Bay 12 Games Forum

Please login or register.

Login with username, password and session length
Advanced search  

Author Topic: Svchost.exe  (Read 1610 times)

Supercharazad

  • Bay Watcher
    • View Profile
Svchost.exe
« on: April 27, 2013, 03:46:27 pm »

My computer has begun working insanely slowly lately. I've tracked it down to an svchost.exe file which, once deleted, gives me about five seconds of normal operation before it appears again.

It is creating TCP connections from my computer to the IP 95.211.95.250, which is in the Netherlands (I know nobody from the Netherlands), and on deletion it makes about ten connections to it. When I attempted to end the process, I was given an access denied message. When I attempted to look up its location with the "properties" bit on the right-click menu, it also gave me access denied.

My computer works fine in safe mode, however. Halp?
« Last Edit: April 27, 2013, 03:52:47 pm by Supercharazad »
Logged

Il Palazzo

  • Bay Watcher
  • And lo, the Dude did abide. And it was good.
    • View Profile
Re: Svchost.exe
« Reply #1 on: April 27, 2013, 03:58:34 pm »

svchost.exe is a Microsoft Windows process running various services. It is perfectly normal to have a number of those running simultainously.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

One of the services that may cause slowdowns is the automatic windows update. Try turning off windows update and see if it helps.
Logged

Eidolon

  • Bay Watcher
  • Floating weightless in a cavern.
    • View Profile
Re: Svchost.exe
« Reply #2 on: April 27, 2013, 04:03:31 pm »

I'd recommend getting in on safe mode, copying your important stuff to external storage of some kind, and then wiping your hard drive and reinstalling windows. It might be a bit extreme but honestly it's the most clear-cut way of solving the problem.

Next time you install windows, put it on it's own partition so you can wipe and reinstall it without having to mess with your other files.

svchost.exe is a Microsoft Windows process running various services. It is perfectly normal to have a number of those running simultainously.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

One of the services that may cause slowdowns is the automatic windows update. Try turning off windows update and see if it helps.
I wouldn't really go for this if it isn't letting you see the properties of the svchost running, as it should allow you to as long as you are an admin. If it isn't located in system32, that's definitely a virus mimicing the normal windows process
Logged
In ancient times, men built wonders, laid claim to the stars, and sought to better themselves for the good of all.
But we are much wiser now.

Catsup

  • Bay Watcher
    • View Profile
Re: Svchost.exe
« Reply #3 on: April 27, 2013, 04:07:59 pm »

probly got hijacked or replaced by an undetected viral version and is being used in a botnet to spam some forum. I suggest reformating your computer and installing a reliable antivirus asap after re-installation.

Il Palazzo

  • Bay Watcher
  • And lo, the Dude did abide. And it was good.
    • View Profile
Re: Svchost.exe
« Reply #4 on: April 27, 2013, 04:27:25 pm »

Assuming it is a trojan after all, and that you don't want to do a reinstall, then you might want to use this method:
http://necroneurology.hubpages.com/hub/How-to-EASILY-remove-the-svchostexe-Trojan

Site and programs listed seem trustworthy enough.
Logged

Supercharazad

  • Bay Watcher
    • View Profile
Re: Svchost.exe
« Reply #5 on: April 27, 2013, 04:35:16 pm »

Nope, that's not the one. I've checked for all the symptoms it describes, and I have none.
Logged

nenjin

  • Bay Watcher
  • Inscrubtable Exhortations of the Soul
    • View Profile
Re: Svchost.exe
« Reply #6 on: April 27, 2013, 04:53:46 pm »

Get Process Explorer (Yes, that's a tool provided by Microsoft), and check what svchost is running. It, and all its other images, are the containers for alllll your services. Printer spooler, network services, yadda yadda yadda. Process Explorer can point you to all the places svchost is running from, and all the processes it's calling. Then you can use services.msc through the run bar and get a closer look at each of the services listed. If you don't see one in that menu, that is being called by svchost, I'd be very suspicious of it. Track down its file location, boot in safe mode, nuke it.
« Last Edit: April 27, 2013, 04:56:07 pm by nenjin »
Logged
Cautivo del Milagro seamos, Penitente.
Quote from: Viktor Frankl
When we are no longer able to change a situation, we are challenged to change ourselves.
Quote from: Sindain
Its kinda silly to complain that a friendly NPC isn't a well designed boss fight.
Quote from: Eric Blank
How will I cheese now assholes?
Quote from: MrRoboto75
Always spaghetti, never forghetti

zehive

  • Bay Watcher
  • [DRAGONFIREBREATH]
    • View Profile
Re: Svchost.exe
« Reply #7 on: April 27, 2013, 04:55:58 pm »

I'd recommend getting in on safe mode, copying your important stuff to external storage of some kind, and then wiping your hard drive and reinstalling windows. It might be a bit extreme but honestly it's the most clear-cut way of solving the problem.

Next time you install windows, put it on it's own partition so you can wipe and reinstall it without having to mess with your other files.

svchost.exe is a Microsoft Windows process running various services. It is perfectly normal to have a number of those running simultainously.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

One of the services that may cause slowdowns is the automatic windows update. Try turning off windows update and see if it helps.
I wouldn't really go for this if it isn't letting you see the properties of the svchost running, as it should allow you to as long as you are an admin. If it isn't located in system32, that's definitely a virus mimicing the normal windows process

If you need some documentation on this method I can supply some, here.

http://en.wikipedia.org/wiki/Scorched_earth

Tellemurius

  • Bay Watcher
  • Positively insane Tech Thaumaturgist
    • View Profile
Re: Svchost.exe
« Reply #8 on: April 27, 2013, 06:57:49 pm »

*sigh

first run process explorer and find which service is eating the resources.


if said process is faux run either malwarebytes or emsisoft emergency kit in safe mode
if clean, go to the command prompt (run as admin) and input sfc /scannow to check your system files

Eidolon

  • Bay Watcher
  • Floating weightless in a cavern.
    • View Profile
Re: Svchost.exe
« Reply #9 on: April 28, 2013, 02:36:27 pm »

I'd recommend getting in on safe mode, copying your important stuff to external storage of some kind, and then wiping your hard drive and reinstalling windows. It might be a bit extreme but honestly it's the most clear-cut way of solving the problem.

Next time you install windows, put it on it's own partition so you can wipe and reinstall it without having to mess with your other files.

svchost.exe is a Microsoft Windows process running various services. It is perfectly normal to have a number of those running simultainously.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

One of the services that may cause slowdowns is the automatic windows update. Try turning off windows update and see if it helps.
I wouldn't really go for this if it isn't letting you see the properties of the svchost running, as it should allow you to as long as you are an admin. If it isn't located in system32, that's definitely a virus mimicing the normal windows process

If you need some documentation on this method I can supply some, here.

http://en.wikipedia.org/wiki/Scorched_earth

Spoiler (click to show/hide)
Logged
In ancient times, men built wonders, laid claim to the stars, and sought to better themselves for the good of all.
But we are much wiser now.

Supercharazad

  • Bay Watcher
    • View Profile
Re: Svchost.exe
« Reply #10 on: April 28, 2013, 03:10:49 pm »

Hard drive formatted. Problem solved. Thank you!
Logged

Starver

  • Bay Watcher
    • View Profile
Re: Svchost.exe
« Reply #11 on: April 29, 2013, 09:16:27 am »

Hard drive formatted. Problem solved. Thank you!
Well, apart from you having no OS on it, anymore, if that's as far as you went... ;)

Seriously, formatting (or de-partitioning) and reinstalling your OS from scratch often[1] solves whatever problem you have, and can't confirm that it was the SVCHOST causing problems.  (Stakes to the heart tend to kill more than just vampires, etc.)

As such, do now ensure that your chosen AV is up-to-date and has a good reputation (often need not be a full paid-for version, I tend to find the "full suite" ones are bloaty, although they do offer additional tools and monitors to stop infection-vectors that you might have been vulnerable to).  Get Malwarebytes (my own preference, but other solutions can (and have) be mentioned) for periodic manual spot-checking.  Separating system partition from data partition is useful, as mentioned, but make sure you have some re-partitioning software (something like a GParted bootable CD, perhaps?) because at some point you may discover that you want an extra few gigabytes on your system area[2] that you want to take from your data area, or vice-versa, however well you thought you'd budget it beforehand.

One of my more diverse machines is a dual-booted Linux/XP machine, each 'system' on their own partition, with a third partition (NTFS format, readable/mountable by each OS) where I store stuff I wish to share between both boot-ups (really ought to get into Virtual Machining so that I can work on multiple OSes at the same time... Or set up that network file server I keep promising myself).  Although I still keep my default Linux $HOME on the ext3/4/whatever Linux partition for more natural 'native' management.  Not that you need to know this.  Technically, I should be splitting part of the 'system' partition off to hold the official /home part (thus saving me the same trouble as being advised about your Windows install, should I ever need to reinstall the system), but I tend to have historically gone for a single partition for all of Linux (to avoid the partition-resizing issues that I've just been explaining how to deal with!) and rely on backups to secure me whenever a reinstall is pursued, and/or needed.

But I've a feeling that last paragraph isn't of any use to you.  I suppose it's mostly there to show how inefficient I can be, in a self-effacing manner to those that know the better practices, however good my actual intentions are.


[1] Ignoring particularly resilient boot-sector infections that your reinstall doesn't touch, but those are rare enough.

[2] While you can install programs to "D:\Program[ File]s", instead of the C:\-based location, if you're reinstalling the OS you'll often lose all the registry entries as well, so apart from truly stand-alone programs like DF/LCS you might as well just use the System disc for that (perhaps automate the backing up of save-games), but shift your Documents And Settings/whatever to be onto the D: (Data) partition drive.
Logged

Supercharazad

  • Bay Watcher
    • View Profile
Re: Svchost.exe
« Reply #12 on: April 30, 2013, 11:15:48 am »

I'm currently using Malware Bytes and WSE to help prevent this happening again. In any case, my computer was long overdue for a clean out of all the crap I have on it.
Logged