Weird svchost problem

bart on 2006-10-22T12:24:58

I've been having some strange things happen on my XP Pro laptop for a few months. So far, I've been able to find some things on what appears to have been going on, but now I'm stuck.

Every once in a while, most of all when the laptop comes out of screen saver mode, there's a DOS window there, that wasn't there before, or it appears after a few seconds after coming back up. It belongs to svchost, the Windows Services control program. So far, I found out that it's an instance of perl (in my case, ActivePerl 5.8.8), waiting for a script. If I type in perl commands, and then enter "__END__" on a line of its own, then first the commands get executed, and then the window closes. I can see what it outputs by adding an END block that postpones the exiting of the program.

In short, it appears that svchost runs, for an obscure reason, perl without any command line parameters. Why? Not a clue.

So, any clue to what might cause this, or how I could find out? I suspect there's a weird entry for perl in the registry, somewhere, and svchost acts on it.


Command line tools

bart on 2006-10-22T23:31:59

After some Googling I created a batch file with a few commands as found on these
pages.

Now it's time to go under cover, and wait for it to show up.

Re:Command line tools

bart on 2006-11-13T00:44:18

Ah, yes, that problem... No, it's still not solved. And when it did happen, these tools found nothing. It's just perl that gets started up without parameters, by svchost it seems, judging by the title bar of the window, but no trace of its origin in the logs created by these programs.