svchost.exe using up all my CPU on Windows XP?

Question

I'm running Windows XP Home Edition Service Pack 3 on this hardware setup:
AMD Athlon 64 3500+ 2.20GHz 2GB Ram Asus A8V Deluxe Motherboard Nvidia GeForce 7600 GS
Basically when I enter windows it is very slow. I enter task manager -> processes and see svchost.exe has astronomically high cpu usage to the extent it slows everything else down.
I've tried doing this: http://www.technibble.com/how-to-fix-svchost-using-100-cpu-memory-leak/
I've also updated everything recommended by windows update. I have scanned my PC for viruses using latest/updated AVG antivirus - it found nothing. I have found disabling automatic updates does not help also.

I have used Process Explorer to look into the svchost.exe that is using up all the CPU. It is called "svchost.exe:1668 (netsvcs)" in the properties tab in Process Explorer. The Strings are here if it helps:
Parameters
System\CurrentControlSet\Services
nServiceMain
ServiceDll
ServiceDllUnloadOnStop
eventlog
ncacn_np
\PIPE\
DefaultRpcStackSize
AuthenticationCapabilities
ImpersonationLevel
AuthenticationLevel
CoInitializeSecurityParam
Software\Microsoft\Windows NT\CurrentVersion\Svchost
\Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\
VS_VERSION_INFO
StringFileInfo
CompanyName
Microsoft Corporation
FileDescription
Generic Host Process for Win32 Services
FileVersion
5.1.2600.5512 (xpsp.080413-2111)
InternalName
svchost.exe
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
svchost.exe
ProductName
Microsoft
Windows
Operating System
ProductVersion
VarFileInfo
Translation
!This program cannot be run in DOS mode.
5Rich
.text
`.data
.rsrc
ADVAPI32.dll
KERNEL32.dll
NTDLL.DLL
RPCRT4.dll
QQV
PWj
WQP
SvchostPushServiceGlobals
ServiceMain
Y@PVPVh
VWh@@
SVW
SVW3
PSh
tQj
VVVV
t6PV
t!VV
QSV3
ucj
jWX
Wht@
jdj
QQSVWd
QSV
u-SS
uLV
FFf
!FFf
F$Pj
f9>t f
FFf9>u
tof
tSf
FFf9>u
ShP$
VWh
QRPh
uRS
taj
u:Vj
VVj
PSj
PSSj
PSSj
unj
GPW
FFf
FFf
PWWj
WWj
SVW
HHt
jWX]
SVW
QRPhh2
VWj
VWj
NETAPI32.dll
ole32.dll
Netbios
CoInitializeEx
CoInitializeSecurity
ADVAPI32.dll
KERNEL32.dll
ntdll.dll
RPCRT4.dll
RegQueryValueExW
SetSecurityDescriptorDacl
SetEntriesInAclW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
GetTokenInformation
OpenProcessToken
OpenThreadToken
SetServiceStatus
RegisterServiceCtrlHandlerW
RegCloseKey
RegOpenKeyExW
StartServiceCtrlDispatcherW
HeapFree
GetLastError
WideCharToMultiByte
lstrlenW
LocalFree
GetCurrentProcess
GetCurrentThread
GetProcAddress
LoadLibraryExW
LeaveCriticalSection
HeapAlloc
EnterCriticalSection
LCMapStringW
FreeLibrary
lstrcpyW
ExpandEnvironmentStringsW
lstrcmpiW
ExitProcess
GetCommandLineW
InitializeCriticalSection
GetProcessHeap
SetErrorMode
SetUnhandledExceptionFilter
RegisterWaitForSingleObject
InterlockedCompareExchange
LoadLibraryA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
LocalAlloc
lstrcmpW
DelayLoadFailureHook
NtQuerySecurityObject
RtlFreeHeap
NtOpenKey
wcscat
wcscpy
RtlAllocateHeap
RtlCompareUnicodeString
RtlInitUnicodeString
RtlInitializeSid
RtlLengthRequiredSid
RtlSubAuthoritySid
NtClose
RtlSubAuthorityCountSid
RtlGetDaclSecurityDescriptor
RtlQueryInformationAcl
RtlGetAce
RtlImageNtHeader
wcslen
RtlUnhandledExceptionFilter
RtlCopySid
RpcServerUnregisterIfEx
RpcMgmtWaitServerListen
RpcMgmtSetServerStackSize
RpcServerUnregisterIf
RpcServerListen
RpcServerUseProtseqEpW
RpcServerRegisterIf
I_RpcMapWin32Status
RpcMgmtStopServerListening
RSDS
svchost.pdb

Task manager has it as running under "services" and not "user".

The Services associated with it I have screen-shotted into an image here:
http://tinypic.com/view.php?pic=4gsr2f&s=5

I've tried to give as much information as possible to help solve this problem.

Answer 1

This looks suspiciously like TDSS (TDL-4 variant most probably) rootkit-from-hell behaviour...at the very least it's worth the effort to rule this out. This root kit is hard to detect and remove with a standard antivirus program, it soaks up CPU and Network resources. Here is some more info- http://support.kaspersky.com/viruses/solutions?qid=208280748

and an MBR scanner- http://public.avast.com/%7Egmerek/aswMBR.exe

and Bleepingcomputers can be a help to you also- http://www.bleepingcomputer.com/forums/topic442388.html

Answer 2

svchost.exe is a helper program that allows .dll files to run like .exe files. There should be one instance of svchost.exe in task manager for each dll that needs to be running. Things that might be causing the problem are AV programs, windows defender, or a rogue/corrupted application. Try trimming the autostart entries till you find the resource hog.

Answer 3

you'll regularly have fairly some svchost classes operating. should not be an difficulty. 13 does sound sort of like a lot inspite of the truth that. besides... yet what's this technique making use of the most processing?

Answer 4

I don't know anyone who still uses xp.