SVCHOST.exe routinely consumes almost all of system resources

On a particular computer, running windows xp home sp1..
For no apparent reason, one instance of SVCHOST.exe suddenly consumes just about all of the processor time, and sometimes causes the computer to stop responding entirely.. it can be killed, but it returns soon after.. i was just wondering if anyone out there has had this problem. my guess is that it is a virus, but it would be helpful if i knew eactly what it was.

 

See the thread:
http://forums.majorgeeks.com/showthread.php?t=38821&highlight=svchost.exe
which gives info about svCHOST even though it also talks about svhost.exe (which is a virus)

Some of the answers were:
Process File: svchost or svchost.exe
Process Name: Service Host Process
Description: Application that works as a host process for services that run from dynamic link libraries.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A

It is also common to have 4 or 5 of these processes in memory. You can find out which services/files are in each SVCHOst.EXE by opening up a DOS prompt and typing 'tasklist /svc'

Most programs run as .exe files, but some Services run directly from .dll files (mainly WIndows processes). Svchost.exe is the Generic Host Process that allows the .dll files to be loaded into memory and executed as a program.

A great place for info:
http://support.microsoft.com/?kbid=314056

 

Wich one is a virus SVC or SV?

 

found this at: http://support.microsoft.com/defaul...com/servicedesks/fileversion/dllinfo.asp&fp=1

Make sure the search says "product and files", then on the right side you need to select the correct Product -- I put in Windows XP (-- it's a drop down window) , then typed in svchost.exe for file name

This place didn't say anything for svhost.exe but I gather from the posts in the other thread that others were saying that THAT is a virus.

 

Back to the first problem: SVCHOSTconsumes system resources

I found this re: svchost and Windows XP -- You'll have to read it to see if you think it's what your problem is: Titled: Slow system performance or your computer stops responding when you use Windows Management Instrumentation in Windows XP....so it sounds like it might help.

http://support.microsoft.com/default.aspx?scid=kb;en-us;838884&Product=winxp

 

http://vil.nai.com/vil/content/v_100559.htm#VirusChar

there are a couple of worms that attack the svchost file

W32/Nachi.worm is one but it should be extinct by now cause it had a built in payload timer or so i understand it

get active ports from majorgeeks http://www.majorgeeks.com/download.php?det=682 and check your open ports here
http://www.bekkoame.ne.jp/~s_ita/port/port1-99.html
it wont say for sure that you have a virus but it will tell you if any of the major worm, virus ,spyware, ports are open and transmitting

if you have a firewall you could also just put svchost on ask mode so it has to ask you before it goes online
i got mine on ask or block mode all the time and havent had any problems with it not being aloud online

windows auto update uses it but i run the update scan manually every 2 or 3 days so i have had no problems with it blocked

 

thanks everyone