Svchost.exe with service Client DHCP [Dhcp] and DNS Client [DNScache] high memory use

Similar Questions

• Removal of the SBS 2011 server how to migrate DHCP and DNS services to the firewall

  I have a small client that has an old server that comes close to falling; its off primary runnign the disk space and must often be restarted.  they do not need the server and it was decided to remove the server and use a working group with NAS drive for their records.  They have a sonicwall firewall that can handle all DHCP services.  All computers have disjoint form field, all profiles will migrate the workstation's local user accounts.  all work, printing, file sharing and internet services.  When the server is stopped, after about 10 minutes the network goes down and I can't even log into the firewall.

  How I got out of shape services DHCP from the server to the firewall?  the firewall has active DHCP and the range of rental contract is configured correctly, but cann no PC connect when the server is off.

  Im trying to finish this tomorrow so if anyone can help me tonight it would be very appreciated...

  This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)
  *

  http://social.technet.Microsoft.com/forums/en-us/home s/fr-U.S./Accueil
  http://social.msdn.Microsoft.com/Forum
  
  
  If you give us a link to the new thread we can point to some resources it

• LOCAL SERVICE, SYSTEM and NETWORK of svchost.exe svchost.exe Svchost.exe. SERVICE

  I have these processes running several times, is this normal

  Generally, Yes, if you are looking in the Task Manager, it is normal to see many/many svchost processes running.  You may see 5-10 svchost process running in the Task Manager, maybe less or maybe more.  But what you don't see with the Manager tasks, is running behind them.

  If your system is not afflicted with malicious software, XP important Services running behind svchost - Service processes sometimes alone, sometimes several.

  The username that see you for the svchost process could perhaps LOCAL SERVICE or NETWORK SERVICE and that's how the Services XP to fix themselves to connect to your system using these special accounts, for example:

  LOCAL SERVICE would be local Services - things like the Webclient or the Application Layer Gateway Services.

  NETWORK SERVICE would be Network Services - things like the DNS Client or remote procedure call (RPC) Services.

  These Services of XP run behind/under the svchost process using these special account names.

  Some malware knows that using the Task Manager, you can not see what works behind the svchost process so that the malware is running under one of them hiding so that you can't see.  Apparently, some malware can dress up like a svchost process for still more you cheating.

  When things like that happen, you'll usually see a svchost process that executed the amok much consuming CPU or memory when they normally does, so if you see, you need to run some malware scanners known first, for example:

  Download, install, update and do a quick scan with these free malware detection programs (not at the same time):

  Malwarebytes (MMFA): http://www.malwarebytes.org/products/malwarebytes_free
  SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

  SAS will probably report a lot of tracking cookies and you can just let him delete them.

  They can be uninstalled later if you wish.

  You can see what works behind your svchost process if you use Process Explorer.  PE can be a little intimidating at first because it displays a lot of information, but once you get the hang of it, you start it if you want to solve performance problems.  PE does not settle anything and going just on demand, so it won't bog down your system.

  If you read this article, you will be smarter than the average bear on what is happening with all those svchost.exe process see you in the Task Manager and understand why it is normal to see several svchost running processes in the Task Manager.

  http://www.bleepingcomputer.com/tutorials/tutorial129.html

• Using vm as DC, DHCP and DNS

  Can I configure vm to use my controller domain, DNS and DHCP servers?

  If so, how can I statically assign my choice for my DNS and DHCP IP?

  Can I configure vm to use my controller domain, DNS and DHCP servers?

  Yes.

  If so, how can I statically assign my choice for my DNS and DHCP IP?

  Just change the network settings of the virtual machine within the guest OS and assign parameters in the appropriate subnet. You can also consider turning off the service DHCP from VMware. With VMware Workstation in place, it is much easier, since you can add additional virtual networks and enable/disable DHCP for each virtual network separately from the GUI.

  André

• Error 800 b 0100 code with Service pack 2 install and the update of vist

  I tried everything short of uninstalling my antivirus... never had a problem vista update before why suddenly it won't install? I tried the chat with tech service website microsofts however they disconnected in the middle of the conversation and closed half an hour early... which really upset me. How to install something that fails everytime I try? Please help because microsoft will not help

  Click on the relevant links
  IE http://support.microsoft.com/kb/947821
  This will take you to the kb article.

  TaurArian [MVP] 2005-2010 - Update Services

• I accidentally put to run the exe with adobe PDF viewr files and can't find how to cancel it

  I was running an exe file and accidentally did something and now he's trying all the files with the adobe PDF Viewer running and I can't undo. Help, please.

  See this tutorial.

  http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html?filter [2] = file Folder settings

• Lost windows xp professional with service Pack 3 cd and my computer is missing componets told me I have to re install cd but can't find what I can do

  I've lost my windows xp cd and it must be reinstalled I can do

  Are you sure you've lost this CD? Maybe you had one. It is certainly the case with many PC manufacturers, which rather than provide a restore hidden on the hard disk partition.

  What is the brand and model of your PC?

  FWIW, it is in fact rarely necessary to reinstall Windows. What are your specific issues? Components that are missing? And why?

  A faster and easier solution may very well be available!

• Computer runs slowly, several instances of dllhost.exe and svchost.exe consumes large amounts of CPU and RAM, please help!

  So it is currently 05:49 where I am right now and I've lost sleep over this issue these days.  My computer went from fast to slow apparently all night and I cannot understand why.  I downloaded Malwarebytes and ESET Nod 32 Antivirus free and I have Avira.  I have scoured the sysinternals Process Explorer and cannot find the root of the problem, and I just need someone better than me to help me with this problem.  I will follow all rules or guidelines, I'd really appreciate just for help!  Thank you!

  I mean not kind of, but not in a concrete way.  I backed up all my hard drive on a USB of terra, reset my computer at the store settings, basically wiping and just re - download the essential.  In fact, it works better than ever, now that it is cluttered with.  It seems barbaric, but he did a lot.

• Cloning by rman on a different server with the directory structure different and different DBNAME in EBS 11i using quick Clone

  Hello

  We want only DB (not apps) cloning through PROD rman, step TEST EBS 11i using quick Clone without taking downtime of PROD (i.e. No. BKP COLD).

  Source and target are on different servers, different file structure and the different database name.

  Kindly let me know the detailed procedure?

  Kind regards

  RR

  
  

  You can use this simple method that I am.
  

  
  

  Take backup of production with rman:

  {

  overlap archivelog all;

  backup format compressed backupset database tag PROD_FULLBKP ' / u10/PROD1_L0_BKUP_20131125/PROD_DB_set%s_piece%p_%T_%U' filesperset 15;

  SQL 'alter database backup controlfile to trace. "

  SQL 'alter system switch logfile;

  SQL 'alter system switch logfile;

  SQL 'alter system switch logfile;

  overlap archivelog all;

  backup as compressed backupset archivelog all delete input PROD_ARCHBKP format tag ' / u10//PROD1_L0_BKUP_20131125/ARCH_PROD_set%s_piece%p_%T_%U' filesperset 20;

  backup format ' / u10/PROD1_L0_BKUP_20131125/PROD_ctl_%T_%U' current controlfile;

  }

  
  

  Move the backup on the test server:

  SCP /ftp

  Modify the pfile to the test server:

  Parameters such as:

  db_name

  control_files

  modify the pfile to match the location of the test server

  Add this parameter

  db_file_name_convert = ' / PROD_datafile_location/datafile ', ' / test_datafile_location / data ', ' / PROD_datafile_location/tempfile ', ' / test_datafile_location / data.

  log_file_name_convert = ' / PROD_redofile_location/ONLINELOG ', ' / test_redofile_location / data ".

  Start the DB:

  Start the db in nomount:

  startup nomount.

  Connecting to rman and start to restore:

  Auxiliary RMAN.

  RMAN > run

  {

  allocate auxiliary channel a1 device type disk;

  allocate auxiliary channels a2 device type disk;

  allocate auxiliary channel a3 device type disk;

  allocate auxiliary channel a4 device type disk;

  data duplicated in the PREPRODUCTION backup location ' / u10/PREPRODUCTION/oraR12/clone_backup/PROD1_L0_BKUP_20131125 ";

  }

  OR

  If you specify time/perform a recovery of time based, like below:

  RMAN > run

  {

  allocate auxiliary channel a1 device type disk;

  allocate auxiliary channels a2 device type disk;

  allocate auxiliary channel a3 device type disk;

  allocate auxiliary channel a4 device type disk;

  data duplicated in PREPRODUCTION backup location 'LOCATION_OF_BACKUP', until ' TO_DATE (7 July 2012 09:45 ',' DD/MM/YYYY HH24:MI:SS') ";

  }

  Concerning

  Karim

• vRanger connection 7.1.1 and vCenter 5.5 - open filters causing high memory use vpxd?

  Hello

  Displays the first time, hoping you can help me. We are big consumers of vRanger connection in our environment, we use multiple instances to save the production, test, dev, VDI, etc. (6 cases total). Recently, we met our vRanger 7.1.1 connection servers and our vCenter to 5.5 Update 2 b. Since then, every evening when our nightly backups occur to our use of memory for vpxd on our vCenter server (process vpxd.exe) increases, and it remains standing and rising again every night until the that vCenter grave service failed due to memory exhaustion. After 2 weeks of troubleshooting with VMware, their senior engineers think that connection vRanger not close correctly filters, leaving a large number of them that causes the memory out is not in the system.

  Are you aware of any issues like this being reported elsewhere? I tried to find other peoples identify this problem, but it seems that we are the first. Please help, thanks!

  We have not seen this issue in our lab, but we currently 5.5 2d update.  I recommend that you open a support casel

• What graphics card and the amount of video memory uses the Satellite A80

  Hello.
  Answer please. I have Satellite PSAA8E-077017DU. What video card on this model? And use of the video card MB maximum how on this model.
  Thank you to.

  Hello

  I googled a little and you should know that the series of laptops have been delivered with a different hardware configuration.
  The number you placed said nothing to me and that's why it would be very interesting to know the additional name of mobile; Satellite A80 - xxx

  However, some of these units are Mobile Intel Express Chipset AlvisoGM up to 128 MB of memory sheared 915GM supported.

• On the server with a not too high memory use. DBS

  Hi all
  I see the use of memory to 100% to this server. I reduced the parameters of the SGA to the minimum values and bounced these DBs, but again I don't see no improvements.
  
  What can we do? I'm the only one currently DBA & I have to solve this problem. Other teams are dependent on my the memory usage reduction.
  
  A few details
  ++++++++
  OS: SunOS
  For all instances version: 10.2.0.3
  
  Please come back in case you need more details to help me
  ++++++++
  See you soon,.
  Malika

  So far you didn't post any detail, such as
  -the amount of RAM in the server
  -the amount of memory consumed by Oracle
  -How many cases, the size of their EAG and their PGAs
  - and especially WHY someone at decide between several database on a single server.

  ---------
  Sybrand Bakker
  Senior Oracle DBA

• How to check a Svchost.exe high memory usage and troubleshoot?

  How to check a Svchost.exe high memory usage and troubleshoot

  Beautiful Basu 'ASK ',.

  I think I know the answer. Visit this link

  And you can download SvcHost Viwer here.

  Run the following command from cmd: tasklist/SVC /fi "imagename eq svchost.exe".

  Focus on the PID that is causing the high CPU.

  Run SC Config = own Type for each service under this PID. It will launch each service with a separate svchost.exe.

  I would recommend for a complete AV scan.
  Use the following link for the same thing:
  Microsoft safety scanner

• netsvcs svchost.exe using too much speed processor - Windows 7

  Hello

  My laptop that runs windows 7 works very slowly if at all during startup or even to open programs. I open the Task Manager > performance > resource monitor and find svchost netsvcs uses more than 90% of the CPU. I found by suspending the process of that CPU usage falls considerably to about 12%. I tried searching, but am not very computer. I installed, updated and scanned with malwarebytes, essentials of microsoft. I came across a thread, which suggests HijackThis, I ran, but I'm not sure what to fix and what not to do. Here is the log:

  Logfile from Hijack Defender v1.2.0
  Scan saved at 18:08:17, 06/01/2013
  MSIE: Internet Explorer 6.1.7601
  Boot mode: Normal

  Ongoing process:
  C:\PROGRAM FILES (X 86) \COMMON FILES\ARCSOFT\CONNECTION SERVICE\BIN\ACDAEMON. EXE
  C:\PROGRAM FILES (X 86) \COMMON FILES\ARCSOFT\CONNECTION SERVICE\BIN\ARCCON. CA
  C:\PROGRAM FILES (X 86) \INTERNET EXPLORER\IEXPLORE. EXE
  C:\USERS\JOANNE\APPDATA\ROAMING\SEARCHPROTECT\BIN\CLTMNG. EXE
  C:\PROGRAM FILES (X 86) \HIJACK DEFENDER\HIJACKDEFENDERFULL. EXE

  O4 - HKLM\... \Run: [ArcSoft Connection Service] "C:\Program Files (x 86) \Common Service\Bin\ACDaemon.exe.
  O4 - HKLM\... \Run: [SearchProtectAll] C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
  O4 - HKCU\... \Run: C:\Users\Joanne\AppData\Roaming\SearchProtect\bin\cltmng.exe [SearchProtect]
  O4 - C:\Users\Joanne\AppData\Roaming\Microsoft\Windows\Start demarrer\programmes\demarrage\: [PC Backup.lnk] C:\Program Files (x 86) \MyPC Backup\MyPC Backup.exe
  O9 - (extra button) @C:\Program c: Program Files (x 86) \Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - HKLM Software Microsoft Internet extensions
  O9 - (extra button) send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - HKLM Software Microsoft Internet extensions
  O9 - (extra) search button - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - HKLM Software Microsoft Internet extensions
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  O14 - C:\windows\inf\iereset.inf: [IEReset.inf is missing]:
  Ø16 - DPF: popcaploader.dll - popcaploader.dll - C:\windows\Downloaded Program Files
  Ø16 - DPF: popcaploader.inf - popcaploader.inf - C:\windows\Downloaded Program Files
  Ø16 - DPF: swdir.inf - swdir.inf - C:\windows\Downloaded Program Files
  F2 - HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon: [Userinit]: userinit.exe,.
  O2 - BHO: Adobe PDF link Helper C:\Program Files (x 86) \Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - HKLM Helper Objects
  O2 - BHO: connect DLC Toolbar C:\Program Files (x86)\Connect_DLC\prxtbConn.dll - {3f3cddf8-f74d-430c-bd19-d2c9147aed3d} - HKLM Helper Objects
  O2 - BHO: Updater SweetPacks C:\Program Files\Updater SweetPacks\Extension32.dll - {7D4F1959-3F72-49d5-8E59-F02F8AA6815D} - HKLM Helper Objects
  O2 - BHO: Windows Live ID Sign-in Helper C:\Program Files (x 86) \Common Files\Microsoft Shared Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - WindowsLiveLogin.dll HKLM Helper Objects
  O2 - BHO: C:\Users\Joanne\AppData\Local\TopArcadeHits\Toparcadehits.dll - {A7A9D7E7-E0C0-4202-9F13-6A06BD073CDA} - HKLM Helper Objects games TopArcadeHits
  O2 - BHO: WeCareReminder Class - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll HKLM Helper Objects
  O2 - BHO: Java (TM) plug-in 2 SSV Helper C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9} - HKLM Helper Objects
  O2 - BHO: Browser Helper C:\Program Files (x 86) SweetPacks \SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll - {EEE6C35C-6118-11DC-9C72-001320C79847} - HKLM Helper Objects
  R1 - HKCU Software Microsoft Internet hand = http://search.conduit.com/?ctid=CT3301943&octid=CT3301943&SearchSource=61&CUI=UN35112783043013184&UM=2&UP=SPB1D3B741-8C57-4DCF-AECB-DC559920EF80
  R1 - HKLM Software Microsoft Internet hand = http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10045&barid= {1F5FE73A-CB16-11E2-BBB0-00266C6F5EF9}
  R1 - HKCU Software Microsoft Internet hand = Internet Explorer, Bing and MSN
  R1 - HKLM URLSearchHooks = {3f3cddf8-f74d-430c-bd19-d2c9147aed3d}
  R1 - HKCU URLSearchHooks = {3f3cddf8-f74d-430c-bd19-d2c9147aed3d}
  O23 - Service: ArcSoft Connect Daemon - ACDaemon - C:\Program Files (x 86) \Common Files\ArcSoft\Connection Service\Bin\ACService.exe
  O23 - Service: Extensible Authentication Protocol - EapHost - C:\windows\System32\svchost.exe-k - netsvcs
  O23 - Service: Function Discovery Resource Publication - FDResPub - C:\windows\system32\svchost.exe k fontcache
  O23 - Service: Windows are Cache Service - FontCache - k LocalService C:\windows\system32\svchost.exe
  O23 - Service: Earphone HomeGroup - HomeGroupListener - k LocalSystemNetworkRestricted C:\windows\System32\svchost.exe
  O23 - Service: HomeGroup - HomeGroupProvider - C:\windows\System32\svchost.exe k LocalServiceNetworkRestricted provider
  O23 - Service: IKE and AuthIP IPsec Keying Modules - IKEEXT - C:\windows\system32\svchost.exe-k - netsvcs
  O23 - Service: Service Intuit - IntuitUpdateService updated - "C:\Program Files (x 86) \Common Service\IntuitUpdateService.exe.
  O23 - Service: Microsoft Antimalware Service - MsMpSvc - "c:\Program Files\Microsoft Security Client\MsMpEng.exe.
  O23 - Service: Microsoft Network Inspection - NisSrv - "c:\Program Files\Microsoft Security Client\NisSrv.exe.
  O23 - Service: Network Location Awareness - NlaSvc - k NetworkService C:\windows\System32\svchost.exe
  O23 - Service: network identity Manager peer - p2pimsvc - C:\windows\System32\svchost.exe k LocalServicePeerNet
  O23 - Service: IPsec Policy Agent - PolicyAgent - C:\windows\system32\svchost.exe k NetworkServiceNetworkRestricted
  O23 - Service: - Power - k DcomLaunch C:\windows\system32\svchost.exe
  O23 - Service: RPC Endpoint mapping - RpcEptMapper - k RPCSS C:\windows\system32\svchost.exe
  O23 - Service: System Event Notification Service - SENSE - C:\windows\system32\svchost.exe-k - netsvcs
  O23 - Service: SSDP Discovery - SSDPSRV - C:\windows\system32\svchost.exe k fontcache
  O23 - Service: TOSHIBA optical disc drive Service - TODDSrv - C:\Windows\system32\TODDSrv.exe
  O23 - Service: TOSHIBA drive HARD SSD Alert Service - TOSHIBA SSD Alert Service HARD drive - "C:\Program Toshiba Toshiba HDD SSD Alert\TosSmartSrv.exe.
  O23 - Service: host device UPnP - upnphost - C:\windows\system32\svchost.exe k fontcache
  O23 - Service: Windows Live ID Sign - in Assistant - wlidsvc - "" C:\Program Files\Common Files\Microsoft Shared Live\WLIDSVC. "." EXE ".
  O23 - Service: Windows Update - wuauserv - C:\windows\system32\svchost.exe-k - netsvcs
  O23 - Service: Windows Driver Foundation - User-mode Driver Framework - wudfsvc - k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe
  O23 - Service: IBUpdaterService - IBUpdaterService - C:\windows\system32\dmwu.exe
  O23 - Service: update by SweetPacks - update SweetPacks - C:\Program Files\Updater by SweetPacks\ExtensionUpdaterService.exe
  O23 - Service: Protect by Conduit Updater - CltMngSvc - C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe research

  --
  End of file - 7617 bytes

  Any help is greatly appreciated, thank you

  Hello

  Thanks for the reply.

  I suggest you to check if you are facing the same question in the new administrator account.

  Create a new user account-
  http://Windows.Microsoft.com/en-us/Windows7/create-a-user-account

  If you are not faced with the same question in a new user account, you can view the link below and use the steps provided to fix a corrupted - user profile
  http://Windows.Microsoft.com/en-us/Windows7/fix-a-corrupted-user-profile

  Kind regards

• Why so many svchost.exe in task manager/processes in XP SP3?

  There are like 8 + svchost.exe in the Manager of tasks/processes all ate

  my memory and I have 4 GB of ram, I have a dual core cpu Intel 6300 Hz 1.86

  Windows XP Media Center SP3

  To help understand your processes svchost.exe and what is running under them, read this article and you will be smarter than the average bear:
  http://www.bleepingcomputer.com/tutorials/tutorial129.html

  You may be able to get clues with what is happening with your svchost.exe process using the Task Manager and maybe understand.

  You will always be able to understand what is happening with your svchost.exe process if you use Process Explorer.

  Download Process Explorer, so you can see what is 'really' running on your system, especially behind those svchosts several process see you in the running task manager.

  Download Process Explorer from here:

  http://TechNet.Microsoft.com/en-us/Sysinternals/bb896653.aspx

  You'll like Process Explorer when you get the hang of it.  Process Explorer is the Manager of Windows taskbar on steroids.

  Process Explorer installs nothing so it won't slow down your system since it works only on request.

  Process Explorer can seem a little intimidating at first because it has so much information, but you will begin to make love the way it works when you're looking for performance problems.   You can even say EP you want it to be your new default 'Task Manager' value in the future.  You can always run the original tasks as Manager.

  Once you get Process Explorer running, expand the columns, made drag the corners of the screen for it's largest, etc., so you can see as much information as possible in the window.  Now you can really see what is running on the system.

  Here's a screenshot of my poor system when I use Process Explorer:
  http://img222.imageshack.us/img222/2567/ProcessExplorer.PNG
  The CPU column is usually the most interesting start with performance issues - which uses the most?

  It is OK and normal to have several svchost exe processes running.  Important XP Services are actually running under svchost.exe processes. There are sometimes an XP Service that runs under a svchost.exe process, sometimes there are several Services in XP, which runs under a svchost.exe process.

  Sometimes malware will hide behind a svchost.exe process because the malware knows that you won't be able to find it in the Task Manager.  He will hide behind a svchost.exe process to deceive you, but you can outsmart it.

  Malicious software can disguise itself also seems to be a legitimate process of XP or he could hide under/behind other processes that you see running in Task Manager if you can't see the execution.

  The malware would trick you into thinking you must use a System Restore Point, run a repair install or reinstall your XP from scratch when you really don't.

  Looking at the display in process Explorer, you want the CPU most to be associated with the system idle process.  It's 'free time' on your system, so more time there, more free.

  If you look at the graphs of performance and see red spikes (or not) double click the graphic in the upper left corner to display the graph to use.  Move the mouse over any pics to see what are the causes.  Even if the Spike has already scroll screen, you can still move the mouse over the edge to see what caused.  You can also just wait for a pic to happen and then see what caused the Spike.

  If you think one of your svchost.exe process is out of control or run amok, understand that some malware will hide as a process behind one of your several svchost.exe processes.  All what you will see in the Manager of tasks is a svchost.exe process that has run amok.

  The malware knows that you won't be able to see it in the Task Manager.  The malware hope you will do something drastic like use a Restore Point, perform a repair installation, or even to reinstall your XP from scratch.

  No matter what you use for software malware, detection and removal do this first:

  Download, install, update and do a full scan with these free malware detection programs:

  Malwarebytes (MMFA): http://malwarebytes.org/
  SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

  They can be uninstalled later if you wish.