Member Avatar for hermanotomas

Recently, I noticed in the Windows Task Manager that a spurious svchost.exe appears and always uses about 50% of the CPU resources. I 'End the process', but it will appear later. If I don't initiate a new activity the greedy svchost does not appear. One thing for sure that will bring up this svchost is using Windows Explorer to access some file or folder. Also, perhaps at other times when a program needs to access something in the file structure it will appear gobbling its 50% CPU time.
I'm using XP Pro SP2. I've been using this same system for over 3 years. Just recently I hooked up a 1Tb, WD 10EAVS External USB (My Book) hard drive within the general time frame of noticing the rogue svchost. Otherwise, no recent additions.

  • 2 Contributors
  • 1 Reply
  • 249 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by barryt

Dani AI

Generated

reported an svchost.exe that spikes to about 50% CPU whenever Explorer touches the filesystem, and that the symptom started after connecting a 1 TB WD My Book. That pattern points away from a random, always-on background virus and toward three likely causes: a legitimate Windows service hosted by svchost misbehaving, an Explorer-triggered component (thumbnail/codec or third-party shell extension) choking on a file or folder, or—less commonly—malware that is active when the file system is accessed.

A safe, orderly diagnostic path:

  • Reproduce the spike, then disconnect the My Book. If the svchost instance goes away, the external drive is the likely trigger.
  • Use Process Explorer (Sysinternals) to inspect the specific svchost PID: check the full image path, Services tab, and the Handles/Threads view to see which file or folder is being accessed. On XP, tasklist /svc can also map PIDs to services.
  • Check Event Viewer for related errors and temporarily disable non-Microsoft shell extensions (ShellExView) to rule out third-party Explorer handlers.

Remediation suggestions:

  • If a particular Windows service is identified, stop it temporarily via Services or msconfig and test.
  • If Explorer thumbnailing or a codec is the culprit, clear thumbnail caches or disable thumbnail previews and scan the offending folder(s) and the external drive with up-to-date antivirus plus a reputable anti-malware scanner (preferably run offline or in Safe Mode).
  • Run the drive maker’s diagnostics to rule out file system corruption or failing media.

Important caution: the manual deletion and registry-edit steps quoted by are risky on XP and can make the system unbootable if done incorrectly. Prefer identification and targeted fixes first, keep a full backup or image of important data, and if the cause remains unclear consider imaging the disk and a clean reinstall or moving off an unsupported XP install.

Member Avatar for barryt

svchost must be in your system32 folder of windows otherwise it might be a virus copycat

Symptoms:


When pressing Ctrl+Alt+Del it blocks to launch the Task Manager
It blocks the Registry Editor.
When you try to go to the command prompt CMD, it will restarts the computer.
The shared folders will duplicates itself to different locations of. The duplicated virus uses a FOLDER icon with an .exe file extension. The configuration of your Yahoo Messenger has been changed.
How to Remove It

OK here we go, you must follow this step on how to remove this virus in manually method:

Restart your PC and press F8 and select the option Safe Mode Command Prompt Only
And after you log-in the command prompt you must log-in as Administrator.
Type cd C:\windows\system32
Type dir /ah, to display all hidden files on this directory folder. You will see the following files which is used by the virus to spread itself: AUTORUN.INI, BLASTCLNNN.EXE, and SCVHOST.EXE
Type ATTRIB -H -R -S SCVHOST.EXE
Type ATTRIB -H -R -S BLASTCLNNN.EXE
Type ATTRIB -H -R -S AUTORUN.INI
Type DEL SCVHOST.EXE
Type DEL BLASTCLNNNN.EXE
Type DEL AUTORUN.INI
Type CD\
Type ATTRIB -H -R -S AUTORUN.INF
Type DEL AUTORUN.INF
You are almost done, reboot your PC you may seat back and relax.. :) while loading...

Go Start Menu and click the Run and type the REGEDIT command. Take note guys before make any changes into your Registry Editor you must make a full back-up to your registry to avoid system errors. :)

Look the location entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, if you see an entry Yahoo! Messengger (it’s spelled like this) with a value c:\windows\system32\scvhost.exe, Delete this entry.

Look the location entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, in the entry named: SHELL, a value = Explorer.exe,SCVHOST.EXE. Edit this value, delete the SCVHOST.EXE only and the value must be Explorer.exe. Once you delete all this value, your computer will not login anymore.

OK we are now done.. Please Restart your PC now and Enjoy!!!

above is a method from the internet
b

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.