Member Avatar for deepfriedluigi

Hello there, the other day I downloaded a program, it had two smaller programs and i double clicked one called load_me.exe and it loaded like 50 or 60 of them into the processes tab and so I immediatly restarted the computer. When my computer started back up, the 60 or so processes that were hogging my resources were gone, but in its place were FIVE svchost.exe programs, i know that they are legit programs that are ran on the operating system, but I don't remember there being five of them before. Also now one of them is huge, ranging at times from 8,000 to 19,000 and is the second biggest process on my list aside from explorer.exe, I have downloaded the weilcha fix, and the blaster fix, (scan utilities norton) and they came back negative, i've checked for registry entires and I didn't see any, When I end on of the svchost.exe's it does the 60 second's till shutdown thing. This site is my only other hope, i've tried everything except reformatting, which judging by the people who have attempted that obviously does no good anyways. I see common posts about hijack this so i searched and downloaded it and ran a scan, I do not know if i scanned it correctly but here is the log it came back with, any help would be greatly appreciated, thanks a bunch! If you need any other details just say so. I am running windows XP professional build 2600 (i think it's 2600) i have 256 mb ram, a 3mbit cable internet connection, and a 2.0ghz celeron processor, I do not have problems copying and pasting, opening msconfig, or regedit, all of that works fine, however sometimes the windows xp userinterface will get really slow and change into a half xp half windows 98 look. I think it does that because of the lack of resources. Well here is the hijack this log...

Logfile of HijackThis v1.97.7
Scan saved at 9:01:39 PM, on 1/1/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\WINDOWS\System32\LXSUPMON.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\PROGRA~1\IDYLES~1\BANDWI~1\BWMNT.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Opera7\opera.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Documents and Settings\Administrator.NONE-E1UC6FU63H\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) -
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) -
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) -
O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} (InstallCtl Class) -

I have also ran spybot search & destroy to eliminate spyware. Please help I dunno what else to do :sad: !

  • 6 Contributors
  • 8 Replies
  • 589 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by baz_shaw

Dani AI

Generated

Short, practical follow-up for and anyone who finds this thread later:

Multiple svchost.exe processes are normal — Windows groups service DLLs into host processes — but a single svchost that keeps growing usually means one hosted service or DLL is misbehaving (memory leak, buggy update, or occasionally malware). ’s overview is the right starting point: don’t panic about the count, focus on the one that’s large. (winhelponline.com)

How to narrow it down without rebooting or reformatting: run Process Explorer (Sysinternals) and inspect the heavy svchost instance. Process Explorer shows the Image Path, parent process, loaded DLLs and the specific services hosted inside that process — this tells you whether the svchost is running only Microsoft services or something odd. If you find a non‑Microsoft DLL or an unsigned image, that’s a red flag. Use Autoruns (also Sysinternals) to examine and disable toolbars/BHOs/Run entries and other auto-start items (these are often where junk or cracked installers add things). Disable, reboot, and re-check the svchost you isolated. (learn.microsoft.com)

If inspection points to a problem service or you see unusual errors, check Event Viewer for errors/events tied to that service (Event IDs and source names are the best clues). If malware is suspected, boot Safe Mode (or use a rescue environment) and run an up‑to‑date second‑opinion scanner such as Malwarebytes; offline rescue media can clean things conventional scanners miss. Save Process Explorer and Autoruns output before making big changes — they’re useful if you need expert help.

A few cautions and workflow tips from the thread: don’t terminate svchost processes randomly (that can force shutdowns or break services). Use Process Explorer to identify the specific service, research that service before disabling it, then stop it from Services.msc or Autoruns if safe. Credit to and for flagging odd toolbars and to for the worm/Netstat angle — those are good parallel checks while you isolate the offending svchost.

Recommended Answers

All 8 Replies

Member Avatar for brujo

Alright tke out these Bad guys:

O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)

O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) -

This won't take care of your svchost.exe problem but nasties you should take care of none the less.

Member Avatar for Paladine

Ok, well svchost.exe is not a problem, unless you have it sucking > 85% resources. But then, it could mean you are running far too many apps/task bar thingy's that are requesting services and thus drawing system resources. I have 5 svchost.exe's running on my system. Ranging from 1,200K to 20,000K. But I have 768 RAM so I notice little on the resource side.


This describes Svchost.exe and its functions. Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs).
MORE INFORMATION
The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can run, depending on how and where Svchost.exe is started. This allows for better control and easier debugging.

Svchost.exe groups are identified in the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

Each value under this key represents a separate Svchost group and is displayed as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

To view the list of services that are running in Svchost:
Click Start on the Windows taskbar, and then click Run.
In the Open box, type CMD, and then press ENTER.
Type Tasklist /SVC, and then press ENTER.
Tasklist displays a list of active processes. The /SVC switch shows the list of active services in each process. For further information about a process, type the following command, and then press ENTER:
Tasklist /FI "PID eq processID" (with the quotation marks)

The following example of Tasklist output shows two instances of Svchost.exe that are running. Image Name PID Services
========================================================================
System Process 0 N/A
System 8 N/A
Smss.exe 132 N/A
Csrss.exe 160 N/A
Winlogon.exe 180 N/A
Services.exe 208 AppMgmt,Browser,Dhcp,Dmserver,Dnscache,
Eventlog,LanmanServer,LanmanWorkstation,
LmHosts,Messenger,PlugPlay,ProtectedStorage,
Seclogon,TrkWks,W32Time,Wmi
Lsass.exe 220 Netlogon,PolicyAgent,SamSs
Svchost.exe 404 RpcSs
Spoolsv.exe 452 Spooler
Cisvc.exe 544 Cisvc
Svchost.exe 556 EventSystem,Netman,NtmsSvc,RasMan,
SENS,TapiSrv
Regsvc.exe 580 RemoteRegistry
Mstask.exe 596 Schedule
Snmp.exe 660 SNMP
Winmgmt.exe 728 WinMgmt
Explorer.exe 812 N/A
Cmd.exe 1300 N/A
Tasklist.exe 1144 N/A

The registry setting for the two groupings for this example are as follows:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost:
Netsvcs: Reg_Multi_SZ: EventSystem Ias Iprip Irmon Netman Nwsapagent Rasauto Rasman Remoteaccess SENS Sharedaccess Tapisrv Ntmssvc
RApcss :Reg_Multi_SZ: RpcSs

As well, Musicmatch Jukebox taskbar tool/item should not be loaded at startup. Large resource hog in my opinion. I always suggest that the only things that should be running in a taskbar in windows systems with low ram is an antivirus software, and that is it.

Member Avatar for deepfriedluigi

Cool thanks guys, but what I don't understand is that I have not increased the number of programs that I run and svchosts have been taking alot more resources over the last 2 days than ever before, sometimes im down to 86mb ram when all I am running is norton and opera browser, right now things seem to be stabalized at 131 mb ram free while running opera browser and norton anti virus, also im at 5-10% cpu resources and no mess ups now, I think the problem may be fixed but I know there wa s a problem but I have ran alot of things and stuff so maybe I fixed it, please check back tomorrow I will post an update of how it's doing, thx guys.

Member Avatar for deepfriedluigi

Oh yeah and mine shows 5 instances of svchost running.

Member Avatar for caperjack

svchost is a generic name ,check this site .

Member Avatar for steosaur(oWn)


This is a app that lets you see whats running and gives some nice details. Dont know if it will help but it looks cool on your desktop. The lightning bolt tells people your a pro and they shouldnt be messin wit yo computer.

Member Avatar for deepfriedluigi

Thanks for all of your replies, things seem to be stabalizing now, thanks for all of your help. If I have any more problems I'll repost a new topic. Thanks again guys.

Member Avatar for baz_shaw

Still be worth checking to see of you have a DCOM/RPC exploit worm, such as W32.gaobot.AO. Read http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.ao.html
and see if any if the symptoms ring a bell. Run netstat -a from a command prompt, if you have a ton of ports open and epmap scouting for more, your hit with it.
Boot into Safe Mode and check your Task Manager again. Also run regedt32 & check HKLM/Software/Microsoft/Windows/CurrentVersion/Run & /RunServices for any of the names listed in the symantec article.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.