svchost.exe streaming audio feeds and taking all available CPU

Page 1 of 15 12311 ... LastLast

  1. Posts : 678
    Windows 7 home premium 64 bit
       #1

    svchost.exe streaming audio feeds and taking all available CPU


    I saw this topic on the forum - svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds and although this seems to be an exact mimic of my problem I didn't think it was proper decorum to piggy-back onto his question svchost.exe (netsvcs) maxing CPU out by streaming in audio feeds

    When we turn on this 64 bit W7 desktop it almost immediately starts playing what sounds like overlapping radio stations. Looking at taskmgr show that svchost's memory consumption climbs to where it's using over 500,000 KB of memory and the performance grinds to a halt. Ending the task stops the audio.

    I ran a quick scan of Malwarebytes in safe mode, it detected a backdoor trojan, which I removed, and rebooted. The radio was still audible, and svchost was still maxed out.

    I killed the process and downloaded Rkill and TDSSkiller. I ran Rkill in safe mode, it detected a zero access virus. I stayed in safe mode and ran TDSSkiller. It detected the zero access virus, and I clicked on Quarantine. It apparently quarantined nothing, because a normal reboot brought up the same symptoms.

    I didn't want to go through the complete scenario of solutions offered to the original poster, so I never attempted the elevated net stop WMPNetworkSvc.

    Should I be doing that, or something else?
      My Computer


  2. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #2

    boweasel

    Try this tool below

    Farbar Recovery Scan Tool


    64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

    Drag the FRST64.exe from the Downloads folder to your Desktop

    Right click on FRST64.exe and choose

    When the tool opens click Yes on the disclaimer window .

    Press Scan button.

    FRST will let you know when the scan is complete and has written the FRST.txt to file

       Note
    The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt


    Please upload both logs in your reply.(FRST.txt and Addition.txt)

    FRST.txt and Addition.txt will be on the Desktop

    Upload a File
    Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .
      My Computer


  3. Posts : 678
    Windows 7 home premium 64 bit
    Thread Starter
       #3

    For some reason I can no longer end the offending svchost process, so I'm now running in safe mode with networking. Here are the text files...

    Additionally, this particular phenomenon occurred at my friend's house as soon as he turned on the PC. Now that I brought it to my house, it only seems to happen when I attempt to connect to the internet. In other words, when I first set up his PC at my house I did not connect an Ethernet cable to his tower, and his Dell desktop was powered on for hours without a peep. As soon as I connected the cable and restarted the PC, the radio noises began. Curiously, there are no noises while running in safe mode with networking.
    svchost.exe streaming audio feeds and taking all available CPU Attached Files
      My Computer


  4. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #4

    Open Notepad . Inside Notepad paste the highlighted text inside notepad

    start
    Winlogon\Notify\AutorunsDisabled:
    HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
    HKLM-x32\...\Run: [] - [x]
    ZeroAccess:
    C:\Users\Vickie\AppData\Local\Google\Desktop\Install\{3ee2cae2-7844-dff1-ce2e-d0c62a7e658e}
    C:\Users\Vickie\GoToAssistDownloadHelper.exe
    end


    Click on File ====> Save As

    File Name : Fixlist.txt

    Save as type : All Files

    Location : Desktop

    Click on the [Save] button .

    Open FRST tool again from the Desktop and click on the [Fix] button . Once complete it will create a new log called Fixlog.txt . Upload the new log created in your reply . It should be on the desktop .

    AdwCleaner

    Click here AdwCleaner

    Click on Download Now button

    Save to the Desktop

    Right-click on AdwCleaner.exe and choose

    Click on Clean and confirm the prompt.


    Upload the log : The log file is at C:\AdwCleaner[n].txt

    Junkware Removal Toolkit

    Click here Junkware Removal Tool to download

    Drag the JRT.exe from the Downloads folder to your Desktop

    Right click JRT.exe and choose

    Once done upload the JRT.txt file
      My Computer


  5. Posts : 678
    Windows 7 home premium 64 bit
    Thread Starter
       #5

    Here's the Fixlog..
    svchost.exe streaming audio feeds and taking all available CPU Attached Files
      My Computer


  6. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #6

    Run the two programs AdwCleaner and Junkware Removal ToolKit .
      My Computer


  7. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #7

    Log into the PC in normal mode and again run TDSSKILLER again

    Do every step

    TDSSKILLER

    download link TDSSKiller

    Save to the Desktop

    Right-click the program and select


    When the TDSSKiller console opens, click on: Change Parameters
    Under Additional Options, place a check in the box next to: Detect TDLFS File System

    Click: OK


    Press: Start Scan


    If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
    If malicious objects are found, they show in the Scan results.
    Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
    (Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


    When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


    Logs have a name like:
    C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


    Please post the TDSSKiller log in your reply.
      My Computer


  8. Posts : 678
    Windows 7 home premium 64 bit
    Thread Starter
       #8

    VistaKing said:
    Right-click on AdwCleaner.exe and choose

    Click on Clean and confirm the prompt.
    The Clean option is grayed out. I can Scan, however. And maybe Clean after the scan?
      My Computer


  9. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #9

    Click Scan then upload the log
      My Computer


  10. Posts : 6,830
    Windows 7 Ultimate 32-Bit & Windows 7 Ultimate 64-Bit
       #10

    Log is in C:\AdwCleaner

    Log title : AdwCleaner[R0]
      My Computer


 
Page 1 of 15 12311 ... LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 08:52.
Find Us