svchost.exe, PC keeps freezing constantly, with high disk usage

Ok, I’ll humor you. I ran TDSSKiller.exe and it found nothing.

I reimage Windows every month and to a full Clean Install twice per year. I did a clean install twice last weak just to make sure there were no errors.

Now you have to realize that I am right and I need solutions other than scanning for viruses.

After all these years the problems with Windows just never stop, do they? Maybe I should just give up and get an iMac “27. After all, it’s the most advanced OS on the planet and is designed so well that no App can ever destabilize the computer.

(quoted from a Windows 8 forum):

Few things you can check:

1. go to: C:\ProgramData\Microsoft\Search\Data\Applications\Windows and look for the fileWindows.edb and check the size of this file. This is a database file associated withWindows Search feature. If it's too big, sometimes it can grow up to many GB's then it might cause high disk usage when Windows Search trying to rebuild the Search index. You can delete this file but first you need todisable the Windows Search service then re-enable after deletion.

---

2. Run Task Manager->Startup and disable everything then reboot the PC to see if it fixes the problem then re-enable one by one, reboot until the problem occurs again, then that's the culprit.
3. Run Task Manager->Details, then right click on the Title->Select Columns and put acheck on I/O Reads, I/O Writes, I/O read bytes, I/O write bytes then clickOK. Click on the Title to sort by I/O Read, I/O Write to find out which process utilizing the Disk I/O most and take appropriate action.

It is not possible that I have Malware, I am certain of it.

I specialize in Corporate Security, Cryptography, and Steganography.

I use Norton Internet Security and scan twice per day every day. The last time I got a virus was 3 years ago and I got it and removed it within 30 minutes.

I understand where you are coming from, but this is not my first time out. I scanned with 14 other anti virus programs before submitting this post. I suspect a software conflit or a corruption bug/ glitch in one of the third part Apps or Windows is to blame. But this is not my area of expertise so that is why I am asking here.

What is the next step?

Hi,

If you need to check for malware here are my recommendations - these will allow you to do

a thorough check and removal without ending up with a load of spyware programs running

resident which can cause as many issues as the malware and maybe harder to detect as

the cause.

No one program can be relied upon to detect and remove all malware. Added that often easy

to detect malware is often accompanied by a much harder to detect and remove payload. So

its better to be overly thorough now than to pay the high price later. Check with these to an

extreme overkill point and then run the cleanup only when you are very sure the system is clean.

These can be done in Safe Mode - repeatedly tap F8 as you boot however you should also run 

them in regular Windows when you can.

TDSSKiller.exe. - Download to the Desktop - then go to it and Right Click on it - RUN AS ADMIN

it will show any infections in the report after running - if it will not run change the name from

tdsskiller.exe to tdsskiller.com. Whether it finds anything or not does not mean you should not

check with the other methods below.

http://support.kaspersky.com/viruses/solutions?qid=208280684

Download malwarebytes and scan with it, run MRT, and add Prevx to be sure it is gone.

(If Rootkits run UnHackMe)

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

Malwarebytes - free

http://www.malwarebytes.org/products/malwarebytes_free

SuperAntiSpyware Portable Scanner - Free

http://www.superantispyware.com/portablescanner.html?tag=SAS_HOMEPAGE

Run the Microsoft Malicious Removal Tool

Start - type in Search box -> MRT  find at top of list - Right Click on it - RUN AS ADMIN.

You should be getting this tool and its updates via Windows Updates - if needed you can

download it here.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

(Then run MRT as above.)

Microsoft Malicious Removal Tool - 32 bit

http://www.microsoft.com/downloads/details.aspx?FamilyID=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Microsoft Malicious Removal Tool - 64 bit

http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en

also install Prevx to be sure it is all gone.

Download - SAVE - go to where you put it - Right Click on it - RUN AS ADMIN

Prevx - Home - Free - small, fast, exceptional CLOUD protection, works with other

security programs. This is a scanner only, VERY EFFECTIVE, if it finds something come back

here or use Google to see how to remove. 

http://www.prevx.com/   <-- information

http://info.prevx.com/downloadcsi.asp?prevx=Y  <-- download

PCmag - Prevx - Editor's Choice

http://www.pcmag.com/article2/0,2817,2346862,00.asp

Try the trial version of Hitman Pro :

Hitman Pro is a second opinion scanner, designed to rescue your computer from malware

(viruses, trojans, rootkits, etc.) that have infected your computer despite all the security

measures you have taken (such as anti virus software, firewalls, etc.).

http://www.surfright.nl/en/hitmanpro

---

If needed here are some online free scanners to help

http://www.eset.com/onlinescan/

---

Original version is now replaced by the Microsoft Safety Scanner

http://onecare.live.com/site/en-us/default.htm

Microsoft Safety Scanner

http://www.microsoft.com/security/scanner/en-us/default.aspx

---

http://www.kaspersky.com/virusscanner

Other Free online scans

http://www.google.com/search?hl=en&source=hp&q=antivirus+free+online+scan&aq=f&oq=&aqi=g1

---

After removing any malware :

Also do these to cleanup general corruption and repair/replace damaged/missingsystem files.

Start - type this in Search Box ->  COMMAND   find at top and RIGHT CLICK  -  RUN AS ADMIN

Enter this at the prompt - sfc /scannow

How to Repair Windows 7 System Files with System File Checker

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

How to analyze the log file entries that the Microsoft Windows Resource Checker (SFC.exe) program

generates in Windows Vista cbs.log

http://support.microsoft.com/kb/928228

Also run CheckDisk so we can rule out corruption as much as possible.

How to Run Disk Check in Windows 7

http://www.sevenforums.com/tutorials/433-disk-check.html

---

If any Rootkits are found use this thread and other suggestions. (Run UnHackMe)

http://social.answers.microsoft.com/Forums/en-US/InternetExplorer/thread/a8f665f0-c793-441a-a5b9-54b7e1e7a5a4/

======================================

If needed AFTER you are sure the machine is clean of all malware. (DO NOT USE IF

MALWARE IS STILL PRESENT.)

How to Do a Repair Install to Fix Windows 7

http://www.sevenforums.com/tutorials/3413-repair-install.html

=======================================

**For extreme cases :**Norton Power Eraser - Eliminates deeply embedded and difficult to remove crimeware

that traditional virus scanning doesn't always detect. Because the Norton Power Eraser

uses aggressive methods to detect these threats, there is a risk that it can select some

legitimate programs for removal. You should use this tool very carefully, and only after

you have exhausted other options.

http://us.norton.com/support/DIY/index.jsp

================================

If you are in North America, you can call 866-727-2338 for help with virus and spyware infections.

See http://www.microsoft.com/protect/support/default.mspx for details. For international information,

see your local subsidiary Support site.

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle - Mark Twain said it right.

Hi,

It is possible that this issue is related to malware so the next message will include how to check

thoroughly for that. Don't rule out malware, especially rootkits which can survive a format and

re-installation of Windows.

References to Vista also apply to Windows 7.

Solving the issue is a process of elimination.

What is svchost.exe?

http://windows.microsoft.com/en-us/windows-vista/What-is-svchost-exe

Svchost.exe Using 100% CPU Resources in Vista – Identify Causing Services

http://www.mydigitallife.info/2007/11/13/svchostexe-using-100-cpu-resources-in-vista-identify-causing-services/

How to determine what services are running under a SVCHOST.EXE process

http://www.bleepingcomputer.com/tutorials/tutorial129.html

What is svchost.exe And Why Is It Running?

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

Svchost.exe - Host Process For Windows Services (a lot of information - see Articles and Host Groups

on Left Side)

http://svchost-exe.net/

================================================================

How to troubleshoot a problem by performing a clean boot in Windows Vista orWindows 7http://support.microsoft.com/kb/929135

Use Advanced Tools to Troubleshoot Performance Problems in Windows 7http://www.howtogeek.com/howto/6152/use-advanced-tools-to-troubleshoot-performance-problems-in-windows-7/

Problems with overall system speed and performance

http://support.microsoft.com/default.aspx/gp/slow\_windows\_performance?p=1

How to troubleshoot performance issues in Windows Vista

http://support.microsoft.com/kb/950685

Optimizing Microsoft Windows Vista Performance

http://support.microsoft.com/kb/959062

To see all that is loading bootup - wait a few minutes without doing anything - then Right Click

TaskBar - Task Manager - take a look at Appplications - Processes - Services - this is a quick

reference (if you have a little box on Lower Left - Show for All Users then check that).

How to Change, Add, or Remove Startup Programs in Windows 7http://www.sevenforums.com/tutorials/1401-startup-programs-change.html

A quick check to see which are loading is Method 2 there - using MSCONFIG then post a list of

those here.

---

Tools that should help :

Process Explorer - Free - Find out what files, registry keys and other objects processes have open,

which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns

each process.

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Autoruns - Free - See what programs are configured to startup automatically when your system boots

and you login. Autoruns also shows you the full list of Registry and file locations where applications can

configure auto-start settings.

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Process Monitor - Free - Monitor file system, Registry, process, thread and DLL activity in real-time.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

There are many excellent free tools at Sysinternals

http://technet.microsoft.com/en-us/sysinternals/default.aspx

WhatsInStartUP - Free - This utility displays the list of all applications that are loaded automatically

when Windows starts up. For each application, the following information is displayed: Startup Type (Registry/Startup Folder), Command -Line String, Product Name, File Version, Company Name,

Location in the Registry or file system, and more. It allows you to easily disable or delete unwanted

programs that runs in your Windows startup.

http://www.nirsoft.net/utils/what\_run\_in\_startup.html

There are many excellent free tools at NirSoft

http://www.nirsoft.net/utils/index.html

Window Watcher - Free - Do you know what's running on your computer? Maybe not. The Window

Watcher tells all, reporting every window created by every running program, whether the window

is visible or not.

http://www.karenware.com/powertools/ptwinwatch.asp

Many excellent free tools and an excellent newsletter at Karenware

http://www.karenware.com/

===========================================

Refer to this thread for many more excellent tips however be sure to check your antivirus

programs, update major drivers and BIOS, and also troubleshoot with the cleanboot method

first.

Performance and Maintenance tips

http://social.answers.microsoft.com/Forums/en-US/w7performance/thread/19e5d6c3-bf07-49ac-a2fa-6718c988f125

Problems with overall system speed and performance

http://support.microsoft.com/gp/slow\_windows\_performance/en-us

Hope this helps.

---

Rob Brown - Microsoft MVP <- profile - Windows Expert - Consumer : Bicycle <- Mark Twain said it right.