> window.  My goal was to have the system go into standby and not start
 JG> itself back up without a network request (wake on LAN).  I ended up
 JG> disabling many things but just recently turned most of the back on,
 JG> using "manual" rather than "automatic" so the process will start only
 JG> when needed.  The system seems to be running fine.

Yeah, I know what you mean.  I found at least 10 services listed under
the offending PID which by the way is "1112".  I really see no viable
way to single out the guilty party except maybe by the process of
elimination.  I need to do a bit more detective work because this has
happened recently.  Something I did, or perhaps from a MS update has
caused the problem.  All I have to do is figure out what?

 JG> Unfortunately, there's a lot of possibilities as to what could cause
 JG> this.  Any of the particular services hosted by that single svchost
 JG> could be the problem.  Disabling (or perhaps just stopping the service
 JG> temporarily so you can judge the result) services one at a time should
 JG> get you the answer but takes time and a bit of pain.  And then it's
 JG> still not necessarily clear as to what's causing that service to go
 JG> haywire.  There's lots of questions and some answers on the Internet to
 JG> slog through - perhaps you'll find a similarity to help you.  As noted,
 JG> I had trouble and now I don't.  Is that because of manually starting
 JG> services, a patch or just the phase of the moon?  Possibly all three...

I probably will try stopping some services connected with that
particular PID.  I've got a list of services around somewhere that I
copied off the net - that describes those which are critical and those
that are not.

I'll let you know if I find a solution.  I may not have much time to
fool with it until Monday.  Thanks for the tips.  Really helps.

Regards.

--- Forte Agent 4.1/32.1088
 * Origin:  (1:123/789.0)