svchost.exe 100% CPU usage

T

The_Dark_Abyss

Limp Gawd
Joined
Oct 6, 2005
Messages
444
Recently my main system started having some problems so I decided to do a complete reinstall. After doing so, I got myself infected by a nasty spyware (visited a site before installing NOD32 & Zonealarm) so I installed NOD32 again and MS Anti-Spyware and using HijackThis I killed off the spyware/virus.

However, whenever I start Windows I still get svchost.exe using 99% of my CPU. So I used cmd and found it was tied to "RPCxSs" I searched on google but didn't find anything pertaining to my particular situation so I'm wondering, is that svchost.exe a spyware fake?

Any ideas on how to fix this would be appreciated . . .
 
Use ad-aware and spybot (See my Signature). If those don't work, get HijackThis and have it make a log (But don't repair anything yet, you'll get a lot of results back that aren't exactly bad). Post the results of the HijackThis scan in here, and we can figure out whats what:).
 
I've actually gone through the whole Hijackthis! log thing. And I've removed the malicious elements. I'm pretty sure I got rid of that bad spyware thing but I read on other places that svchost.exe can cause CPU usage even if there isn't spyware involved.

Anyway, I'm doing system restore right now. I'm hoping that will fix the problem. I'll post my log up once that's done.
 
My son had this problem on his computer. His CPU would be at 100% when first booting up and would not do anything else for about two minutes. His games would also slow down for a period of time. I looked up solutions, and running my Avast Antivirus cleared up the problem.
 
Cleaning spyware alone might not solve the problem. Open control panel > admin tools > services, and click the "Status" column to group your active processes together; study the list of started services. Now hit ctrl+alt+del and end the svchost.exe that is eating up 100% CPU. Inspect your list of services for anything that stopped running when you killed the svchost, right click it and look in the properties to see if it was related to svchost at all. It is most likely a redundent process created by the spyware. So disable that process, reboot and see if your cpu is taxed again.

Addon: I noticed that your problematic svchost is tied to RPCxSs, in my case I disabled the "Remote Procedure Call (RPC) Extensions" service.
 
Wow N_Rage, that is so not the right approach.

Are you running XP PRO? If so run:
tasklist /svc and see what is hosted in that svchost. If it's RPC then I would not kill it. ;) You should be able to figure out what that svchost.exe is pointing too and if it's valid. If it's a valid and known good file, I would do a repair install, maybe something it depended on got messed up.
It could also be that the valid file was compromised via an exploit. If that's the case, get a good hardware filewall, and rebuild the box.


This posting is provided "AS IS" with no warranties, and confers no rights.
 
Yeah it was pointing to RPC . . . in any case I reinstalled Windows so I guess that is that . . .
 
You must log in or register to reply here.
Back
Top