# Svchost goes berserk!



## Chmat (Apr 13, 2010)

Hey there! I got a problem with a process/driver (idk the real term, got swedish Windows). Ever since i brought (in a PC store) this new antivirus called Norman my computer start up with this process "Svchost - network service" that takes up to 50% of my CPU! If i shut the process of once it comes back and takes 10% more CPU than before, but when I've shut it down 3 times it doesn't come back again. The computer runs perfectly fine after that, but its anoying always to take 5 - 10 minutes to start up the computer and wait for the process to start so I can shut it down 3 times.

It is Norman's fault that this process appears, but I can't just remove it and use another Anti-virus. No, this Norman have stolen my computer! If I uninstall it my internet won't work! At all! My dad is making hardware for a living and is quite handy with software as well, but he can't fix the problem. When reinstalling Norman the internet works again, so I'm stuck with a Norwegian inside my PC (Swedish: Norrman = Norwegian). I'm to lazy to reinstall my OS from scratch, so here is my question: Is there any way I can prevent this process from even starting?

If any help, I use a Vista 32 bit.


----------



## LizardKing (Apr 13, 2010)

Norton?


----------



## Chmat (Apr 13, 2010)

LizardKing said:


> Norton?


 
Nope, Norman


----------



## Runefox (Apr 13, 2010)

I've never heard of it, but it seems to be a European security suite. It seems to be legitimate from what I can tell, and AV-Comparatives has it listed. I absolutely cannot recommend it - It's among the worst tested by AV-Comparatives, among the slowest and least sensitive. And with this, it seems as though it's also very bad with system performance.

Anyway, try this. It should fully remove Norman from your computer, including the aspect of it that causes your internet to stop working if you uninstall it normally (this is because the uninstall program isn't properly removing its driver that hooks into the network, and since the driver can't load because Norman is gone, it fails and your internet connection won't start). If it still won't work, grab Autoruns and look for everything related to Norman (it should say Norman in the Publisher column) and uncheck them. This should get you back up and running.

Aside from that, no, you can't prevent the process from starting. If you do successfully manage to get Norman removed via that tool, I'd recommend switching to Avast Free edition.


----------



## SnowFox (Apr 13, 2010)

Never heard of "Norman" antivirus, but if svchost is the real thing it has nothing to do with this program, It's part of windows and is the process for quite a few windows services. I've seen this 100% cpu usage thing happen quite a few times and it seems to be caused by the windows update service.

You could try temporarily (or permanently) disabling it to see if it's the cause.

start ->run,  enter *services.msc*. Open up "Automatic Updates" stop it and set it to disabled.


----------



## Ricky (Apr 13, 2010)

Yes - it will be in the registry.

You can run:

cmd > tasklist /svc

in order to list your processes and the services attached if you need to try and find out what the fuck is going on first.


----------



## Ames (Apr 14, 2010)

Svchost has to do with windows update.

I had this problem before (on XP), and disabling automatic updates solved it for me.


----------



## yak (Apr 14, 2010)

Uhm, "scvhost" is the container process for pretty much all Windows services - not just windows update. Google for "disabling unnecessary services in Vista" and follow the instructions - you'll be doing yourself and your PC a favor.


----------



## Ricky (Apr 14, 2010)

Also, I've seen spyware attach itself to this process before, probably to try and hide itself.  If you run cmd and type "tasklist /svc" you can see the services that are running and Google them if you need.


----------



## Runefox (Apr 14, 2010)

Pretty much anything can "attach" to svchost because it's a surrogate process. This is why first and foremost it's probably a good idea to take that antivirus out of the picture, especially if it's caused trouble before. A free tool called Prio can add some useful tooltips to Task Manager that will tell you what services are attached to a given svchost to narrow down your search a little (it also saves the priority/affinity of tasks and offers the ability to check digital signatures and enable programs of your choosing to use UAC silently - Handy). Process Explorer can also tell you, and is a fairly robust Task Manager replacement (sadly not compatible with Prio to save priorities/affinities, but still excellent).


----------



## Chmat (Apr 14, 2010)

Thanks for the posts so far, and another thanks to yak for making me turn of alot of unnececery stuff, and also that damn "omg that pogram didnt work!!!! REPORT TO MICROSOFT SO WILL WE NOT DO ANYTHING ANYWAYS!!!" window. It have annoyed me for years!

Also, looking in my tasklist, i dont have a "automatic updates", or "windows automatic updates" in the list. I have however found four tasks that are conected to this specific svchost process via the activityhandeler (ctrl+alt+delete) and used "show tasks". the four have the PID 1732, they're all NetworkService(s) and the names are: "TermService", "KtmRm", "Dnscache" and "CrypSvc". 

When turning the problematic Svchost off the tasks disapear alongside it, and the PC works fine. however, one minute later another Svchost have taken its place, and the same tasknames apear again, but with the PID 2076 this time. 

The third and final Svchost takes some time to launch. about 2-5 minutes after the second svchost is gone thisone apear. This one is a little different however. While not taking 40% of the CPU, thisone just takes 20%, but the process "System - system - NT Kernel & System" skyrockets and takes up to 50% CPU. This Svchost only have three tasks. PID 448, and we have the same names again exept for "CryptSvc" which i found lying about stoped and without a PID. Turning off Svchost thistime makes the System process to calm down to normal and a fourth Svchost of the same kind does not apear. This happends everytime i boot up the PC, and oddly after three times it NEVER reapears. I've had the computer on for a week just to see if it would come back. It didn't until, as I said, i rebooted the PC.

Ricky, the problem disapeared when I had uninstaled Norman, but as I said my conection to the internet alongside it. Do you think Norman somehow is acting like a spyware on this process?


----------



## Runefox (Apr 14, 2010)

Again, if removing Norman causes this to stop, try using the removal tool from Norman's website rather than just uninstalling it. It should get rid of everything _properly_, where most antivirus uninstallation programs seem not to.

On that note, in case you DO find yourself in a situation where you have no internet after removing Norman, download Autoruns and uncheck *everything* to do with Norman (it should say something about Norman in the Publisher field). If you got everything, reboot and you should have your internet back. Be careful only to uncheck Norman-related items. If you want to reduce your chances of hitting something important by mistake or just want to reduce the clutter, go to Options, then hit Hide Microsoft and Windows entries, and then hit the refresh button.

Again, I recommend Avast Free Edition to replace Norman. It's a lot faster, a lot lighter, and a lot *better* overall. Norman isn't really providing you with a whole lot of anything in the way of protection right now.


----------



## Chmat (Apr 14, 2010)

I will do what you say, Runefox. In a year. I've paid 700 kr = about 100 USD for Norman - 1 year subscription and it do provide protection, and is wayyy better than Norton that i had before. Norman acctually found things Norton did not (But it also thinks my Roller Coaster Tycoon 2 is a troyan everytime i start it) The only thing that bugs me is this awful Svchost process! This is my main problem and I'm looking for a way to make it stop appearing.

I do apreciate your advice though, and will do the exact thing you've told me now as soon as my subscription runs out.


----------



## Runefox (Apr 14, 2010)

Are you willing to suffer through this just because you spent (a _lot of_) money on it? What about the time and effort you waste every time you start your computer? Surely that's worth something, too. You should contact Norman and describe your situation; They may have heard of it before.

However, you might also want to check to be sure that you don't have some malware on your system. If Norman found things when it was installed, then it's possible that you've got a minor infection somewhere that it wasn't capable of removing. Try downloading Malwarebytes' Anti-Malware and giving your system a going-over with it just to be sure.


----------



## Chmat (Apr 14, 2010)

Thanks! That's the first thing I'll do in the morning!

And yes. It's annoying, but its now a reflex for me to press ctrl+alt+delete as soon as i see that it booted up.


----------



## SnowFox (Apr 14, 2010)

Chmat said:


> Also, looking in my tasklist, i dont have a "automatic updates", or "windows automatic updates" in the list. I have however found four tasks that are conected to this specific svchost process via the activityhandeler (ctrl+alt+delete) and used "show tasks". the four have the PID 1732, they're all NetworkService(s) and the names are: "TermService", "KtmRm", "Dnscache" and "CrypSvc".



I don't know how things have been changed around in vista, so maybe you could try it on the command line assuming that hasn't been altered since XP

open up a command prompt and run these 2 commands:


```
sc config wuauserv start= disabled
net stop wuauserv
```

For some reason the space between "start=" and "disabled" is required or it won't work.

If you want to undo this later just change disabled to auto.


----------



## Chmat (Apr 15, 2010)

SnowFox said:


> I don't know how things have been changed around in vista, so maybe you could try it on the command line assuming that hasn't been altered since XP
> 
> open up a command prompt and run these 2 commands:
> 
> ...




Tryed it, and there is no difference


----------



## TreacleFox (Apr 15, 2010)

lol norman...


----------



## Ricky (Apr 15, 2010)

So you know that's the right PID for the svchost that is the problem?

You can try stopping the services individually by going to cmd and typing:

sc stop servicename

to see which one is the cause.

Also, this might help:

http://everything2.com/node/1358272


----------



## Dyluck (Apr 15, 2010)

Would you say that it's. . . 
	

	
	
		
		

		
			



?


----------



## Chmat (Apr 15, 2010)

Dyluck said:


> Would you say that it's. . .
> 
> 
> 
> ...


Bwahahahahaha!!! You made my day! 

As long as they are running, yes. Then its SVCCHAOS X3


----------



## Ricky (Apr 15, 2010)

no


----------

