Anyone know how to fix 99% cpu svchost.exe

[omega]

Ok, I've narrowed it down. The svchost.exe (network service), doesn't actually hit 99% on startup. It spikes when I do anything that attempts to connect to the net. Open explorer, run an update program etc. I think it appeared to be 99% on startup most of the time because windows update was trying to connect.

How can I explore the svchost.exe and see which programs are running under it?

If killing the process works and doesn't seem to cause any problems, then how can I just disable it from the start?

Doing malware/virus scans now.

[fenris_w0lf]

Hmmm....what antivirus are you running?

If its not Microsoft Security Essentials, then uninstall whatever you have installed and reboot. Then install MSE. (just google it)

To explore what programs is running under svchost you need to install ProcessExplorer (posted earlier).

You cant disable svchost as such, but if you install and use ProcessExplorer you should be able to narrow it down.

[Meow]

How can I explore the svchost.exe and see which programs are running under it?

Type tasklist /SVC in the command prompt or use ProcessExplorer.

It's all mentioned in the link I posted earlier. Go through it.

[fenris_w0lf]

The tasklist cmd was new to me, nice tip Meow!

Unfortunately it seems that the "tasklist" cmd is unable to give the path to the exe's/dll's running under svchost tho....ProcessExplorer will do this.

[omega]

do I need to have the process running, if I killed it will I be able to see still?

oh it looks like it runs itself again, but without the 99% problem..... so strange.

[omega]

The particular svchost.exe only runs one service, DNS client(dnscache), it runs at 99% for about 5 mins when I try to connect to anything. If I kill it, it doesnt seem to reload.

I disabled it, now I will see what effect it has on my system when I reboot.

[omega]

Good its fixed. Now can anyone answer why it was doing this, and why I needed it - well actually seems I don't need it.

Maybe it has something to do with my hosts file, which I got to block ads. It's confusing.

[[EIF]BokiSergy]

How can I explore the svchost.exe and see which programs are running under it?

Type tasklist /SVC in the command prompt or use ProcessExplorer.

It's all mentioned in the link I posted earlier. Go through it.

Basiaclly, to find which one is the service, u use option rightclick and "go to the service".

Its in task manager, when u do right click of svchost.exe, and its bottom option. But, then u have to see which one runs and u may use ProcessExplorer. Or u can do reversed process, when u are in Services, u can right click on every each service u found, and pick option "go to then process", and it will lead to a one instance of svchost.exe, and after few guessing u will find the one.

[fenris_w0lf]

A couple of posts discussing "DNS Client [DNScache]"

http://www.bleepingcomputer.com/forums/topic245277.html
http://social.technet.microsoft.com/For ... 104fd2e2e/

Basically its this:

The DNS resolver service caches DNS lookups so that the system doesn't have to perform a new lookup every time you visit a website. Disabling the service means that Windows will always query your default DNS server when you visit a website. While disabling it will add some additional overhead to your Internet usage it ought not make a noticeable difference while browsing the web.

What antivirus are you running?

Check your hostfile, does it look ok?

Did Malwarebytes find anything?

[evertone]

combofix.exe