an instance of svchost.exe going damned insane on startup

[Woolong]

so I have an instance of svchost.exe running randomly up to 100* CPU usage with mem usage near 200k. before Windows DEP would just force it off, resulting in a few dll files not running, and consequently some things wouldn't work properly. Now it just goes retarded and I have to wait a few minutes for it to go back down in the CPU area. I need to find the dll responsible and either delete it or cripple it. Is there a way of doing this?

Thanks.

Also, to give an idea of how frequent this happens: In the course of me typing this, my CPU usage shot to 100 at least 3 times.

 

[Schadenfroh]

Start>run>CMD> tasklist /svc

 

[Mermaidman]

"'tasklist' is not recognized as an internal or external command, operable program or batch file."

 

[imported_nocturne]

What he means is use the tasklist command in the command prompt, by going to the run box and exectuing 'cmd' (short for cmd.com or command.com).

What that command will tell you is exactly what services are running on what svchost process (they split themselves up, several to a thread). In order to tell which svchost process is to blame to begin with, in the task manager goto select columns in the view menu and check the 'pid' box, and in the process tab you'll now see a pid column -- just use the problem process's pid to reference the tasklist and find what service(s) are responsible.

If your not sure which of the services can be disabled safely to see if they are the problem, you can either post the questionable services here or google for blackviper's XP service guide. BTW... never use msconfig to disable a service -- use 'services.msc', executed from the run box.

 

[InlineFive]

Take a look with Process Explorer to determine which subprocess is using all of the CPU cycles.

In an uninfected system I've usually found it to be Windows/Microsoft Update.

 

[nineball9]

The Tasklist command ships with Windows XP Pro but not XP Home.
For a little info about Tasklist and where to dowload it, try here: Windows Expertise

If you download the file, place it in a folder on your PATH list unless you want to run it under the command promt using the full path, e.g. C:\"somewhere or another"\tasklist.

(Your Windows folder is likely on the path list. To see your path list, simply open the command prompt and enter "path" (no quotes))

 

[Woolong]

Ok, there's a Software Explorer in Windows Defender. the instance of svchost that's running amok randomly (including now) is svchost 920, which handles:

Windows Audio, Background Intelligent Transfer Service, Cryptographic Services, DHCP Client, Error Reporting Service, COM+ Event System, Fast User Switching Compatibility, Help and Support, HID Input Service, Server, Workstation, Network Connections, Network Location Awareness (NLA), Remote Access Connection Manager, Task Scheduler, Secondary Logon, System Event Notification, Windows Firewall/Internet Connection Sharing (ICS), Shell Hardware Detection, System Restore Service, Telephony, Themes, Distributed Link Tracking Client, Windows Time, Windows Management Instrumentation, Security Center, Automatic Updates, Wireless Zero Configuration

 

[Woolong]

Does anyone know how I can check to see what should be running under this instance of svchost?