Remote Access Connection Manager = svchost overload

[ID10T16]

Ok, here's the problem:

Remote Access Connection Manager, when running, causes svchost.exe to take up all CPU cycles. When Remote Access Connection Manager is not running, everything runs fine.

Normally I would just disable the service and that would be that, unfortunately, the service is needed for the dial-up connection that the individual needs/uses.

Here's my questions:

1. Has anyone seen this before?
2. Aside from an OS repair/format+reinstall, is there a way to fix this?
3. What exactly can be the cause of this.

Thanks for the help that anyone can offer.

----------------------------------------
Exactly where is the point that you are assassinated rather than murdered?

 

[gpalmer711]

I have seen this before and in that instance it was due to malware. So first off if you haven't already i'd do a full virus and malware scan.

Then i'd use the System File Checker to make sure all the system files are present and correct.

Click on Start > Click on Run > Type sfc /scannow > Click ok

You May need the Windows XP CD to complete this task.

Also check the event viewer - Click Start > Run > type eventvwr > Click OK

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[ID10T16]

I figured malware was a very likely culprit, so I've done a couple scan(s) (1 housecall, 1 Ad-Aware, and one manual browse through for anything suspicious). I need to run spysweeper (the undisputed king for spyware imho).

My first thought was to check the event viewer as well (guess I wasn't too forthcoming in my initial post), but I saw nothing that was suspect, in fact it was suprisingly void of warnings or errors for the few days I was looking through.

I did run sfc before I posted as well, and I've run a registry repair utility too. SFC never asked for the Windows disk, which told me that it didn't find anything that it needed to take care of.

I'll do a more in-depth virus/spyware scan, and report back (that won't be till tomorrow sometime or maybe even this weekend).

----------------------------------------
Exactly where is the point that you are assassinated rather than murdered?

 

[ID10T16]

Update:

Checked for spyware/viruses. 3 Spyware programs say it's clean, and 2 Virus programs say it's clean.

Something else I noticed as well...

With the Remote Access Connection Disabled, if I try to run windows update, svchost pegs out yet again, and I can never download the updates. However, if I have RACD running from startup, then svchost pegs out from the get go.

Does anyone have any clue what might be going on?

----------------------------------------
Exactly where is the point that you are assassinated rather than murdered?

 

[gpalmer711]

Have a look at your hosts file

C:\windows\system32\drivers\etc

You can open it in notepad.

Has it got loads of entries? If so try renaming it to hosts.old and reboot the machine. When it comes back up see if you still have the problem. If so download and run Hijack This from

http://www.tomcoyote.org/hjt

and post a log file here.

Greg Palmer
Freeware Utilities for Windows Administrators.

http://www.palmersoft.co.uk

 

[linney]

Does Services confirm that the Remote Access Connection Manager service has started and has not hung?


Is there anything strange about this Registry Key and the Value data which on this working machine only has a Data Value of "Tapisrv" listed?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan, the Value "DependOnService"

You could try unregistering and then reregistering the rasmans.dll