Slow startup, no networking, svchost.exe using too much cpu

I've got a Sony VAIO VPCC227FX laptop running Win 7 Pro 64. A friend was using it one day, just browsing the web, and it crashed. It might have had a BSOD, but I'm not sure.

When I got home and started using it, here's what happens. (Sorry for the long description. Just trying to be thorough.):

+ It takes about 5-10 minutes to start up.
- After turning it on, it sits at the Starting Windows screen (with no icon) for at least 5 minutes. Then Windows icon comes up for a few seconds.
- Screen goes black, except for the mouse pointer. Sits here for a couple minutes.
- I hear the startup chime and then the logon screen.
- After entering my password, the remained of the startup process takes about twice as long as normal.

+ Once started, I can't connect to a network, either wired or wirelessly. Using ipconfig, I can see that I'm not getting an IP address from the router. Other computers on the network work fine.

+ svchost.exe is taking up 25% of CPU. It's a quad core computer. This is what happens when I try to track down the service:
- Right click -> Go to service: It's wscsvc. I stopped that service.
- svchost.exe still at 25%. Go to service again. It's lmhosts. I stop that one.
- svchost.exe still at 25%. Go to service again. It's Dhcp. When I try to stop it I get an error message saying that it's unable to stop the service.
- End svchost.exe proces. CPU usage goes back to normal, but still no networking.
- After a little while (10ish minutes) svchost.exe goes back to 25%

+ I tried a full system scan with Avast, but no problems found.

+ I tried a clean boot (selective startup, only windows services enabled). Got a similar slow boot, no networking, but no problem with svchost.exe.

+ I tried a diagnostic startup. Same results as clean boot.

+ I tried booting in Safe Mode, both with and without networking. In both cases I got a black screen for about 5 minutes before the logon screen. In the "with networking" case, the networking still wasn't working.

Any ideas of what the problem might be? I'm not sure what to do next.

Thanks!

Try a full system scan with Malwarebytes. The lmhosts is usually a dead malware giveaway.

Thanks for the quick response. I did a full system scan with Malwarebyes, it found 7 items, and I removed them all. Windows startup now seems normal, but I still have the svchost.exe problem and no network access.

Any other ideas?

Thanks.

tppk said:

Thanks for the quick response. I did a full system scan with Malwarebyes, it found 7 items, and I removed them all. Windows startup now seems normal, but I still have the svchost.exe problem and no network access.

Any other ideas?

Thanks.

First reboot and re-run malwarebytes. If clean run a system file check

Run a system file check to verify and repair your system files.
To do this type cmd in search, then right click to run as administrator, then
SFC /SCANNOW

It may need to be run up to three times before sucessful

Read here for more information SFC /SCANNOW Command - System File Checker

Let us know the results from the report at the end.

I ran Malwarebytes a couple more times, until it didn't find any problems. I'll let sfc /scannow run while I'm at work and will post the results this evening.

I tried SCN /SCANNOW but it aborted after 5% and said "Windows Resource Protection could not perform the requested operation."

Then I tried booting in safe mode so I could try the scan again, but it hung up when loading classpnp.sys.

Then I tried booting normally and it ran through a disk check. I walked away and when I came back it was at the standard windows logon screen.

I tried SCN /SCANNOW again and it got to 7% before aborting with the same message as above.

I'm not sure what to do next. Any ideas? Thanks for the help!

tppk said:

I tried SCN /SCANNOW but it aborted after 5% and said "Windows Resource Protection could not perform the requested operation."

Then I tried booting in safe mode so I could try the scan again, but it hung up when loading classpnp.sys.

Then I tried booting normally and it ran through a disk check. I walked away and when I came back it was at the standard windows logon screen.

I tried SCN /SCANNOW again and it got to 7% before aborting with the same message as above.

I'm not sure what to do next. Any ideas? Thanks for the help!

If you cant run SFC chances are good there is a problem with the OS that may need a repair install.

Bummer. Is there anything else I should try before I do a repair install?

tppk said:

Bummer. Is there anything else I should try before I do a repair install?

Since you were/are infected and SFC sees problems but cant fix them repair install is the best option unless you have a backup from before the problem started.

A repair install should not wipe out your data but I would make a backup just in case.