svchost process runs wild

[Fred Caughlin]

Do you have a scan I can do to fix this? Also if you can I would sure like to know where exactly this came from. It is not easy to understand in that area for me as I used normal sites and had not done any other web surfing or downloads.

I am attaching the FRST and Addition logs, but they may not show anything about the svchost process when it goes wild. Maybe somehow the processes need to be scanned when the one is going crazy with the memory. Can anything be deciphered if I check “Go to Services” on the svchost process and look at those specifics prior to or when the process(es) is going crazy?

Ultimately I am intending to do a clean install of W7 on this to tune it up and get rid of all of the Dell stuff I don’t want. But I’d still like to get this all fixed up so I can make a backup disc of the original configuration and I don’t want that to include malware or a virus.

Thanks for any help.

 

[TwinHeadedEagle]

Hello,



They call me TwinHeadedEagle around here, and I'll be working with you.



Before we start please read and note the following:

• At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
• Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
• Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
• Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.
  
• All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
• If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
• I visit forum several times at day, making sure to respond to everyone's topic as fast as possible. But bear in mind that I have private life like everyone and I cannot be here 24/7. So please be patient with me. Also, some infections require less, and some more time to be removed completely, so bear this in mind and be patient.
• Please stay with me until the end of all steps and procedures and I declare your system clean. Just because there is a lack of symptoms does not indicate a clean machine. If you solved your problem yourself, set aside two minutes to let me know.
  
• Please attach all report using
  
  button below. Doing this, you make it easier for me to analyze and fix your problem.
  
• Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay for the repair.

Rules and policies

We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.



Are you familiar with OfficeAdRemover?

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Fred Caughlin]

No on Office Ad Remover. I am new to that and it is what I am wondering about. I have uninstalled it, but if it added some malware that is done.
I downloaded the fixlist file and it went to my download file where the FRST file is at along with on the desktop. I sent the fixlist to the desktop also. I get no option to run as an admin, only open using either location. The FRST does have the run as admin option, so it is just that the fixlist that wont do that. Did I do something wrong or what can I do here? Thanks.

 

[Fred Caughlin]

I put it in my desktop and it also has no run as admin option. Maybe a file defect. Of course I wouldn't have run it on that PC, and I immediately have removed it!! Thanks.

 

[TwinHeadedEagle]

You need to put Fixlist beside FRST. Then just run FRST by double clicking and press Fix.

 

[Fred Caughlin]

Still lost. I download the file. It only has option to open or save the file, but no option where to save it to so it goes to the download file. The FRST is on the desktop and also in that download file as I had been transferring a copy of it elsewhere previously.

If you mean beside and in next to FRST on the desktop or the download listing, that is true in the download file list, and when I send a copy to the desktop it is right next to it there also. I am not getting any icon, just an icon of a file for both of them.

Is there something else you mean by beside it?

I am starting to feel like an idiot here.

 

[TwinHeadedEagle]

Can you just open FRST and click Fix?

 

[Fred Caughlin]

No option to click anything when I open it.

 

[TwinHeadedEagle]

Please move FRST tool from your Downloads folder to your Desktop.

C:\Users\Dell\Downloads

 

[Fred Caughlin]

If that icon and the underlined Fix with Farbar Recovery Scan Tool is supposed to be a link, it is inoperable. It does nothing.

 

[TwinHeadedEagle]

It is not a link, it is only a title, nothing else.

 

[Fred Caughlin]

Ok, now I figured this out. I didn’t know we would be using the FRST tool, I thought it was just to generate the FRST report, so I had deleted it and that icon didn’t come to mind. I thought you meant the FRST report.

I went back and downloaded the tool. I ran it and here is the log from that.

 

[TwinHeadedEagle]

This is good. How is your PC behaving now?

 

[Fred Caughlin]

The tool said to restart and I think it was still goofy. I need to get some sleep, so I had shut it off. I saw your message like it may be better so I started it again. At first it seemed like it actually may have normal responses like it should be. But I tried the windows update check and that starts a svchost process that goes up to about max memory again. Of course then it gets a lot slower again. I think overall it is not much better even when the svchost isn't way up. And of course that svchost is still going crazy when something sets it off. I just opened firefox and started a video stream and that got it going up. Of course video ends up badly with low memory.

After that FRST restart is popped up asking if I wanted a change to my search page and I clicked to not change that. Hope that wasn't a mistake to what you were doing.

I had uninstalled that officeadremover using programs and features, but I notice it still gives me a pop up when I start about buying the service or something. So some remnant of that in the PC.

I'll check with this in about 8 hours. Thanks.

 

[TwinHeadedEagle]

Okay, keep me updated.

 

[Fred Caughlin]

I would say some progress may have been made, but still problems. Sometimes it starts right off with the svchost craziness, but usually opening a browser sets it off. Checking for Windows updates will always get it going crazy.

Must be some kind of hidden bug. If this is a tough one is there a way to look at all of the processes involved in that specific svchost process? I could allow remote viewer if that is necessary also.

I'll be working on other stuff, but will check in when I can.

 

[TwinHeadedEagle]

This is a notebook with low power processor and low amount of ram memory. With modern 64-bit operating system it is inevitable to choke sometimes.