Help! svchost.exe is hogging my CPU. Any ideas?
in Software ·
I’m not entirely sure if this will solve your specific issue, but in most cases—and I mean most cases!—you are dealing with a Blaster worm.
You might be able to shake it off using this method: just head over to your search bar and type in one of these:
msblast.exe
penis32.exe
teekids.exe (these are three different variations of this particular virus) and try deleting them manually.
Now, if that doesn't work—which happens sometimes—you’ll have to take a slightly more difficult route, though it is certainly doable.
Again, any of those three viruses could be the culprit here, but it is most frequently msblast.exe.
First, pull up your Task Manager, hunt down the process named msblast, and once you’ve found it, hit "end process."
Next, navigate to windows/system32/ and locate msblast.exe; since you stopped the process, the virus shouldn't be able to run anymore.
Also, take a look in the windows/prefetech folder for anything with a similar name—for example, msblast.exe -o9FF84F2.pf or something similar—and if you find it, delete it too.
After that, go to Start, click on Run, and type in regedit
A little window should pop up for you shortly after.
Inside there, look for HKEY_LOCAL_MACHINE
Once you click that, move over to SOFTWARE—meaning HKEY_LOCAL_MACHINE\SOFTWARE
then proceed to Microsoft
then to Windows
and then finally to CurrentVersion
and lastly, the Run key
The final directory path should look exactly like this:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
When you click on that Run key, you should see several variables listed on the right-hand side.
Search specifically for the name "windows auto update."
That is actually what is triggering the virus and causing that annoying startup notification to pop up every single time!
Once you've located "windows auto update," go ahead and delete it.
You should also check your Startup folder—in my example, it's located here:
C:\ Users\ All Users\Start Menu
or C:\ Users\ All Users\Start Menu\Programs
Look for TFTP or something similar.
That is what's driving that error message you're seeing.
Make sure to delete that file as well.
If you happened to boot into Safe Mode, please reboot into normal mode first; otherwise, you might not be able to access the "windows auto update" entry to fix it. If you are already in normal mode, just ignore this part.
Next, head over to Windows Update
and run an update.
It really depends on how much time you have—I had a colleague who only had a few minutes left before his entire computer forced a restart!
If you don't have enough time to run a full update, try searching for the specific Windows update under
KB823980
Keep in mind, this same virus could still be lurking in your system.
1. Empty your Recycle Bin.
2. It could also be hiding in System Restore.
With System Restore, you'll need to disable it first, and then turn it back on again.
You can find Sys.Rest under Start Menu under Programs\Accessories\System Tools.
Once you find it, click on the System Restore settings link.
Check all the boxes that tell the system to "turn off system restore on all drives."
Then, simply hit OK.
After that is done, repeat the exact same process to re-enable it.
Once you have finished all of this, please do yourself a favor and pick up a really solid antivirus program. Seriously! :-)
Personally, I use Norton.🙂
Anyway, I hope that helps you out a bit!
You might be able to shake it off using this method: just head over to your search bar and type in one of these:
msblast.exe
penis32.exe
teekids.exe (these are three different variations of this particular virus) and try deleting them manually.
Now, if that doesn't work—which happens sometimes—you’ll have to take a slightly more difficult route, though it is certainly doable.
Again, any of those three viruses could be the culprit here, but it is most frequently msblast.exe.
First, pull up your Task Manager, hunt down the process named msblast, and once you’ve found it, hit "end process."
Next, navigate to windows/system32/ and locate msblast.exe; since you stopped the process, the virus shouldn't be able to run anymore.
Also, take a look in the windows/prefetech folder for anything with a similar name—for example, msblast.exe -o9FF84F2.pf or something similar—and if you find it, delete it too.
After that, go to Start, click on Run, and type in regedit
A little window should pop up for you shortly after.
Inside there, look for HKEY_LOCAL_MACHINE
Once you click that, move over to SOFTWARE—meaning HKEY_LOCAL_MACHINE\SOFTWARE
then proceed to Microsoft
then to Windows
and then finally to CurrentVersion
and lastly, the Run key
The final directory path should look exactly like this:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
When you click on that Run key, you should see several variables listed on the right-hand side.
Search specifically for the name "windows auto update."
That is actually what is triggering the virus and causing that annoying startup notification to pop up every single time!
Once you've located "windows auto update," go ahead and delete it.
You should also check your Startup folder—in my example, it's located here:
C:\ Users\ All Users\Start Menu
or C:\ Users\ All Users\Start Menu\Programs
Look for TFTP or something similar.
That is what's driving that error message you're seeing.
Make sure to delete that file as well.
If you happened to boot into Safe Mode, please reboot into normal mode first; otherwise, you might not be able to access the "windows auto update" entry to fix it. If you are already in normal mode, just ignore this part.
Next, head over to Windows Update
and run an update.
It really depends on how much time you have—I had a colleague who only had a few minutes left before his entire computer forced a restart!
If you don't have enough time to run a full update, try searching for the specific Windows update under
KB823980
Keep in mind, this same virus could still be lurking in your system.
1. Empty your Recycle Bin.
2. It could also be hiding in System Restore.
With System Restore, you'll need to disable it first, and then turn it back on again.
You can find Sys.Rest under Start Menu under Programs\Accessories\System Tools.
Once you find it, click on the System Restore settings link.
Check all the boxes that tell the system to "turn off system restore on all drives."
Then, simply hit OK.
After that is done, repeat the exact same process to re-enable it.
Once you have finished all of this, please do yourself a favor and pick up a really solid antivirus program. Seriously! :-)
Personally, I use Norton.🙂
Anyway, I hope that helps you out a bit!