my girlfriends machine is a 1.3 pentium 3, 512 ram, xp home system

it work fine and then all of a sudden the scvhost will shoot up to 99% cpu usage and cause the system to slow to a crawl.

i have scanned for a virus, a trojan, both spybot and adaware and all have come up clean.

i did the decombobulater, changed the rpc permissions to "restart the service".

here is a copy of the hijack log:

Logfile of HijackThis v1.97.7
Scan saved at 10:10:48 PM, on 12/6/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Jim\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
C:\WINDOWS\system32\svchost.exe

F1 - win.ini: load=???
??? ???
?
???

F1 - win.ini: run=???
??? ???
?
???

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O9 - Extra button: Real.com (HKLM)
O16 - DPF: axscanner - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: axscannerruntime - http://www.pestscan.com/scanner/axscannerruntime.cab
O16 - DPF: First Class Solitaire by pogo - http://temp38.pogo.com/applet/solita...-ob-assets.cab
O16 - DPF: Jungle Gin by pogo - http://gin.pogo.com/applet/gin/gin-ob-assets.cab
O16 - DPF: mscomctl - http://www.pestscan.com/scanner/mscomctl.cab
O16 - DPF: msvcp71 - http://download.pestpatrol.com/Downl...ts/msvcp71.cab
O16 - DPF: msvcr71 - http://download.pestpatrol.com/Downl...ts/msvcr71.cab
O16 - DPF: Payday FreeCell by pogo - http://freecell.pogo.com/applet/free...-ob-assets.cab
O16 - DPF: Pop Fu by pogo - http://popfu.pogo.com/applet/popfu/popfu-ob-assets.cab
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: Spades by pogo - http://spades12.pogo.com/applet/spad...-ob-assets.cab
O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet/sq...-ob-assets.cab
O16 - DPF: Sweet Tooth TM by pogo - http://temp83fe.pogo.com/applet/swee...-ob-assets.cab
O16 - DPF: Tumble Bees by pogo - http://jumbee.pogo.com/applet/jumbee...-ob-assets.cab
O16 - DPF: Turbo 21 TM by pogo - http://turbo12.pogo.com/applet/turbo...-ob-assets.cab
O16 - DPF: Word Whomp Whackdown by pogo - http://whackdown.pogo.com/applet/wha...-ob-assets.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {4C226336-4032-489F-9674-67E74225979B} (OTXMovie Class) - http://www.otxresearch.com/OTXMedia/OTXMedia.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...941.6139930556
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab



any help would REALLY be appreciated! i'm ready to toss this box on the street!

I don't see anything really strange in the log ,but I am just learning what it all means , check the highjackthis fourm for more help
http://forums.spywareinfo.com/index.php?showforum=11

Re: svchost takes up to 99% - %100 of cpu

i HAD THE SME PROB.

dON'T THINK IT'S A VIRUS

it's funny how different things work for different people/computers. Here's how I solved it.

First I tried the suggestions mentioned by others and got nowhere.

For xp pro

First-- open task manager control/alt/delete keep it open
(note which services are using memory and cpu.)
(some you don't even need like p2p networking - this come installed with kazaa but kazaa does't need it to work- you can uninstall at cotroll panel add/remove programs) and so on.

Second--open control panel/admin tools/services (not component services just plain services.

NOW arrange both windows so you can see them.

now go down the list of services and turn them off and back on while monitering the taskmanager until you see the culprit that is hogging your cpu usage.

note: my culprit happended to be "ssd discovery services" which was indicating it was "stopping" where the others read started.


HOPE THIS HELPS

common problem with xp - applications not starting correctly, then taking up 99% cpu usage. my experiences show it happens with iexplore.exe, help centre, some virus scanners, etc.. it's quite random, and microsoft have not yet released a fix for it. i'm told it's partially due to corrupt/damaged system files. this fix should work for all versions of xp, but BACK UP ALL YOUR IMPORTANT FILES FIRST!

Place XP CD in cd drive with windows running.
Quit out of the menu that pops up.
Go to START>Run
Type "sfc /scannow" then press OK.

This will check and restore if corrupt all your sytem files. It can corrupt other files, hence the warning to back up other files.

Hope it helps

I just noticed that you seem to be running two antivirus programs -- Norton and RAV. This can cause no end of problems, including what you are experiencing.

Hi,
I have the problem on our server running IIS and a web site with a page containing the control mscomctl.cab.
In your list, i have noticed:
O16 - DPF: mscomctl - http://www.pestscan.com/scanner/mscomctl.cab

You have to know that for queries wich need to return an important amount of data (records), the server hangs till a time out. During the process the cpu goes up to 100%. The server has 1Gb of Ram.

If you have designed the site with this control, i would be glad to know if you foind a solution to this prob.

Cheers

I have the same problem and am running NAV 2004. Happens even when diabled. See the following that I found at Microsoft Website
http://support.microsoft.com/default.aspx?scid=kb;en-us;833228&Product=winxp

MS has finally fixed ALL the bugs relating to SVCHOST. The patch can be found at:

http://support.microsoft.com/default...;EN-US;Q927891

It's an update to the same patch released a month before, which actually didn't work for me. After installing this new patch it's fixed this problem which I've been having for a year now and has prevented me from using Microsoft Update and would randomly lockup up the PC about 3 times a day!

Well, if this helps anyone....I'm glad. If not, well, that's my two cents. :mrgreen:

Stop or Disable Automatic Updates.....this did the job for me. With Task Manager and Services both open, stopping Automatic Updates immediatley stops 99% CPU usage for PID 1160 svchost.exe. Confirmed 3 of 3 restarts.

Windows XP Pro SP2

On the one machine where I had this issue, I also found that stopping Automatic Updates solved the problem. However, I also found that I could keep Automatic Updates enabled once I disabled Microsoft Update returning to basic Windows Update. This is done by going to the Microsoft Update page, clicking Change Settings and then scrolling down and selecting "Disable Microsoft Update software and let me use Windows Update only" and then click Apply changes now.

The only machine that I've seen with this issue had a Celeron processor. I'd like to hear from others to see if a Celeron is a common factor.