weird program run at every startup and uses at least 9X% cpu usage 1

[cassiohui]

hi,

i got a weird program that automatically runs everytime i boot up the computer. it's called tcpsvcs.exe. i have to manually terminate it using Task Manager. It's very annoying, and i can't find this tcpsvcs.exe on my computer (at least not with window's search function). i ran norton av, adaware but nothing about this program is mentioned in either programs. what can i do?

thanks

p.s. i'm using win xp pro sp1

 

[Freestone]

It appears you may have added some unnecessary TCP/IP services:

http://www.liutilities.com/products/wintaskspro/processlibrary/tcpsvcs/

http://www.blackviper.com/WinXP/servicecfg.htm

(search for tcpsvcs.exe on this page)

 

[bcastner]

There is no earthly reason for you to be running this service.

Control Panel, Administrative Tools, Services, find "DHCP Server" and stop it. Set its startup to disabled.

My own guess is that this is a virus/trojan.
See:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.egghead.html

A description of the service:
DHCP Server
Service Name: DHCPServer

Executable Name: tcpsvcs.exe

Log On As: LocalSystem

Description: The DHCP Server service allocates IP addresses and allows the advanced configuration of network settings such as DNS servers, WINS servers to DHCP clients automatically.

DHCP uses a client-server model. The network administrator establishes one or more DHCP servers that maintain TCP/IP configuration information and provide it to clients. The server database includes the following:

Valid configuration parameters for all clients on the network.
Valid IP addresses maintained in a pool for assignment to clients, plus reserved addresses for manual assignment.
Duration of a lease offered by the server. The lease defines the length of time for which the assigned IP address can be used.
Dynamic Host Configuration Protocol (DHCP) is an IP standard designed to reduce the complexity of administering address configurations by using a server computer to centrally manage IP addresses and other related configuration details used on your network. The Windows Server family provides the DHCP service, which enables the server computer to perform as a DHCP server and configure DHCP-enabled client computers on your network as described in the current DHCP draft standard, RFC 2131.

DHCP includes the Multicast Address Dynamic Client Assignment Protocol (MADCAP) which is used to perform multicast address allocation. When registered clients are dynamically assigned IP addresses through MADCAP, they can participate efficiently in the data stream process, such as for real-time video or audio network transmissions.

With a DHCP server installed and configured on your network, DHCP-enabled clients can obtain their IP address and related configuration parameters dynamically each time they start and join your network. DHCP servers provide this configuration in the form of an address-lease offer to requesting clients. With a DHCP server installed and configured on your network, DHCP-enabled clients can obtain their IP address and related configuration parameters dynamically each time they start and join your network. DHCP servers provide this configuration in the form of an address-lease offer to requesting clients.

If the DHCP Server service is stopped or disabled off, DHCP clients will not automatically receive IP addresses or network settings. See also DHCP Client, Configure Your Server, Manage Your Server.

Available on: Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; Windows Server 2003, Datacenter Edition and Windows Server 2003, Web Edition.

Installed through: Configure Your Server, Manage Your Server, Add/Remove Windows Components

Startup type: Automatic

Service status: Started

This service depends on the following system components:

Event Log
Remote Procedure Call
Security Accounts Manager
COM+ Event System
TCP/IP Protocol Driver
IPSEC Driver
The following system components depend on this service: None

IP Port Numbers used:

TCP: 7, 9, 13, 17, 19, 135 (DHCP Manager) 515, 2535, 2856
UDP: 67, 68

 

[cassiohui]

wow...........that's a great website, the 2nd one
so......now i know what that is, so how can i delete/disable/uninstall it?
thank you very much

Computers are unreliable. Humans are worse.

 

[cassiohui]

OMG..........there is not "DHCP server" in service, only a "DHCP Client", but when i disable it, it stops all internet connections....@.@

thanks

Computers are unreliable. Humans are worse.

 

[Freestone]

Look in Control Panel, Add or Remove Programs, Add/Remove Windows Components, Networking Services, uncheck Simple TCP/IP Services. Also ensure that Other Network File and Print Services is unchecked.

Unless you explicitly installed these components, start suspecting a virus or trojan as Bill indicated in his post.

 

[cassiohui]

thanks freestone

p.s i just realized i posted this in a wrong board........should be in a software board =_="

Computers are unreliable. Humans are worse.

 

[jpger]

If you ever find apps running that bog your system down again, look for a program called EnditAll. Lot like Task Manager, but can effectively end any/all processes you deem unneccessary.

 

[cassiohui]

thanks jpger

Computers are unreliable. Humans are worse.