SEARCH

The How-To Geek Forums Have Migrated to Discourse



Join the Discussion at discuss.howtogeek.com

How-To Geek Forums / Windows 7

winsvchost.exe

(18 posts)
  • Started 6 months ago by PackDrill
  • Latest reply from ispalten
  • Topic Viewed 1502 times

PackDrill
PackDrill
Posts: 159

winsvchost.exe "Critical System Service" is causing my GPU to run at Max load.
Yes, strange I guess, but let me explain.

So when I update my GTX 680 (I have 2)
WHILE it's updating my screen flashes as usually does during a graphics update but now I see "Critical System Service has stopped working" I googled that and got winsvchost.exe. Later I found it in my Tasklist and stopped it. INSTANTLY my GPU's 100% load went to 0-1%.

Well when I update my card I usually make sure to reconfig the SLI on the Nvidia control panel then reset my PC. AS SOON as it's back on my desktop my software that comes with my Asus branded GPU "GPU Tweak" reads that my graphics card is now again at 100% load.

Perhaps this is falsely displayed and it's not really at 100% you may add?
No it's true, because once I run a high-end or even a small game my Frames are RIDICULOUSLY low.

Ask any needed specs or info I can add to help with this issue. I can't put a finger on the day I noticed this starting, but I will try system restore and see if I can get somewhere.

--Would removing and reinserting my GPU's perhaps undo something and get it to work again? or try 1 on a 16x slot and another on a 8x slot instead?
Can't be the hardware if stopping "winsvchost.exe " fixes the issue.

Posted 6 months ago #
Top
 
ronniesonora
Posts: 919

First, I would run a virus and malware scan. Check here http://www.file.net/process/winsvchost.exe.html

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

When I have a hunch it's pretty accurate and I'm going to say I don't have a virus, I know certain viruses disguise themselves as winsvchost.exe but honestly last time I got a virus was over 5 years ago. Still running a scan JUST to move on this thread.
I'm considering reformatting my SSD but I hate to have to reinstall everything again, unless I'm switching to windows 8 then I'd do it :p
(then again I'm not so quite sure I'm ready for W8 yet.)

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

This "windows file" isn't even in the correct folder. I deleted it all, and restarted and it's still there.
It recreates itself.

Posted 6 months ago #
Top
 
ispalten
ispalten
Posts: 6259

This picture you posted is very ODD... it is your USERID folder. You also are NOT showing ALL the files, hidden and system files are not showing (that is a folder property to turn them on).

I have NO SUCH file either?

Take a look at this SEARCH, http://duckduckgo.com/?q=winsvchost.exe, almost ALL call this a VIRUS... and since you said it came back, then in your STARTUP in one of the many places it could be is the payload module for the virus. It starts and sees if the file exist, doesn't, creates it (see the TIMESTAMP on the files, TODAY), and runs it.

RUN a virus scan please. Do NOT assume you do not have one!

Irv S.

Posted 6 months ago #
Top
 
Xhi
Xhi
Posts: 6298

Also run Malwarebytes and Superantispyware. Not all malware is a virus.

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

It has to be a malware or virus, Irv, I know, I've NEVER seen that folder or file, especially there that's my point, WHY is it there?
Xhi, I'm running Malwarebytes now.

Posted 6 months ago #
Top
 
ispalten
ispalten
Posts: 6259

I didn't write the virus, so I have no clue, other than it shouldn't be there. If I were to write a virus I'd hide it somewhere where no one would expect, name it the same as legit windows filenames, or overwrite the real windows file, BUT later version like W7 will stop you from doing that in most cases, soooo, that is why it might be where it is.

Be careful of some of those links on the search page I posted, some are there to SELL you some sort of program to get rid of it, and it might NOT even to it.

Still, I'd use MSCONFIG and look on the STARTUP tab for a program that is 'odd'. Many of these use a bunch of letters and numbers stuffed into a TEMP directory. Booting into SAFE MODE might also allow you to run without the virus and is a good test. Then start unchecking the 'odd' MSCONFIG programs you do not recognize, eventually with trial and error you'll discover the culprit if it gets started the 'normal' process way.

There are more complicated ways to find it too, like Process Explore and filtering... need some skill possibly to do that, virus checkers should get it and it is easier that way.

Irv S.

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

This is what I get for being lazy and not buying an antivirus ;_;

Posted 6 months ago #
Top
 
ronniesonora
Posts: 919

Tried to tell you 4 days ago!

Posted 6 months ago #
Top
 
Xhi
Xhi
Posts: 6298

Many good Antivirus and antispyware programs are free. Never a need to buy one.

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

Ronniesonora hush! :p
So NO ONE here even HAS this file on your system?
Can you guys search for it?
Regardless of having or not, it's not even in the right place. :'[ Might as well just upgrade to W8 for 2 reasons, upgrade and clean out this SSD.

Posted 6 months ago #
Top
 
warlock
warlock
Posts: 4100

http://www.internetslang.com/_.....nition.asp Play nice PackDrill.

Posted 6 months ago #
Top
 
PackDrill
PackDrill
Posts: 159

LOL!

Posted 6 months ago #
Top
 
ispalten
ispalten
Posts: 6259

There is no such thing as the right place, only specific file locations. Many times you will find like named files in different places.

In your case you have 'system' like files in a Windows folder in YOUR UserID folder. A definite sign that it might be suspect.

You image you posted it WAY TOO SMALL to read, at least for my eyes, but not all reports are always problem files, you have to possibly research them.

"So NO ONE here even HAS this file on your system?", I don't but that doesn't make it 'bad'. It is there for a reason, and one could be a virus, Trojan, Rootkit, or a legitimate file for you specific h/w. Without an identical h/w setup you have and identical apps you can't be sure.

Irv S.

Posted 6 months ago #
Top
 



Topic Closed

This topic has been closed to new replies. Please create a new topic instead.


Create New Topic Return to Forum