Svchost running 99% cpu

[rwfhere]

One on my pc's (XP home) has svchost running 99% of cpu usage when i boot it up, it also has no internet conectivity anymore. I've tried a system restore and i still have the same problem. I've taken the hd out and put it into an external housing on my other pc and ran a virus scan and got nothing there, I tried what this site said

http://www.pchell.com/virus/welchia.shtml

and still no change. Now i've put the hd back and i get a message saying non-system disk or disk error replace and strike any key when ready.
Am i having to reinstall the o/s or is there something else i can do to fix the problem?

 

[JFBouchard]

Hi, download LSPfix

http://www.cexx.org/lspfix.htm

from another computer, copy it to a floppy and run it on your computer. This should repair your network connectivity.

Hope this helps. Please let me know if this resolve your issue

Jeff

 

[rwfhere]

Thanks for the very quick reply, i've just downloaded the ispfix file and going to atempt it now. As for the non-system disk error i've fixed that, when i pluged the hd back i noticed the floppy disc wasn't pluged in so did so, now i've just looked and someone left a disk inserted!...such a simple check to do and it didn't even cross my mind!!!.

 

[bcastner]

Uhmm Jeff,

I've taken the hd out and put it into an external housing on my other pc and ran a virus scan and got nothing there, I tried what this site said

http://www.pchell.com/virus/welchia.shtml

and still no change. Now i've put the hd back and i get a message saying non-system disk or disk error replace and strike any key when ready.
Am i having to reinstall the o/s or is there something else i can do to fix the problem?

1. Use Recovery console to repair the boot issues, I hope:

http://support.microsoft.com/defaul...port/kb/articles/q307/6/54.asp&NoWebContent=1

In recovery console, type:

fixmbr c:
fixboot c:
exit.

Now remove from your floppy drive, your CD drive, etc any other media and try a cold boot.

2. If you are using Service Pack 2 with your version of XP, do not use LSPFIX and do not use WinsockFix. This is discussed in faq779-4625

For Service Pack 2 installs:
Start, Run, cmd
netsh winsock repair

(wait for the prompt that a reboot is required. reboot)

For all other service pack levels of Windows, see faq779-4625

 

[linney]

How does this machine run in Safe Mode?

A Description of Svchost.exe (Q314056)

http://support.microsoft.com/default.aspx?scid=kb;en-us;314056&FR=1&PA=1&SD=HSCH

You may be able to use the above article to further breakdown the svchost into the component (possibly a Service) causing the trouble.

See if you have any services that are flagging as "Starting" but not actually running, or that are set on Automatic but have failed to start.

If you are using a Firewall like ZoneAlarm, you need to allow svchost.exe access to the Internet, but don't allow it to act as a Server.

anti virus, and spyware software cannot update
thread779-874935

Removing adware & spyware
faq608-4650

 

[rwfhere]

Ah, i just ran LSPFIX and i now have a connection, it removed a program/malware or whatever it is called NEWDOT. Although i now have a connection i got this popup message:

Error loading c:\progra~1\NEWDOT~1\NEWDOT~2.DLL
The specified module could not be found

Although i ran LSPFIX should i run netsh winsock repair anyway or has the damage been done so to speak?

 

[bcastner]

No, run through the steps in faq608-4650.

A shortcut: The Microsoft antispyware beta will kill NEWDOT.NET, as should AdAware and/or Spybot. See the FAQ and follow the steps, as there are likely other surprises.

As to any damage done if using SP2 and running LSPFIX, it does not hurt, but the entries involved are different under SP2. If using SP2, after the cleanup, do the netsh winsock repair to get a clean winsock stack of the proper kind for SP2.

You are doing fine, just keep going, as I suspect there is additional malware involved. faq608-4650 steps #2-#4 should set you straight.