svchost.exe problem - not running any services

OEM said:

Glad to hear it sounds like you've found the culprit and abolished it from your PC.

I just wanted to add and ask, when running Process Explorer, did you run it as an administrator?

Right click Procexp and choose run as admin, ...then click "yes" for the uac pop-up. It does make a difference in the amount of info shown.

Good Luck, and I hope the malware is gone for good.

BTW, I checked it at viruswatchlite (Kaspersky), and it didn't have it listed either so it does seem to be something new as there pretty good with tracking, listing, blocking malware. I entered the name of your offending malware into the filter and it came up with nothing. So glad you got it, good job.

Kaspersky Viruswatchlite

Thanks for the tip. I remember I did run Process Explorer as "run as admin" at least once (I think on accident), but I don't actually remember noticing anything different unfortunately.

Hopefully this is the end of that virus, but I hope others can benefit from this thread.

Hi

I just thought I'd see if anyone has any more information on this. My vista laptop has started suffereing from the same problem (namely svchost.exe taking up 50% CPU and having no associated .dll services running under it.) It also runs under my user name rather than SYSTEM, LOCAL or NETWORK service.

I fear it may be a virus, but i get clean scans from AVG, malwarebytes and avira.
Wonder if its a mutation on the original posters issue?

Many thanks
Rob

Hi everyone (I hope Goluxor sees this..)

I think I am having the same problem, I have a svchost.exe taking up a lot of my CPU usage and it has no services operating under it. Closing it or ending the process helps only momentarily as another svchost.exe starts running in its place after a few minutes which also has no services running under it and the PID is different.
I want Goluxor to see the as he/she is the one who solved this issue, so I am really curious what scans you ran and what 'definitions' you used to find this. I know its been a while since you had this issue but if there's anything you remember I'm sure it would help

Cheers,
Silas

Ok I have an update on my issue.
I ran Malwarebytes anti-malware and it found something I think. Through out the scan and now afterwards, the svchost.exe that has been causing problems has been repeatedly closed down by host process windows services with these details:

Problem signature:
Problem Event Name: BEX
Application Name: svchost.exe
Application Version: 6.1.7600.16385
Application Timestamp: 4a5bc100
Fault Module Name: StackHash_e8ad
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: 74dec9f1
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.1.7601.2.1.0.768.3
Locale ID: 3081
Additional Information 1: e8ad
Additional Information 2: e8adce1c2b9e7be834b4063ac3c53863
Additional Information 3: e8ad
Additional Information 4: e8adce1c2b9e7be834b4063ac3c53863

----

Each time host process does this Malwarebytes has notified me that it has quarantined a threat. This threat is called Trojan.0Access from C:\$RECYCLE.BIN, and the filename is ALWAYS the same.
I have said that this particular svchost.exe re-appears after a short time after closure and due to that I now have over 30 of these Trojans in quarantine.
I am not sure what to do next as it just seems to duplicate itself in a never ending cycle of deleting this file...The RECYCLE.BIN file is empty when I went to look into it.
Does anyone have any idea about what I can do here???

Many thanks,

Silas