Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: svchost.exe streaming audio feeds and taking all available CPU


21 Aug 2013   #1

Windows 7 home premium 64 bit
 
 
svchost.exe streaming audio feeds and taking all available CPU

I saw this topic on the forum - svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds and although this seems to be an exact mimic of my problem I didn't think it was proper decorum to piggy-back onto his question svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds

When we turn on this 64 bit Windows 7 desktop it almost immediately starts playing what sounds like overlapping radio stations. Looking at taskmgr show that svchost's memory consumption climbs to where it's using over 500,000 KB of memory and the performance grinds to a halt. Ending the task stops the audio.

I ran a quick scan of Malwarebytes in safe mode, it detected a backdoor trojan, which I removed, and rebooted. The radio was still audible, and svchost was still maxed out.

I killed the process and downloaded Rkill and TDSSkiller. I ran Rkill in safe mode, it detected a zero access virus. I stayed in safe mode and ran TDSSkiller. It detected the zero access virus, and I clicked on Quarantine. It apparently quarantined nothing, because a normal reboot brought up the same symptoms.

I didn't want to go through the complete scenario of solutions offered to the original poster, so I never attempted the elevated net stop WMPNetworkSvc.

Should I be doing that, or something else?

My System SpecsSystem Spec
.

21 Aug 2013   #2

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

boweasel

Try this tool below

Farbar Recovery Scan Tool


64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

Note   Note
The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt


Please upload both logs in your reply.(FRST.txt and Addition.txt)

FRST.txt and Addition.txt will be on the Desktop

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .
My System SpecsSystem Spec
21 Aug 2013   #3

Windows 7 home premium 64 bit
 
 

For some reason I can no longer end the offending svchost process, so I'm now running in safe mode with networking. Here are the text files...

Additionally, this particular phenomenon occurred at my friend's house as soon as he turned on the PC. Now that I brought it to my house, it only seems to happen when I attempt to connect to the internet. In other words, when I first set up his PC at my house I did not connect an Ethernet cable to his tower, and his Dell desktop was powered on for hours without a peep. As soon as I connected the cable and restarted the PC, the radio noises began. Curiously, there are no noises while running in safe mode with networking.


Attached Files
File Type: txt FRST.txt (29.3 KB, 5 views)
File Type: txt Addition.txt (27.1 KB, 2 views)
My System SpecsSystem Spec
.


21 Aug 2013   #4

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Open Notepad . Inside Notepad paste the highlighted text inside notepad

start
Winlogon\Notify\AutorunsDisabled:
HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKLM-x32\...\Run: [] - [x]
ZeroAccess:
C:\Users\Vickie\AppData\Local\Google\Desktop\Install\{3ee2cae2-7844-dff1-ce2e-d0c62a7e658e}
C:\Users\Vickie\GoToAssistDownloadHelper.exe
end


Click on File ====> Save As

File Name : Fixlist.txt

Save as type : All Files

Location : Desktop

Click on the [Save] button .

Open FRST tool again from the Desktop and click on the [Fix] button . Once complete it will create a new log called Fixlog.txt . Upload the new log created in your reply . It should be on the desktop .

AdwCleaner

Click here AdwCleaner

Click on Download Now button

Save to the Desktop

Right-click on AdwCleaner.exe and choose

Click on Clean and confirm the prompt.


Upload the log : The log file is at C:\AdwCleaner[n].txt

Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file
My System SpecsSystem Spec
21 Aug 2013   #5

Windows 7 home premium 64 bit
 
 

Here's the Fixlog..


Attached Files
File Type: txt Fixlog.txt (1.1 KB, 2 views)
My System SpecsSystem Spec
21 Aug 2013   #6

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Run the two programs AdwCleaner and Junkware Removal ToolKit .
My System SpecsSystem Spec
21 Aug 2013   #7

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Log into the PC in normal mode and again run TDSSKILLER again

Do every step

TDSSKILLER

download link TDSSKiller

Save to the Desktop

Right-click the program and select


When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System

Click: OK


Press: Start Scan


If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


Please post the TDSSKiller log in your reply.
My System SpecsSystem Spec
21 Aug 2013   #8

Windows 7 home premium 64 bit
 
 

Quote   Quote: Originally Posted by VistaKing View Post
Right-click on AdwCleaner.exe and choose

Click on Clean and confirm the prompt.
The Clean option is grayed out. I can Scan, however. And maybe Clean after the scan?
My System SpecsSystem Spec
21 Aug 2013   #9

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Click Scan then upload the log
My System SpecsSystem Spec
21 Aug 2013   #10

Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
 
 

Log is in C:\AdwCleaner

Log title : AdwCleaner[R0]
My System SpecsSystem Spec
Reply

 svchost.exe streaming audio feeds and taking all available CPU




Thread Tools



Similar help and support threads for2: svchost.exe streaming audio feeds and taking all available CPU
Thread Forum
svchost.exe taking up too much CPU Performance & Maintenance
svchost.exe taking up too much CPU? Performance & Maintenance
Solved svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds Performance & Maintenance
Audio Streaming Music, Pictures & Video
Streaming audio help. Sound & Audio
Svchost taking too much memory Performance & Maintenance
svchost taking up as much bandwidth as uTorrent, why? General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 01:11 PM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33