Ask Question Forum:
Model Library:2025-02-08:A.I. model is online auto reply
C
O
M
P
U
T
E
R
2
8
Show
#
ASK
RECENT
←
- Underline
- Bold
- Italic
- Indent
- Step
- Bullet
- Quote
- Cut
- Copy
- Paste
- Table
- Spelling
- Find & Replace
- Undo
- Redo
- Link
- Attach
- Clear
- Code
Below area will not be traslated by Google,you can input code or other languages
Hint:If find spelling error, You need to correct it,1 by 1 or ignore it (code area won't be checked).
X-position of the mouse cursor
Y-position of the mouse cursor
Y-position of the mouse cursor
Testcursor
caretPos
Attachment:===
Asked by c7c4c7
at 2024-07-01 23:30:59
ModifyPoint:0 Replies:9 POST_ID:828928USER_ID:11828
Topic:
Windows Server 2008;;
The server has all updates applied. The machine started hanging up and when we looked the machine was running at 100% CPU occupancy. Eventually found that there were numerous svchosts being kicked off 40-50 of them
Running Process explorer the svchosts are all running syswow64.
Opened up the location of the program using task manager and ran a scan against syswow64, but it does not appear to be infected.
I also generated a .dmp file from the task manager of the svchost causing the problem but do not know how to work with this type of .dmp file I am only familiar with the ones created by a blue screen.
I did find a couple of files in the default users startup folder that were identified as viruses from doing a scan of the machine. They were qiutzi.exe suaze.exe, they were cleaned up but problem persists
I searched online for references to the above two files but did not find anything that would help.
The svchost's get generated after the machine is up and running for about 30 minutes, I don't see anything getting kicked off and am running out of ideas.
Any ideas?
Thanks
Running Process explorer the svchosts are all running syswow64.
Opened up the location of the program using task manager and ran a scan against syswow64, but it does not appear to be infected.
I also generated a .dmp file from the task manager of the svchost causing the problem but do not know how to work with this type of .dmp file I am only familiar with the ones created by a blue screen.
I did find a couple of files in the default users startup folder that were identified as viruses from doing a scan of the machine. They were qiutzi.exe suaze.exe, they were cleaned up but problem persists
I searched online for references to the above two files but did not find anything that would help.
The svchost's get generated after the machine is up and running for about 30 minutes, I don't see anything getting kicked off and am running out of ideas.
Any ideas?
Thanks
Author: c7c4c7 replied at 2024-07-08 02:16:40
There was no solution
Accepted Solution
Author: c7c4c7 replied at 2024-07-03 17:00:59
A miracle! the problem disappeared all by itself.
Not sure I like that solution but I will have to wait and see what happens
Not sure I like that solution but I will have to wait and see what happens
Author: c7c4c7 replied at 2024-07-02 13:31:37
Sorry misspoke on that last post, ignore it
Author: c7c4c7 replied at 2024-07-02 13:24:02
Looking at another server, syswow64.exe doesn't exist. SysWow64 is a folder on that machine, anybody got any feedback on that?
Expert: duncanb7 replied at 2024-07-02 07:47:49
You can try it in any way, be reminded your system could be recovered by
Window Recovery Software on your PC windows system that once you
have issue during your try, you can get back the system status to date that
is before any try or test
Duncan
Window Recovery Software on your PC windows system that once you
have issue during your try, you can get back the system status to date that
is before any try or test
Duncan
Author: c7c4c7 replied at 2024-07-02 07:36:29
It looks like syswow64 is used to enable 32 bit apps run on a 64 bit machine, is that true?
Can I remove/rename temporarily syswow64 and see what fails? There is very little running on this machine. SQL SERVER, Paperclip and that's it.
It looks like when the processes start generating they occurr about 1 every 30 seconds.
How do I see what is generating these processes.
Can I remove/rename temporarily syswow64 and see what fails? There is very little running on this machine. SQL SERVER, Paperclip and that's it.
It looks like when the processes start generating they occurr about 1 every 30 seconds.
How do I see what is generating these processes.
Expert: duncanb7 replied at 2024-07-02 07:32:02
Just copy and paste issue. This is right one
http://www.neuber.com/taskmanager/process/svchost.exe.html
http://www.neuber.com/taskmanager/process/svchost.exe.html
Author: c7c4c7 replied at 2024-07-02 07:26:49
Duncan, received URL not found from your link
Expert: duncanb7 replied at 2024-07-02 01:22:58
If the svchosts.exe cause high CPU usage, it may be caused by the automatic
window update from which it may create some hidden malware on your computer
that might change your window registry key.
Please use the following link to check the issue with free svchosts analyzer
http://www.neuber.com/taskmanager/proces...
Be reminded. The svchosts.exe is located at c:WinodwsSystem32 and delete all
other svchosts.exe file at other path. You can search those problem svchosts files
at Window Explore
Duncan
window update from which it may create some hidden malware on your computer
that might change your window registry key.
Please use the following link to check the issue with free svchosts analyzer
http://www.neuber.com/taskmanager/proces...
Be reminded. The svchosts.exe is located at c:WinodwsSystem32 and delete all
other svchosts.exe file at other path. You can search those problem svchosts files
at Window Explore
Duncan
