Svchost Netservices

system · 2015-05-22T17:29:28.000Z

Svchost, running the services in the attached image, is using a bunch of memory, disk IO, and connections. I tried to scan a drive with a PC already running Avast and the same is now happening with that PC. Disabling Windows update seemingly stops the problem but that’s not really a solution.

Attached MBAM log is with Windows Update disabled. MCShield log after I made the mistake of connecting the drive is also attached.

Thanks in advance to anyone that helps.

TwinHeadedEagle · 2015-05-22T17:30:04.000Z

Hello,

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Scan with Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

system · 2015-05-22T17:33:06.000Z

FRST logs attached.

AswMBR is currently running and I’ll attach the log as soon as it finishes.

system · 2015-05-22T17:49:18.000Z

AswMBR log attached. If I need to re-enable Windows Update and rescan with anything please let me know.

TwinHeadedEagle · 2015-05-23T07:33:12.000Z

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

https://sites.google.com/site/cannedfixes/adwcleaner/adwcleaner_new.png
Fix with AdwCleaner

Please download AdwCleaner by Xplode and save the file to your Desktop.

[*]Right-click on
https://sites.google.com/site/cannedfixes/adwcleaner/adwcleaner_new.png
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
[*]Wait until the database is updated.
[*]Accept the Terms of use and click Scan.
[*]When finished, please click Clean.
[*]Upon completion, click Report. A log (AdwCleaner[S*].txt) will open.

Please include the contents of that file in your reply.

Note: Reports will be saved in your system partition, usually at C:\Adwcleaner

system · 2015-05-23T13:45:19.000Z

Logs attached. Still have the problem if Windows Update gets enabled :.

TwinHeadedEagle · 2015-05-23T18:35:02.000Z

It is normal to have higher CPU usage with Windows Update.

system · 2015-05-23T22:49:45.000Z

TwinHeadedEagle post:7:

It is normal to have higher CPU usage with Windows Update.

The attached is just with it enabled. This only started after plugging in an external drive.

TwinHeadedEagle · 2015-05-24T00:58:44.000Z

Do you have something on this External drive?

system · 2015-05-24T12:42:32.000Z

A drive from another PC that has the same problem that I was attempting to scan with Avast. I’ve tried reformatting it as well as restoring a backup image to it. The only thing I can think of that I haven’t tried at this point is shredding a drive before reinstalling Windows or a brand new drive. Is it possible that the USB bus is infected?

TwinHeadedEagle · 2015-05-24T16:02:27.000Z

Please download MCShield from one of the following links:

MCShield -Official download link

[*]Double click on MCShield-Setup to install the application.
Next => I Agree => Next => Install … per installation click on Run! button.
[]Wait a few seconds to MCShield finish initial HDD scan…
[]Connect all your USB storage devices to the computer one at a time. Scanning will be done automatically.
[*]When all scanning is done, you need to post a logreport that MCShield has created.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Post here AllScanst.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

system · 2015-05-28T20:56:44.000Z

It reports all the hard drives as clean. I’ve reinstalled W7 on two of the affected PCs and they seem fine so far but a Vista PC continues to have the problem. I’ve completely wiped the drive (overwrote everything with 0s), reflashed the BIOS, and I’ve flashed my router. TCPView shows svchost constantly opening and closing connections while I idle on the desktop.

Announcements