SVCHOST.EXE Using All RAM + Abnormally High CPU Usage Part - 2 Resolution

Hi Friends!

This posts is in continuation of my earlier post on svchost.exe [thanks Shree for the query!]

As promised in that post, Let us resolve it now:

Go to Start | Settings | Control Panel and double click Automatic Updates or Windows Update.

Checkmark/Select the bottom option to disable automatic updates.

Click Apply/OK and then reboot.

Check if svchost still consume 100% CPU cycles? If no, we are done for the day! :)

If it does, do the following.

Go to Start, Run, copy/paste this command and click OK: services.msc

In the list of Services, can you see Background Intelligent Transfer Service ?

Here's a pic of what it looks like:

If it's not listed, please proceed as follows to register the BITS service.

Open the Windows Search tool, copy/paste the following and then click Search: qmgr.dll

Search should show that file in the following locations:

C:\WINDOWS\system32

C:\WINDOWS\ServicePackFiles\i386

C:\WINDOWS\system32\bits

It may only be present in C:\WINDOWS\system32, but provided you can see it, do the following to register the service.

Go to Start, Run and copy/paste: regsvr32 qmgr.dll and click OK

Do the same with this file: regsvr32 qmgrprxy.dll

Reboot the system and then copy/paste this command into the Run field:

%windir%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %windir%\inf\qmgr.inf

If you're prompted to insert the Windows installation CD, ignore that and in the dialog box at the bottom, change the path to C:\WINDOWS\ServicePackFiles\i386

If you could only see qmgr.dll in C:\WINDOWS\system32  change the path to that instead.

Restart the PC again and then go to Services and you should be able to see BITS in the list.

Double click it and then on the General tab, click the Start button to try and start the service manually. This is just a test to ensure that it's working correctly.

If you get Error 2: cannot find the file specified, go to Start, then Run again and copy/paste the following command and then click OK:

Reg add HKLM\SYSTEM\CurrentControlSet\Services\BITS\Parameters /v ServiceDll /t REG_EXPAND_SZ /d %windir%\System32\qmgr.dll

Reboot again and then try once more to start BITS. It should work properly now, but in the unlikely event that it fails again, run the following command and then hit Enter:

Reg add HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToBackup

Reboot once more and then do the following.

Go to this link and install the  IE8 cumulative December update:

http://www.microsoft.com/en-gb/download/details.aspx?id=41404 

If you use IE7, use this link instead:

http://www.microsoft.com/en-gb/download/details.aspx?id=41442

If you use IE11, use this link instead:

http://www.microsoft.com/en-us/download/details.aspx?id=42463

Finally, go to the Windows Update site and you should be able to download normally.

[Reference: Microsoft]

SVCHOST.EXE Using All RAM + Abnormally High CPU Usage Part -1 Basics

Hi Friends!

Apologies for the delay in the posts! [This is also my 1st post in Segoe UI font, looking for a feedback on this readers! :) ]

This post is in response to a query by Shree Nidhi

Let us try to understand its basics in this post:

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. 

Meaning?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.

The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.

If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box

References: howtogeek

Feel free to add more on this in the comments section below.

I will write for its possible resolution in the next post.

Regards,
Vipul

Connect To Remote Computer Using Remote Desktop

Hi Friends,

This article is in response to query by Sreekanth K.

Here we will learn how to connect to your machine from any remote location(say your friends location). So lets get started

I will use the abbreviations
1. RM: denotes the Remote Machine to which to want access
2. UM: denotes your currently User Machine i.e. the machine which will be used to access RM

Follow the steps in the mentioned order:

#1: Both the machines should be turned on [This is most important.. ;P ]

#2: Both the machines should be on network (even if it is internet!)

#3: a) Remote desktop must be enabled in RM
      b) user who wants to log in to the RM must have been granted access(or should be admin of RM) . Lets see, how this can be achieved with the screen shots:

[In the screen shot above, the radio buttons are disabled. But in your machine, they must be enabled, so select them]

RM should be able to communicate through your Firewall

Let's see how this can be achieved:

#1: Start -> Control Panel -> Search for Firewall -> Allow a program through Windows Firewall

Under Allowed programs and features, scroll down to Remote Desktop and ensure that the check boxes are selected

If you are using any other firewall, read the manual which came with it to replicate the same above mentioned steps.

Get the IP Address of your RM
Start-> cmd -> ipconfig

Note the IP address under your connection(Wireless or Local Area Connection). Above screen is for Local Area Connection. This IP will be used while turning on port forwarding.

Forward Port to RM

#1: On your web browser, type the internal IP address of your router(generally: 192.168.1.1, 192.168.0.1, 198.168.2.1). If none of this works, see the manual which came with the router to find out the internal IP address.

#2: Enter the credentials

#3: In the configuration screen, search for place to turn on port forwarding

#4: Forward TCP port 3389, the default port for Remote Desktop Connection, to RM. You can also forward other ports[ that enhances security, as using default value for anything is not advisable!]. Lets say the port forwarded is 3395
-->>So we have a mapping between the RM to the port on your router

Find your Routers' Public IP Address

You can search internet to 'find ip address' and you can find many results. Use any one to get your routers' IP address. Lets suppose it is 202.168.21.36

Use UM to Connect to RM

On your UM, use Start-> Run-> mstsc -> OK -> Give the public IP address found in previous step:[colon] the port number

 

You will be asked to provide the credentials as you do in your normal system!

Start Working....

Feel free to drop a comment.

Create A WiFi Hotspot To Connect To Internet In Android: Step By Step

Hi Friends,

All of us must have played Counter Strike over wireless network. So why can't we share our internet connection with our android device and use the data cards' internet. This led one of my college friends to call me ask me how it can be accomplished.

This blog is an answer to that question.

Before we get going, we require a 3rd party software to utilize Microsoft Virtual WiFi Miniport Adapter and create a WiFi connection to. So, please download this from here.

So let's get started:

#1: Click on the Network icon in your systems' toolbar. Then click on Open Network and Sharing Center

#2: Find Change adapter settings on the top-left side of the screen and click on it:

#3: Right click on the connection which you want to share. So, the steps are Right click -> Properties

                                                      

#4: Navigate to Sharing tab and follow the screen shot:

                             

The Home networking connection will be a drop down, from this, select Wireless Connection Network 2 (if you remember, at the beginning of this blog, I mentioned that we are going to use Microsoft Virtual WiFi Miniport Adapter, this, Wireless Connection Network 2, is the title/label of this connection)

#5: Now, its time to set the properties of Wireless Connection Network 2. So right click on it - > Properties and follow the screen shots:

                  [Same settings which were used to set up CS server! :) ]

#6: Now, we are ready to use the mHotspot tool which we have just downloaded and installed. Configure it as per your wish:

           

Click on Start Hotspot

#7: You could now see the hotspot name created by you once you click the Network icon :)

                             

So far so good, what's Next??

#8: Now, we use our android phone to connect to this newly created WiFi network. [I am using version 4.2.2 Jellybean for this blog, it is same for other android versions as well]

                                           

#9: Connect to your WiFi network -> provide password -> and start using internet!!

So there in all 9 steps from creating a WiFi network to browsing internet in your Android phone.

Feel free to ask your doubts or any errors received.

Rest Is Next...

Google Drive

Hi Friends,

Yesterday, one of my friend called me to ask how to use Google Drive. I was a bit stupefied with this request and also that this thing could have been easily found in Google, but Nevertheless... friends are friends...

I thought of writing an article over it, but then stumbled over this great article [saved my effort of writing it! :) ].

So, let me shout for this article on my blog.

Please use this link to understand how to use Google Drive. [ Copy + Paste this on your browser: http://www.wikihow.com/Use-Google-Drive]


Hope my reference helps.


Rest Is Next.

Identify Problems In Your PC In Easy Steps

Hi Friends,

First let me wish all my readers A Very Happy New Year To Them & Their Families.

So lets start this year with a bit of troubleshooting tips.

You might have encountered that as an avid reader of this blog and trying the stuff mentioned here, would have raised your techie skills among your friends, family members and neighbors.

They might call you from your home town, some remote location and start describing their problem, and you may just wonder, what the hack!!

So, to help you all such techie guys & gals, let me give you a short list of what you can advice to your friends(/whatever), so that you can have all the necessary details required to troubleshoot the problem.

#1: Tell your friend to press Windows logo -> psr

#2: Click on Start Record

And you are done, this PSR will keep track of every key press, will take screen shots and record every click on your friends system(or whatever you can think of!).

When all this is done, this whole data is stored into a single zipped MHTML file ready to be mailed to you. [Microsoft understands your concerns has really put in lot of efforts to make this tool effective.. :) ]

Hope you have an easy troubleshooting time and, of course, create impression among your friends..

Wish you again A Very Happy & Safe New Year!!

Rest Is Next.

What Is Distributed Denial Of Service(DDos) Attack

Hi Friends!

I heartily welcome you to our learning session. Today we develop an understanding of Distributed Denial Of Service (DDoS) attack (or informally zombie attack).

Definition:
It is a type of attack in which an online target is rendered unavailable (i.e. no one is able to access the site, i.e. not even legitimate users).

Explanation:
Lets begin by understanding "Denial of Service" first.

In India, we have general public telephone number to contact local police @100.

Assume, a bad guy(or group), everyday, goes to telephone booth and dials this number, say between, 6:00 am to 9:00 pm. In that case, if any legitimate user wants to call police for an emergency, he/she will always find the line engaged! This is what is known as "Denial of Service".

It is easy to track down from where the call is made and hence relatively easy to prevent this attack.

Now, let's understand the "Distributed" part:

It is common sense that the police station in a district won't have just a single inbound line to cater to calls. So lets us assume that there are 200 lines available. What if, 200(or more) bad guys start making calls to the police station from different pay phones. The phone lines are bound to get flooded thereby preventing 'needy' person to reach to Police.

Here, the bad guys make a coordinated attack on the Police contact lines from different locations. And hence, the scope of this attack is major.

Now, consider the same situation, replace 'Police telephone lines' with the web site's server you are trying to use[bad guys still remain the same!]

Targets(mostly):
1. Banks
2. News websites
3. Government websites

How it is done:
#1. To launch DDos, attackers needs millions of machines as sources of request. They develop malicious software, web sites, advertisements etc. to attract users to click them.

#2: Once clicked on these links, a malicious software is installed in to the users machine, without they being even aware of it.

#3: These machines are called botnets.
Now these botnets can be used by the hacker like his own system to send requests to the target.

Symptoms:
#1: Inability of authenticated users to open web sites or Unavailability of web site
#2: Unusually slowness of the site

Categories:
There are 2 flavors of the attack:
#1: Crash services
#2: Flood services

Google them for more understanding! :)

Precautions:
To prevent your machines to be one of botnets, know which web site are you visiting(online games, adult sites, songs/movies downloading sites mostly have these flashing links), don't run any executable on your machine unless you are sure of its 'origin'. Keep your anti-virus updated with internet security turned ON.

There are a lot of things you can do. Better will be to Google it!

Is there any map where I can get the look and feel of DDos Attack:
Well this question shows the inquisitiveness of my blog's readers. And, yes I won't disappoint you all. The answer to this question is: YES

You can find the link here (or alternatively, you can copy+paste "http://www.digitalattackmap.com" in your web browser.)

Hope you find this session interesting.

Feel free to leave a comment.

Cheers!

Access Shared Folders Over Network: NetBios Attack

Hi friends!

Greetings!!

Today we are going to learn one of the primitive types of hacking: NetBios Attack.

Disclaimer: The below attack is for tutorial purpose and the blogger does not endorse the technique. Please note that if any thing (relating to this post or any other) goes awry, the blogger cannot be held responsible. This tutorial is only to show a potential attack of this type exist and all parties using computers should use preventive measures to be safe from this type of attack. The misuse of the tutorial can result in criminal charges brought against the person in question and the blogger cannot be held responsible in case anyone is misusing below information to break the law. This blog was created for information purpose only.

[I took more time to write Disclaimer than the tutorial]

What exactly it is: Well, If you are running a home network, chances are that you may have some folders, files or printer sharing turned on. With this attack, a hacker can get access to your shared resources over the network.

So lets see how it is done:

N.B.: I am using my own system for demo purpose.

#1: Find out the IP address of systems over your network(I have a separate tutorial lined up for this). For now arp -a could be used:

#2: Once you have the IP handy, let check if there is any shared files available on the system:

N.B.: 'A' is caps in the above command

#3: If there is no <20> under Remote column, then that system is not vulnerable to this attack. If there is, as in case of my system(see screen shot above), we can move to #4.

#4: Now its time to find out shared files over this system:

#5: We see that 4 files are shared over the network. Let's see how it can be accessed:

If all goes well, it will generally take 10-15 seconds to get a positive response

#6: Now opening the accessed folder in Explorer should be piece of cake for you:

That's all folks. You can watch videos on your local system as if it is your own system and not somewhere in the network.

Rest is Next
Cheers!

Chkdsk Demystified : Part 1

Hi Friends!

Here I am(sounds like Brian Adams solo, right!) with another post in which we will explore Windows built in utility known as CHKDSK .

Lets get started.

What does CHKDSK mean, let us try to understand what Wikipedia has to say,

CHKDSK (short for "check disk") is a system tool in DOS, OS/2 and Windows. It verifies the file system integrity on hard disks or floppy disk and fixes logical file system errors

                                                                                                      -- Wikipedia

So, it means it is used to Check, Repair and Recover data(if possible) on the drive. It comes with a number of parameters. With command prompt help, you can find all the parameters and their actions using the cmd/? option.

Let us see what this results into in a Win 7 machine:

Well the options are self explanatory, for example:

#1: chkdsk /f : Will fix the errors on the current disk. Like if I run it on the above screen, it will take C: and try to fix the errors on C:

#2: chkdsk /r : Will attempt to recover data from from damaged sectors.

One important point, CHKDSK requires the drive not to be Locked. If the drive cannot be locked (you see a message, The Volume is in use by another process and that process is none other than your OS!), then, it will prompt you if you want to schedule it on the next system restart. If you press 'y' / 'Y'; it schedules on the next restart of the system.

In Win Vista or Win 7, the output is actually piped to App Event Log found in bootex.log in the root folder of the drive.

Let me show you the path to that folder --->> it is in C:\bootex.log !! [Sorry, I just tried to be funny!]

If it is not there, simply, run the CHKDSK utility again, it will appear!!! 

I will continue with the UI version of this in my next article!

See you later!

Basic Computer Definitions By Intel Corporation

Hi Friends!

Today, I am going to share my grey cells, but instead will share a link which will familiarize you with the basics of computer terminologies.

This article is from Intel corporation in which they have written crisp and succinct definition of many computer fundamentals. My sincere advice to you all, please read it and add to your understanding!

You can navigate to the link by clicking here.

[or you can copy + paste the link in your address bar: http://smb.intel.in/solutions/get-an-understanding-of-the-computer-terms?cid=40_smb_outbrain_common-computer-phrases_link ]


Feel free to ask your queries in the comment section.


Rest Is Next!