04-11-2012 03:21 PM
04-11-2012 04:18 PM - edited 04-11-2012 04:19 PM
Please realize that Performance Monitoring is designed as an aid to help users understand which current system activity might be contributing to a given system behavior. For example you might get a high CPU usage alert for Flash Player or your browser when a sudden slowdown occurs while watching a video. Perfomance Monitoring is not a malware detection component like Auto-Protect, even though it might spot some system issues secondary to a malware infection (and those would be major anomalies, not a single write to disk). Given that there seem to be no indications of malware on your system coming from any of the protection components of NIS, it seems unlikely that the Svchost process in this case is a malicious imposter. It was almost certainly a legitimate process that happened to be active enough to be noticed by Performance Monitoring. Svchost is a Windows process that runs in the background - you are unlikely to know about most of the things it is doing or, actually, they are doing, since there are several of them.
04-13-2012 04:31 PM
As I say the only thing that is really stumping me is that there was not any recorded event in the Windows event log. I know that was some advice given to check that log. But as I say nothing noted around that same time.
Not sure if this makes any difference, but Looking through my NORTON history log, I see similar entries of
High Disk Write Usage by Host Process for Windows Services
October 1 2011 Saturday for 169MB
December 6 Tuesday for 188mb
Feburary 14 Tuesday for 2MB
March 14 Wednesday for 63 MB
and then April 10 Tuesday for 715mb
so not a real clear pattern, thought it might be windows update Tuesday but not
so again kinda stumped : (
Not a rootkit right?
04-14-2012 03:43 AM - edited 04-14-2012 03:49 AM
No, it just needed to do something, but it was certainly something legitimate. Forget this thing; you are making an issue out of a non-issue. Turn the Norton performance monitoring off if needed; at the moment, it's the Norton performance monitoring that is causing you issues, not the disk writes svchost.exe did that day.
Besides, there doesn't have to be any entries in the event viewer, if it's a service that is constantly running that is causing the disk writes. Only starts and stops are logged there, but if it's an automatic service that is on 24/7 that increases its activity, it won't be logged. Could be Superfetch maybe.
04-16-2012 02:20 PM
04-16-2012 02:35 PM - edited 04-16-2012 02:36 PM
Yeah, Superfetch runs under a svchost.exe, and it has been known to do a lot of disk trashing. On Vista especially. It has been much improved on Windows 7, but if you Google vista superfetch disk thrashing you get something like 50000 results
It also runs constantly by default - it's set to Automatic, so you won't see start- and stop messages about it in the event viewer.
04-17-2012 03:15 AM - edited 04-17-2012 03:16 AM
so I think thats soubds like the source, eh?
Quite possible. In any case, there is no indication of malicious activity from that Norton high disk activity report. Chances are overwhelming that it is a Vista issue - or even more likely, no issue at all, just Windows processes doing their job.