Medinacarlos

Well Mr. Charlie, thanks for your time. I really appreciate your effort to want to help. I will search Google each service to see what may be causing. Thanks a lot.

I can attach a log from Process Explorer if you want.

These are the services runing from the Svchost.exe: AudioEndpointBuilder, CscService, HomeGroupListener, Netman, PcaSvc, Sysmain, TabletInputService, TrkWks, UmRdpService, uxsms, WPDBusEnum, wudfsvc.

AdwCleaner log: # AdwCleaner v3.005 - Reporte Creado 26/09/2013 en 13:40:07 # Actualizado 22/09/2013 por Xplode# Sistema Operativo : Windows 7 Professional Service Pack 1 (64 bits)# Nombre de usuario : Carlos Medina - MEDINACARLOS# Ejecutado desde : C:\Users\Carlos Medina\Downloads\AdwCleaner.exe# Opción : Limpiar ***** [ Servicios ] ***** ***** [ Archivos / Carpetas ] ***** ***** [ Accesos directos ] ***** ***** [ Registro ] ***** Clave Borrar : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2} ***** [ Navegadores ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Google Chrome v29.0.1547.76 [ Archivo : C:\Users\Carlos Medina\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [946 octets] - [26/09/2013 13:37:52]AdwCleaner[s0].txt - [862 octets] - [26/09/2013 13:40:07] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [921 octets] ########## Malwarebytes Anti-Malware log: Malwarebytes Anti-Malware (Trial) 1.75.0.1300www.malwarebytes.org Database version: v2013.09.26.06 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16686Carlos Medina :: MEDINACARLOS [administrator] Protection: Enabled 26/09/2013 01:43:46 p.m.mbam-log-2013-09-26 (13-43-46).txt Scan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 196414Time elapsed: 2 minute(s), 10 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 0(No malicious items detected) Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 0(No malicious items detected) (end) Svchost.exe still using 150.000 KB of memory.

I can't download any file using Chrome. I was able to download Adwcleaner using Internet Explorer.

Much better. ComboFix.txt

Hahahaha sorry MrC, my english is not very good. I put Combofix on my desktop and run it. A window about the installation of Combofix appeared but froze on "Output Folder: C: \ 32788R22FWJFW". Is normal or should I wait?

I disabled all programs against malicious software and antivirus and install ComboFix on the desktop. However, still extracted.

Nothing to clean. mbar-log-2013-09-26 (11-36-17).txt system-log.txt

Thanks for the help both of you. I turn on system restore as you said. Here's the log from RougeKiller: RogueKiller V8.6.12 _x64_ [sep 18 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.adlice.com/forum/Website : http://www.adlice.com/softwares/roguekiller/Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser : Carlos Medina [Admin rights]Mode : Scan -- Date : 09/26/2013 11:03:49| ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 3 ¤¤¤[HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Unidades de disco estándar) - ST1000DM003-1CH162 ATA Device +++++--- User ---[MBR] 18b880fea1ec143782ed42e36dc6093e[bSP] 0333ae070763e7e0a630be8d12814313 : Windows 7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MoUser = LL1 ... OK!User = LL2 ... OK! Finished : << RKreport[0]_S_09262013_110349.txt >>

Hi, I'm new here and I desperately need help. A few days ago I noticed that svchost.exe was using a lot of memory making my OS very slow. I decided to do a full scan of my computer with BitDefender Total Security and the results showed that there was no virus or malware on my hard drive. I decided to format to fix the problem and unfortunately, after installing the OS, svchost.exe was still consuming a lot of memory. I'm using Windows 7 Professional 64 bits. I downloaded Avira and did a full scan and shows no result. Svchost.exe still consume memory. Don't know it's bad thing that svchost.exe is using a lot of memory, but if anyone could help me I would appreciate. Services used by the highest memory consume svchost.exe are: AudioEndpointBuilder, CscService, HomeGroupListener, Netman, PcaSvc, Sysmain, TabletInputService, TrkWks, UmRdpService, uxsms, WPDBusEnum, wudfsvc. I enable and disable each service to see which was of them have the most memory consumed. Sysmain (Superfetch) is the service that consumes more memory. I researched a bit and found that it is normal that this service is consuming a lot memory. After disabling, svchost.exe process drop from 170,000 KB to 30,000 KB. If I leave him in that way, do you think that the memory rate is normal? I do not have system restore turned on and i never use it and i have some files in "C:/Systemvolumeinformation": WindowsImageBackup MountPointManagerRemoteDatabase Syscache.hve Syscache.hve.LOG1 Syscache.hve.LOG2 tracking I scanned the directory to see if I got a virus but did not get any results. I tried deleting them manually and nothing happened either. attach.txt dds.txt