svchost - continually reading files

Specifically svchost periodically (about every hour) begins to read
C:\program files\world of warcraft\data\patch.mpq which is a huge file.
This isn't the only file it likes to read often.

What is actually causing this? Is this superfetch's doing? I'd be surprised
as I only played wow once since installation last night and the file has
now been read about 9 times today.

Indexing is switched off by the way.

richgk wrote:
> Specifically svchost periodically (about every hour) begins to read
> C:\program files\world of warcraft\data\patch.mpq which is a huge file.
> This isn't the only file it likes to read often.
>
> What is actually causing this? Is this superfetch's doing? I'd be surprised
> as I only played wow once since installation last night and the file has
> now been read about 9 times today.
>
> Indexing is switched off by the way.

Svchost does nothing on its own. As part of the name *host* implies,
Svchost host other processes such as DLL(s).

You can use Process Explorer and go look at a Svchost and see what it is
hosting.

Go to menu View/Show Lower/Pane/Show All Dll(s), which will show
everything that's being hosted by a process in the upper pane when you
click on a running process. You can right click a line in the upper or
lower pane and go to Properties.

http://www.download.com/Process-Expl....html?hhTest=1
http://technet.microsoft.com/en-us/s...s/default.aspx

I am not saying you have malware, but you have the information and what
tools to use to look at things for yourself.

<http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and_Rootkit_Tools_i n_a_Windows_Environment.html>
http://www.snapfiles.com/reviews/CurrPorts/cports.html

On Fri, 11 Jul 2008 08:21:10 -0400, the wrote:

> richgk wrote:
>> Specifically svchost periodically (about every hour) begins to read
>> C:\program files\world of warcraft\data\patch.mpq which is a huge file.
>> This isn't the only file it likes to read often.
>>
>> What is actually causing this? Is this superfetch's doing? I'd be surprised
>> as I only played wow once since installation last night and the file has
>> now been read about 9 times today.
>>
>> Indexing is switched off by the way.
>
> Svchost does nothing on its own. As part of the name *host* implies,
> Svchost host other processes such as DLL(s).
>
> You can use Process Explorer and go look at a Svchost and see what it is
> hosting.
>
> Go to menu View/Show Lower/Pane/Show All Dll(s), which will show
> everything that's being hosted by a process in the upper pane when you
> click on a running process. You can right click a line in the upper or
> lower pane and go to Properties.
>
> http://www.download.com/Process-Expl....html?hhTest=1
> http://technet.microsoft.com/en-us/s...s/default.aspx
>
> I am not saying you have malware, but you have the information and what
> tools to use to look at things for yourself.
>
> <http://www.windowsecurity.com/articles/Hidden_Backdoors_Trojan_Horses_and_Rootkit_Tools_i n_a_Windows_Environment.html>
> http://www.snapfiles.com/reviews/CurrPorts/cports.html

Cheers, I already have procmon (and other sysinternals apps) but haven't
got round to learning how to use it yet. Unfortunately I have to wait until
it decides to do it again!

"richgk" <> wrote in message
news:1ru0ljfz3ncwg.3ely245g4b4m$....
> Specifically svchost periodically (about every hour) begins to read
> C:\program files\world of warcraft\data\patch.mpq which is a huge file.
> This isn't the only file it likes to read often.
>
> What is actually causing this? Is this superfetch's doing? I'd be
> surprised
> as I only played wow once since installation last night and the file has
> now been read about 9 times today.
>
> Indexing is switched off by the way.
>

I don't play WOW, but perhaps it installs a service that you could disable.
That file is mentioned alot in WOW forums...try there.