Multiple svchost.exe files eating CPU? (100%!)

Ryukouki · 09 Jun 2011

So, basically, first time poster here. I basically run Windows 7 HP 64bit, and recently I've been encountering a really high CPU meter and RAM meter, far too high to be considered "normal." From when I posted this, I have 69 processes running, I HAVE 15 SVCHOST.EXE things running! My RAM is in the 60's and this is from just sitting here! Doing nothing! I've run every decent AntiVirus program out there, and aside from the usual detections, it fails to delete the issue permanently.

I have run:
-Malwarebytes
-Advanced SystemCare 4 Free and PRO
-Trend Micro scanner
-Kaspersky Free scanner
-Avast
...and the list goes on and on... up till like 16 programs in 3 days.

If you need any more information, please let me know! I really need help!!

Borg 386 · 09 Jun 2011

Here are a couple utilities that can help you explore/diagnose this problem:

Process Explorer

Ever wondered which program has a particular file or directory open? Now you can find out. Process Explorer shows you information about which handles and DLLs processes have opened or loaded.

The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded. Process Explorer also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.

The unique capabilities of Process Explorer make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way Windows and applications work.

Process Monitor

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Also, you may wish to use this one to see if any of the high usage is linked to a source on the net:

TCPView for Windows

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.