[DrTony]

Good day to all.

I have a problem with my computer. It is located in a cybercafe and is the main work computer. I have the hard disk backed up in a Norton Ghost image, and this problem makes me restore the image every 1-2 weeks, wich is very annoying. Here it is:

The CPU usage, every 1-2 weeks after I restore the image (A clean install with all that is requiered to work the cybercafe, more on this later) goes over 100% wich makes it almost imposible to work with. When I open the process tab in the task manager, all processes are about right, I got 5 or 6 svchost active, one of them over 90%. It is single handedly rendering the computer useless. I have Spybot S&D, Lavasoft Ad-Aware, Spyware blaster, Microsoft anti-spyware beta1 and Norton antivirus update and running, and repeated analysis with them show nothing.

The clean install contains:Windows XP SP1, Office 2003, Nero burning Rom, Software to control the cybercafe, Two shared printers. There are 20 computer in the cybercafe, all going through ICS (Internet Conection Sharing) in this computer to the WAN.

Here is the config of the pc:
Pentium 4 1.8 Ghz
Motherboard intel chipset 845
1 GB ram
2 40Gb hard disks
DSL internet conection.

This computer is used to print, burn CD´s and scan documents for the cybercafe, plus it surfs the web in working hours

There is one drastical solution to this problem. If I kill the svchost process with over 90% cpu usage, the computer goes back to normal, but all the computers in the cybercafé los the internet conection, until I reboot the main computer.

Can you help me with this?

[Advertisements]

I can't tell you what is specifically wrong but I have an idea.

First, having 5 or 6 svchost.exe's running is not uncommon, and in fact I have 5 running right now. Secondly, one of svchost.exe's main functions includes being the main program for ICS. No svchost, no ICS.

The thing you want to do is check for spyware, adware, and viruses. For the adware and spyware, use "Spybot Search and Distroy" fully updated, this seems to find the most of them. I had a simular problem and this cleared it up.

[cpc197c]

I can't tell you what is specifically wrong but I have an idea.

First, having 5 or 6 svchost.exe's running is not uncommon, and in fact I have 5 running right now. Secondly, one of svchost.exe's main functions includes being the main program for ICS. No svchost, no ICS.

The thing you want to do is check for spyware, adware, and viruses. For the adware and spyware, use "Spybot Search and Distroy" fully updated, this seems to find the most of them. I had a simular problem and this cleared it up.

[cpc197c]

You said you have run the checks and found nothing....I wonder what the problem is....


Try downloading HiJack this! and see what results come out of it. Post the results in the HiJack this form in a new thread

Edited by cpc197c, 11 May 2005 - 12:06 PM.

[DrTony]

Thanks for the answers!

Unfortunaetly, I tried that, without solution. I also tried Lavasoft ad-aware and Microsoft anti-spyware beta 1. I also scanned it with Ccleaner, Norton antivirus and I have spyware blaster to block unwanted activeX controls. Windows SP1 is fully updated.

I even heard of some trojan horse that used svchost as a false cover, so I went to Symantec´s page, and downloaded a tool to remove the trojan... but the tool said it did not find the trojan in my computer. I dont remember the name of the trojan though

Im begining to think it has something to do with ICS indeed, but, even if it does, how do I fix it?.

We know of a similar cybercafe, with 16 computers, same system of work and it does not have the same problem...

Edited by DrTony, 11 May 2005 - 05:46 PM.