Packets Dropped, And Too Many Scvhost

hi, its possibly to have many instances of svchost running at the same time. i think thats what you meant, if you did mean scvhost.exe then you have malware running. its not normal for one to tie up system resources though. if it was scvhost then you should post a hjt log in the malware removal forum. those ping/tracert checks can be misleading as its possible for routers due to traffic load to prioritize packets along the way. in any case all this is out of the end users hands as is how you get from point a to b. to rule out a DNS change since last visit you can try this: open a cmd prompt and type in ipconfig /flushdns there is a space after ipconfig. shelf life

When I start up, I have two scvhost running on SYSTEM. It often takes up 100% of my CPU for anywhere from 5 minutes to 20 minutes, and I can't do anything till it's done.

And after the 5-20 minutes?
Any problem with the machine's function.
Any problem with browsing to sites "other than" the one you identify as problematic?
_____________

As you may know, svchost.exe is a MS process that handles processes executed from DLLs.

Maybe you made a "typo" above when you typed: scvhost <– notice that the "cv" portion of the file name is "reversed" from how it should read. (should read svchost.exe

If, however, you have two instances of "scvhost" running active at boot for 5-20 minutes, you have some serious malware going on and should post a HJT Log over in the Malware Removal Forum.
__________

Even if you didn't make a "typo" your svchost should not normally be consuming that much of your system resources and holding them for that long a time.
Such a situation would again suggest possible Malware loading at boot, sending and receiving it's nefarious information and crippling your machine for that time period.

If you decide to keep working on this problem here in OCP Forum, please run the Full Tests at http://www.pcpitstop.com and post the TechExpress link back here into this thread so we can get an overview of what may be hogging/clogging your machines functioning.

Best Regards

Thanks to both of you!

TechExpress link for your current results:
http://www.pcpitstop.com/techexpress.asp?id=V13LFW1V6GWSVTDW

I have done the flush dns several times, to no avail.

the "scvhost" was indeed a typo, it should be 'svchost'.

After the time (it varies) it uses to get whatever loaded, it browses acceptably fast to anywhere but that one site. Or at least that is the only site I have noticed having problems with.

Machine looks good! Following the 2 Pit Test Recommendation would be a good idea. IE Browser Cache Size Adjust System Restore size ______________ Any chance your favorite BB may have gotten included in a SpywareBlaster update? Doesn't look like you use a hosts file. But you do have SpywareBlaster and Spybot S&D Do you use "Immunize" from Spybot? Maybe disable protection of SpywareBlaster and Spybot Immunize. See if you can connect. Important: Turn SpywareBlaster and Spybot Immunize back on after the above little experiment. Check your IE Restricted Zone to see if the BB is listed there? I'm wondering about Spybot - TeaTimer. but have no specific concerns It just monitors to prevent System changes. Maybe try turning off TeaTimer and try to access the BB site? <– long shot, and I feel silly even suggesting it.

In spybot, I turned off tea timer, turned off resident, unchecked the block bad. In spyware blaster, I disabled all protection. The website is not in my restricted sites list, but IS in my 'Trusted', as they only use session cookies. I tried it, and went there quickly, but I clicked on some different threads and clicked the reply, and it returned to not working after a couple minutes.

you can try clearing out IE cache: with IE open> Tools>click Internet Options> General tab. in the Temporary Internet Files section, click the Delete Files button. Click on Delete Cookies.

I do that 3 or 4 times a day. I click on my iIsystemWiper,and it clears all my cache.

You have (3) three separate versions of SunMicrosystems JAVA Runtime Environment.
The earlier two contain vulnerabilities that can continue to compromise your system, even though you have also updated to JAVA JRE 6 Java™ SE Runtime Environment 6 Update 1 on April 11th

Uninstall "all" versions of JAVE JRE via Control Panel - Add/Remove prior to installing the most recent update.
You will probably have to repeat the Uninstall via Add/Remove three separate times until all JAVA utilities have been removed.

Download the most current version of JRE, here:
http://java.sun.com/javase/downloads/index.jsp

Select the:Java Runtime Environment (JRE) 6u1

Deleting the old and installing the new Update, will also clear your JAVA Cache, which could contain corrupted ActiveX scripts.
You will have to again accept ActiveX scripts the first time you visit websites that require activeX
That's a good thing, since you will be getting a fresh, uncorrupted copy of their ActiveX.
________________

You have an application called AnalogX Script Defender.
I have not used it on my own machines, but it is designed to screen/block script that may be included in email and IM.
Not sure if that may also apply to interaction at your BB.

You may be able to "temporarily disable" AnalogX Script Defender via MSCONFIG - StartUp, and MSCONFIG - Services

That seems to make a big difference! I uninstalled script defender for now. It's one of those things that are just there. It has quarantined some gifs, though. I uninstalled all the Java runtimes, and downloaded the latest. The load time is now about a third what it was, and I can get in my BB and stay more than thirty seconds. I'll check it throughout the day, and let you know how it's doing this evening. I'm GMT-10, so evening is one of those open to interpretation. Thanks an awful lot! I'm hoping this does it.

Very Good Work, WatcherDuck! Yes, please do keep an eye on it for a few days. And…. Please do post back so that other Members can learn from your success. Best Regards Doug

My start-up is certainly fixed. No more waiting for System to load. I am so grateful for that, thanks! However, although the time I can stay at the BB has lengthened, I am still droping packets. I now have to assume it has something to do with my software, or settings. Do you have any more ideas? If it's relevant, when I do connect it's through six Local Ports. 1834 through 1839, all through Remote Port 80. The only other connections are gmail notifier and google homepage. Thanks again for your help.

Your comments about port access suggest that you are using some form of Desktop Remote Accessing (settings or software) when connecting to your favorite BB?

Here's a link for general information about using Remote Desktop Web Connection with Windows XP
http://www.microsoft.com/windowsxp/using/n…up_03may16.mspx

I have no familiarity with using those types of connection protocols and rarely use any Port Forwarding at all.
My internet use is rather "bland vanilla" in comparison to what you apparently use, so I won't be of much further help.

Now that you have some of the potential cause eliminated on your own machine, you may benefit from contacting the BB administrator again to verify optimal port settings with them.

Best Regards

I just use my browser, and that's all. Or at least that's all it's supposed to be. I noticed when I connect., it's always 6 Local Ports, but they're always different ports and in sequence. On Tuesday, I tried a system restore, but that didn't help, so Wednesday, I put in the XP disk, and re-upgraded, in case it was missing dlls or something.

Download and install "Starters" from this location:
http://www.snapfiles.com/get/starter.html

Run Starters by clicking its Desktop Icon.

While viewing the Startups(tab) display, Select - File - Save as Plain Text
Copy/Paste that saved report, back here into this thread.
__________

I'm also wondering if you have IE Security Settings locked down too tight. (re: accepting cookies, for instance)
GoTo:
Control Panel - Internet Options - Security(tab)
Select - Internet Zone
If you have "Custom" selected, browse through the list to see if you have made any selections that would frustrate your browsing situation.
Let us know if you have any questions about specific settings in the IE Security Settings

I know it would be "tedious" to manually "type out" the Settings you have (and I don't know of any automated tool that scans and creates a report) but if it comes down to it, it may be useful for you to type out the entire list of your custom settings.
___

In your next reply:
Post your Starters - Plain Text Report
Post any questions about IE Security Settings (or the whole list)

Note: In the course of your previous investigation, you have discussed "disabling" various of your Security Utilities, in hopes that you could remove whatever was blocking you from access to your favorite BB.
Disabling Security Utilities, may make your browsing more accessible, but can also leave you "wide open" to risks and threats from the internet.
Please review what you may already have disabled, and consider restoring those various utilities to their full protection.
Ask questions as needed.

Best Regards