Separate out a service from SVCHOST.exe (and Superfetch)

I have a runaway svchost.exe (service host) that is using 135 MB of memory.  I want to know what is using up the memory and whether I can separate it out into it's own service host, so I can watch it by itself.

Before Windows Vista and the later improvements in Task Manager, you would have to use a cmd window and tasklist.exe to find which services were being hosted by which service host.  Tasklist produces a list of all running processes:

Image Name               PID Session Name  Session#    Mem Usage
=================== ======== ============ ========= ============
System Idle Process        0 Services             0         24 K
System                     4 Services             0      1,612 K
smss.exe                 408 Services             0         88 K
csrss.exe                632 Services             0      1,944 K
csrss.exe                684 Console              1     69,172 K
wininit.exe              692 Services             0        112 K
winlogon.exe             756 Console              1      1,268 K
services.exe             796 Services             0      5,764 K
lsass.exe                804 Services             0      7,236 K
lsm.exe                  812 Services             0      1,624 K
svchost.exe              908 Services             0      4,416 K

Tasklist /svc returns all Services

Image Name              PID Services
===================== ===== ==========================================
System Idle Process       0 N/A
System                    4 N/A
smss.exe                408 N/A
csrss.exe               632 N/A
csrss.exe               684 N/A
wininit.exe             692 N/A
winlogon.exe            756 N/A
services.exe            796 N/A
lsass.exe               804 EFS, KeyIso, ProtectedStorage, SamSs
lsm.exe                 812 N/A
svchost.exe             908 DcomLaunch, PlugPlay, Power
svchost.exe             988 RpcEptMapper, RpcSs
svchost.exe             600 AudioSrv, Dhcp, eventlog,
                            HomeGroupProvider, lmhosts, wscsvc
svchost.exe             572 AudioEndpointBuilder, hidserv, Netman,
                            PcaSvc, SysMain, TrkWks, UxSms, Wlansvc,
                            wudfsvc
svchost.exe            1060 EventSystem, fdPHost, FontCache, netprofm,
                            nsi, SstpSvc, WdiServiceHost
svchost.exe            1120 AeLookupSvc, Appinfo, BITS, Browser,
                            EapHost, IKEEXT, iphlpsvc, LanmanServer,
                            ProfSvc, RasMan, Schedule, SENS,
                            ShellHWDetection, Themes, Winmgmt, wuauserv
svchost.exe            1196 gpsvc
TrustedInstaller.exe   1228 TrustedInstaller

PID 572 svchost.exe is running quite high.  If you find this svchost.exe in Task Manager, right click and choose Go To Service(s) then it will jump to the Services tab and highlight each of the services named on the right hand side.  [This is a great improvement over the poor TaskMan console in Windows XP (which could have easily been updated in a service release during the years that Windows XP was being sold.. Tho there were ways to replace TaskMan with improved versions manually.]

When I restart the service SysMain - Superfetch, the working memory used by this svchost process drops significantly.  So I want to run SysMain in its own process to watch it independently of the other processes.   To do this apparently I need to run:

sc config servicename type= own   there has to be a space after the type=.. so:

sc config SysMain type= own ... and running this gives me.. er.. failed.

[sc] OpenService failed 5

So if you get that, you don't have the elevated permission required to change the service.  Close the cmd window and run cmd as Administrator instead.  (Press the Start button and type 'cmd' then right click the cmd.exe when it appears, choose Run as Administrator from the context menu.)

Now it says:

[SC] ChangeServiceConfig SUCCESS

If you find the service in Regedit - HKLM\SYSTEM\CurrentControlSet\services\SysMain - you'll see that the Type REG_DWORD changes from 32 (0x100) to 16 (0x010) = shared and own respectively.

Restart the service.  Tasklist should now show the service has been placed in its own process - 22832.

Superfetch: this was introduced in Windows Vista.  It basically attempts to pre-empt which programs you use most frequently and then swap them in and out of the memory cache.  So what if you use the computer like me.. have 3 browser windows with a total of 25 tabs, two Visual Studio instances, Word, Regedit, Explorer, TaskMan, Excel all open at the same time..  I think Superfetch is running to its max and killing my system.  Now it's like working in treacle.  Could it be that what was designed as a 'performance enhancement' is actually unable to keep up under heavy usage?

Windows 7 has a program called Resource Monitor, which is an updated perfmon.exe  (Performance Monitor).  This is a useful program - you can select every instance of Chrome for example and see what all the windows are doing... I've got one process 12544 which is opening Cookies, my $LogFile.. my user data cache for Chrome.. and is connecting to the following:

lhr08s06-in-f9.1e100.net
sea15s02-in-f3.1e100.net
we-in-f189.1e100.net
collector.trendmd.com
lhr08s06-in-f14.1e100.net

[1e100 = 10 to the power of 100... which is a 'Googol'...]

I'm going to explore Chrome's own TaskMan to see what's running on that PID.. seems it is the main base browser instance and not any of the tabs.  Google keeping tabs on my usage...

I'm going to try living without Superfetch running for a bit... to see whether switching it off makes my laptop run any differently..

Blacklisted, Router Spam, Rootkits, Worms

A client has been infected by something nasty... email is not getting through to clients due to blacklisting...

1)  www.mxtoolbox.com  - Lookup the mail server MX record, check for blacklisting.  Find out the date that it happened and any reasons you can find.

2)  Find/fix the infected PC...  As I work remote, I set up a batch file that users can run... 

tasklist /svc > s:\%computername%-tasks.txt
netstat -nabvo > s:\%computername%-netstat.txt
;pause    [ remove commenting semi-colon if you want to]

This assumes there is an S: drive - replace with a network drive letter that you have access to - and save the file as something like 's:\commands.bat'.  Ask someone to run it on all computers.

Check each -netstat.txt file for numerous connections being made where there is a :25 after the Foreign Address (search the text file for ':25').

I've found one PC making such connections...

TCP    10.0.0.12:27163        208.123.68.19:25       SYN_SENT        700
  C:\WINDOWS\System32\mswsock.dll
  C:\WINDOWS\system32\WS2_32.dll
  -- unknown component(s) --
  C:\WINDOWS\system32\kernel32.dll
  [services.exe]

This suggests a dodgy mswsock.dll or software running that is spamming out.  I have checked the other PCs and none of them are infected.  So now to Remote Connect (RDP) into the PC and have a look.

No processes running ... rootkit? .. Ran MalwareBytes' Anti-Malware and found Adware.Starware ... Security Center warning if no Firewall or Antivirus was disabled... AVG looks like it got a random letter named dll file...  and I found Run settings ('rundll32 /dll, startup' in both Local Machine and Local User / Software/Microsoft/Windows/CurrentVersion/Run ... AVG reports the Hiloti... does that send out on smtp?  there's also another file reported as Trojan Horse Generic 17.BEDK.   Adobe monxga32.exe... not Adobe but in a folder called 'Startup' in the Adobe menu group in the Start Menu.

ThePhone.coop has still not responded with a Smart Host for relaying emails... which means their clients will not get their emails... Surely the service assistant didn't need to ask an engineer to call me back just to tell me the name of their Smart Host?

Anti-Malware found 109 issues.. but nothing substantial...  now running AVG's Rootkit Search...  That has not fixed it...  Computer rebooted and still infected.

I have connected to the router and added a new rule to block all SMTP Port 25 traffic from all LAN addresses except the server to any address on the internet.  That will stop the blacklisting organisations from blocking us... and will stop anyone else getting dodgy emails from us.

Now I can remote desktop back into the computer and have another good go at it ...

Strangely 'tasklist /svc' reveals that it is Process ID 708 that is sending smtp packets out.  ID 708 is Services.exe.  Tasklist reveals that Services.exe is a host for Eventlog and PlugPlay.

Sysinternals' Process Explorer with a filter of 'Path contains :smtp' also reveals ID 708.   But it also shows that the operation is TCP Disconnect and TCP Reconnect - which means the router block is working.   There's one inetinfo.exe in there sending smtp to localhost ... which throws the possibility of IISADMIN, SMTPSVC and W3SVC involvement.

Sysinternals' RootkitRevealer (RKR) has found quite a few results...

HKU\1-5-21-nnn..nnnn\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\... ...HRZR_EHACVQY:uggc://vzntrf.tbbtyr.pbz/ ... etc

Further investigation discounts this as suspicious...
1) {75048700-EF1F-11D0-9888-006097DEACF9} is the CLSID for ActiveDesktop - so all these entries are Operating System entries.
2) HRZR_EHACVQY:uggc://vzntrf.tbbtyr.pbz/ is ROT13 encoding for UEME_RUNPIDL:http://images.google.com/

Also see Didier Stevens UserAssist Tool for an easier decryption of these UserAssist entries.

Null containing registry entries found by RKR such as in the hklm\security hive SAC* SAI* and SCM* have the same date (maybe) as the computer was installed... something to do with password hiding perhaps...

HKLM\Software .. Microsoft SQL Server .. apparently this is logged by RKR because SQL often changes quickly whilst the registry is being read.. so comparing it can often show innocent discrepancies.

HKLM\System\ControlSet1\Services\eyviuy
HKLM\System\ControlSet2\Services\eyviuy

These have the same names as the driver file (.sys) I found in the system32\drivers folder...

AVG has popped up .. The Trojans, Hiloti.AL Hiloti.AM have infected two files in System Volume Information\_restore folder...

I have given in and taken it back to a previous system restore point .. early last week.  If it gets re-infected then I'll have to ask someone to go and run Recovery Console and delete the offending system driver file and registry entry without Windows running.