hey!
ok, all must be well.
thank you fer your help you fellows are great!!
*<];-D
hey!
ok, all must be well.
thank you fer your help you fellows are great!!
*<];-D
hey
i dont think its all gone.
a svchost opens in and when shut down things pick up.
?
Hi musicalpulltoy,
Please can clarify what you what you mean by:
Try to describe exactly what happens and provide any error message(s) you receive.Originally Posted by musicalpulltoy
Did this issue start immediately following the final cleanup instructions or has it started since following further use of the computer?
Scolabar
--------------------------------------------------------------------------
No Reply Within 3 Days Will Result In Your Topic Being Closed
Malware Removal University - You too could train to help others
hey..
when online page loading goes from good to super slow.
at a restart ( after finding the svchost fake) i wrote down the PID of each svchost running.
when it slowed id shut down the new one and things returned to normal.
go figure ..
Hi musicalpulltoy,
Does the slowdown issue recur each time you restart the computer?
If so, please complete the instructions below so we can get a handle on what might be causing the slowdown.
Again, please remember to read the instructions below carefully before executing and perform the steps, in the order given.
If you have any questions about or problems executing these instructions, <STOP> do not proceed, post back with the question or problem before going any further.
Before proceeding please make sure any open programs are closed.
Step 1:
Tasklist Utility - XP Home
Please download the Tasklist Utility for Windows XP Home. Save the file to your Desktop.
Note: If the utility is not saved to the Desktop the following batch query will not work.
Step 2:
Batch - Query
Please follow the instructions below BEFORE killing off the "fake" new svchost process:
- Click on Start > Run.
- In the text entry box type:
notepad- Then click on the OK button.
- This will open an empty Notepad file.
- Copy and Paste the contents of the box below into the Notepad window:
Code:@echo off cd "%userprofile%"\desktop tasklist /svc /fi "imagename eq svchost.exe" > "%userprofile%"\desktop\svclook.txt notepad.exe "%userprofile%"\desktop\svclook.txt del %0 exit- Click Format and ensure Wordwrap is Unchecked.
- Save as svcquery.bat to the Desktop.
- Save as file type All Files otherwise it will not work.
- Now double-click on svcquery.bat to allow it to run the query.
(A command prompt window will flash on the screen briefly.)- Please Copy and Paste the contents of the file svclook.txt into your next reply.
Step 3:
"Fake" New Svchost Process - Feedback
When you shutdown the "fake" new svchost process this time, please make a note of the PID and post that information into your next reply.
Step 4:
Include in Next Post
- Did you have any problems carrying out the instructions?
- Does the slowdown issue recur each time you restart the computer?
- svclook.txt.
- What was the PID of the "fake" new svchost process you needed to shutdown?
Scolabar
--------------------------------------------------------------------------
No Reply Within 3 Days Will Result In Your Topic Being Closed
Malware Removal University - You too could train to help others
Hi musicalpulltoy,
It has been over 48 hours since my last post.
- Do you still need help?
- Do you need more time?
- Are you having problems following my instructions?
- In line with Safer-Networking's Forum Guidelines, topics will be closed after 3 days without a response.
- If you do not reply within the next 24 hours, this topic will be closed.
Scolabar
--------------------------------------------------------------------------
No Reply Within 3 Days Will Result In Your Topic Being Closed
Malware Removal University - You too could train to help others
hi.,.
was busy
when running the query i got "access denied ".
there were 2 pid 672 and2880.
after query 2460 appeared.
no, the new svchost can appear at any time.
Image Name PID Services
========================= ====== =============================================
svchost.exe 1612 DcomLaunch, TermService
svchost.exe 1712 RpcSs
svchost.exe 1884 AudioSrv, CryptSvc, Dhcp, EventSystem,
FastUserSwitchingCompatibility,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, w32time, winmgmt, wscsvc, wuauserv,
WZCSVC
svchost.exe 196 Dnscache
svchost.exe 364 LmHosts, SSDPSRV
svchost.exe 672 HTTPFilter
svchost.exe 2880 WudfSvc
svchost.exe 2460 stisvc
a second 1
pid 2052 and 3998
Image Name PID Services
========================= ====== =============================================
svchost.exe 1268 DcomLaunch, TermService
svchost.exe 1352 RpcSs
svchost.exe 1432 AudioSrv, CryptSvc, Dhcp, EventSystem,
FastUserSwitchingCompatibility,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, w32time, winmgmt, wscsvc, wuauserv,
WZCSVC
svchost.exe 1484 WudfSvc
svchost.exe 1696 Dnscache
svchost.exe 1724 LmHosts, SSDPSRV
svchost.exe 2052 HTTPFilter
svchost.exe 3988 stisvc
Hi musicalpulltoy,
Were you logged into an account with administrative privileges when you tried to run the query?
Did you get the "access denied" error the second time you ran the query as well?
Was the "access denied" error a standard Windows error message dialogu box? Or was error generated by the AVG or ZoneAlarm software?
Regarding the second query do you actually mean you killed the services:
or do you mean:Originally Posted by musicalpulltoy
pid 2052 and 3988?
Please try running the steps for the query again with both AVG and ZoneAlarm temporarily dsabled.
Have you attached a scanner or camera recently to your computer?
Or have you installed scanner- or camera-related software?
Scolabar
--------------------------------------------------------------------------
No Reply Within 3 Days Will Result In Your Topic Being Closed
Malware Removal University - You too could train to help others
hiya
yes its an administrator.
3988.
got access denied every time "standard windows".
there is a scanner connected but no new installs.
Image Name PID Services
========================= ====== =============================================
svchost.exe 1268 DcomLaunch, TermService
svchost.exe 1352 RpcSs
svchost.exe 1432 AudioSrv, CryptSvc, Dhcp, EventSystem,
FastUserSwitchingCompatibility,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, w32time, winmgmt, wscsvc, wuauserv,
WZCSVC
svchost.exe 1484 WudfSvc
svchost.exe 1696 Dnscache
svchost.exe 1724 LmHosts, SSDPSRV
svchost.exe 2052 HTTPFilter
svchost.exe 3988 stisvc