SVC

[cyanide911]

Low Download speeds, possible svchost virus

Alright, so I need you guys' help.
I've been getting very low speeds in my downloads since a few days. Around 1/4 of what I should be getting.
But the thing is, that my torrents are downloading fine, at the usual high speeds they get.
EDIT: Checked again, torrents are slow too, now
It's just the HTTP downloads which are suffering, specifically from filesharing websites like RS or Hotfile. Streaming videos is a PAIN.

I checked using ProcessExplorer, svchost.exe is continuously recieving and sending some data to and from my computer. I have no update services or such running in the background so I don't know why this process is doing what it is.

Any possible way I can diagnose this problem further? Probably there is some virus. Maybe my ISP have throttled/done something to the HTTP port.

I've done a scan using Microsoft Security Essentials, nothing found.

I searched a bit and on this fourm, found this: http://www.sevenforums.com/performance-maintenance/101726-svchost-exe-virus.html

He had a similar problem, and he solved it by running Hitman Pro. I tried it, it found a few things, cleaned them, but now there are still the 2 svchost.exe processes downloading stuff.

 

[SledgeDG]

svchost is only the host for quite a bunch of services
you could try to check the properties of those two as to what are they doing

Double click them in process explorer and sift through the properties
Good luck
-DG

 

[Borg 386]

If you want to investigate your connects, you can use this free tool to see where these connections are going to:

TCPView for Windows

TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint.

TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

When you start TCPView it will enumerate all active TCP and UDP endpoints, resolving all IP addresses to their domain name versions. You can use a toolbar button or menu item to toggle the display of resolved names. On Windows XP systems, TCPView shows the name of the process that owns each endpoint.

By default, TCPView updates every second, but you can use the Options|Refresh Rate menu item to change the rate. Endpoints that change state from one update to the next are highlighted in yellow; those that are deleted are shown in red, and new endpoints are shown in green.

You can close established TCP/IP connections (those labeled with a state of ESTABLISHED) by selecting File|Close Connections, or by right-clicking on a connection and choosing Close Connections from the resulting context menu.