Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Windows Server 2003 Standard (Much to my distaste), I've applied all the security updates and now I'm stuck with a box that's constantly being hammered by svchost.

The process ID is always around the 700 mark and if I use tasklist /svc, I can see that RpcSs is causing it.

I have tried various things that have come up in google searches such as turning automatic software update services off, removal of antivirus software, removal of systray items, removal of remote screen services such as RDP, VNC, LogMeIn etc.

I'm still stuck with this RpcSs running at 90%, I'm completely at the end of my tether with this now but I don't really want to sit through a complete re-install just to see if it happens again.

share|improve this question
    
To clarify - are you saying the CPU hammering started after the updates were applied? –  Chris Feb 1 '11 at 20:41
    
Yep. Can't pinpoint which one though as I performed a few software updates one after the other. You know, download-install-restart, check for more updates, goto 0 –  Squeeb Feb 2 '11 at 8:53
add comment

2 Answers

up vote 2 down vote accepted

You might try using the Sysinternals tools Process Explorer and Process Monitor. For example, in Process Explorer - select the relevant svchost.exe instance, right click and choose properties and then go to the Threads tab. You may see a dll name in there that gives you a clue.

share|improve this answer
    
+1 Great tools And free! –  Dave M Feb 1 '11 at 21:33
    
Thanks, I'll give this a try :) –  Squeeb Feb 2 '11 at 8:53
add comment

I have seemn some malware use this process and we had to use a bootable disk with the Syamantec Endpoint Recovery Tool and current defs to remove. It was some kind of rootkit that slipped by the installed AV.

share|improve this answer
    
we tried this, but there was nothing to remove. It was clean. –  Squeeb Feb 1 '11 at 19:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.