svchost.exe problem - not running any services

I am running 32-bit Windows 7 Professional on my laptop [Core2Duo P9300; 2GB RAM] and everything was going smoothly up until yesterday when suddenly, the fan started to ramp up and continue blowing at startup (usually, when I press the power button, the fan will start, but then it'll die down by the time the OS boots up).

That's when I opened up Task Manager and noticed svchost.exe was using ~50 in the CPU column. I tried checking what services were running under it, but when I clicked "go to Services," no services were highlighted! What's even stranger is, under the "User Name" heading, instead of System, Local Service, or Network Service [like the other instances of svchost running], it just says my computer's name [for the purpose of privacy, we'll say my computer's name is goluxor].

I then used Process Explorer to double check things [screenshot attached], and it also showed nothing was running under it.

svchost Viewer also yielded nothing. In fact, this is what it said verbatim:

No Service(s) Where [sic] found for "svchost" with PID :2824

This is not normal, it is strongly recommended you check
if this is a program you want to have running.

Command line used to start the process:
C:\Windows\system32\svchost.exe -k netsvcs

Path to the executable file:
C:\Windows\system32\svchost.exe

Description:
svchost.exe

On a lark, I decided to "end process" the errant svchost.exe, and that seems to have freed up my CPU and stopped my fan. However, upon restart, the same problems comes back. I've ran anti-viruses (Avast and Malwarebytes Anti-Malware), but they haven't picked anything up. My Windows Automatic Updater is also disabled. Now, I'm all out of ideas on what to do, and I hope y'all can help. Thanks.

richc46 said:

This should explain how to stop the service

What is svchost.exe And Why Is It Running? - How-To Geek

Same in 7

Thanks for the tip, but that's actually my problem: I don't see any services being listed for the particular svchost.exe that's running!

Jacee said:

Have you run an Anti-virus/malware scan, just to make sure you haven't picked something up?

Did that already. I've done some other things I also mentioned in my original post, but so far no progress. Hopefully y'all can suggest some stuff I haven't thought of yet. Thanks!

Jacee said:

Read this Svchost.exe process | What is Svchost.exe file?
You might want to download RunScanner too. :)

I'll go try that, thanks! I'll also try another virus scan with today's updated definitions. *crossing fingers*

Success! I tried my antivirus programs again after updating the definitions lists from yesterday and I seem to have caught a "Trojan.Dropper" named wwwbyh32.exe. Seems to be very new or very rare b/c Goggle turned up barely anything on it, but it seems to have fixed my problem as there is no longer a rogue svchost.exe and my CPU is now back to its old idling levels of single-digits.

Thanks Jacee for recommending another virus check. I didn't think there'd be a new definition for it so soon, but looks like there is.

whs said:

How about a system restore to before yesterday. This is an interesting problem. I have never seen a svchost.exe without an associated .dll.

I actually considered doing that, but I found out my last system restore point was from last year (much too old for the programs I need to use). I'm not sure if I turned it off or something, but is it supposed to automatically come up with restore points or do I have to do it manually? Also, out of curiosity, since I use it so infrequently, is System Restore the same as "Backup and Restore?" Thanks!

Glad to hear it sounds like you've found the culprit and abolished it from your PC.

I just wanted to add and ask, when running Process Explorer, did you run it as an administrator?

Right click Procexp and choose run as admin, ...then click "yes" for the uac pop-up. It does make a difference in the amount of info shown.

Good Luck, and I hope the malware is gone for good.

BTW, I checked it at viruswatchlite (Kaspersky), and it didn't have it listed either so it does seem to be something new as there pretty good with tracking, listing, blocking malware. I entered the name of your offending malware into the filter and it came up with nothing. So glad you got it, good job.

Kaspersky Viruswatchlite