svchost.exe

UPDATE -- I solved my problem with 100% CPU usage due to multiple instances of svchost running. I originally thought I had figured it out after removing SoundForge, the program that caused a hard crash on my laptop because CPU usage dropped to between 4% and 100% after removal. But after reboot, the system returned to 100% CPU usage. The svchost.exe (Generic Host Process for Win32 Services) is an integral part of Windows XP OS. It cannot be stopped or restarted manually. It manages 32-bit DLLs and other services. In normal conditions more than one Svchost.exe instance will always be open. Because I normally have five open, I cannot launch things such as REGEDIT or Norton Anti-Virus. This is tedious, even when using online scanning troubleshooting like RAV AntiVirus.

It's important to note that SERVICE HOST is not a bug. It is a required service. SVCHOST.exe runs runs DLLs. In my case, a DLL might be experiencing a problem or might be corrupted. These problems might be caused by viruses, trojans--or spy software in my case. SVCHOST.exe runs a DLL. If a specific DLL is corrupted, you have to identify what app is causing the DLL call. The Event Viewer helps here.

I did a line-by-line analysis of tasks running in my XP Pro operating system. I have Task Manager running in one window and have noted which services are using memory and CPU. I also open a second window for Control Panel [Admin Tools/Services] where I look at plain services, not component services. I go down the list of services and turn them off and back on while monitoring the Task Manager. In my case, systems.exe is the culprit. Time to delete the culprit.

I deleted services.exe from my System32 directory and released enough resources to run Norton Anti-Virus. It found evidence of the HLLW.Nachi.B virus, so it quarantined it and deleted it from my system. However, Norton Anti-Virus 2004 totally mucked up my mail services on my laptop, so I cannot recommend its use with Windows XP Pro.

I edited my system registry to remove any other evidence. Clean registries make faster bootups.

After patching all my Windows XP Pro services, which included installing SP1, reactivating Norton Antivirus 2004, and cleaning my Windows Registry, I lost all SMTP and POP services. Losing normal mail services was not on account of spyware, but it happened because Norton Antivirus 2004 appears to be incompatible with Windows XP Pro SP1. I've gone from removing spyware from my system to removing all traces of Norton Anti-Virus from my computer. Along the way, I've attracted more people to this blog--including persistent comment spammers from Poland--than any other topic I have ever written. There must be an enormous problem with SVCHOST.exe in the home computing environment. That means thousands of computers, infested with spy programs and connected to always-on services that are easily compromised after simple port scans. If svchost.exe has your computer maxed out, many ot its protective services simply stop running (if they launch at all).

---

PCVS Console -- "How to remove svchost"
McAfee -- explains how SVCHOST embeds to Registry
Anthony Quinn -- "Browser-based attacks on the rise"
x_ref125ws
qu

Comments

[ahmed]

hello how are you. i want to know that..i tried lot of time to remove svchost.exe but every time when i am starting my windows2000 so i always found svchost.exe in startup. so what i have to do and how i remove that permenently.please us with thanks. and how we can check our system that "our system is secure or hacked) please give me the answer. and thanks for help

[Muzammel]

hi sir i have problem in window xp a svchost.exe captured my whole process up to 100% and when i check through task bar several process running with that exe. so sir kindly provide me a solid solution how can i fix this problem i am very thankful to you. i am waiting for ur reply sir
Thanks
Muzammel

[Torquemada]

1. Turn off System Restore
2. Disable RPC services
3. Install AVG Free edition, update & run
4. Install Ad-Aware SE, update & run
5. Update your system with Windows Update
6. Leave system restore off
7. Re-enable RPC services
8. Keep your antivirus software and spyware up to date

9. Never use Internet Explorer or Outlook Express again

[Paul Power]

Looking through your task manager list can be very informative - I've a Dell D600 laptop and regularly the hot key service goes nuts and starts consuming loads of CPU - killing it fixes the problem but loses access to the various function keys available on the machine.

If you're interested in watching your task list take a look at process explorer from System Internals (www.systeminternals.com). It can be used as a drop in replacement for the task manager and gives you *loads* more information and control.

[jason]

help, my svchost crashes or gets an error at the begining of start up not allowing me to connect to my internet connection. error signature- szAppName : svchost.exe szAppVer : 0.0.0.0 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

these files were included in my error report
C:\DOCUME~1\GENERA~1\LOCALS~1\Temp\WER7771.dir00\svchost.exe.mdmp
C:\DOCUME~1\GENERA~1\LOCALS~1\Temp\WER7771.dir00\appcompat.txt

if anyone can help please let me know.

[tom]

Best advice is get shot of NAV & get yourself a copy of NOD32 - silly name, excellent AV. Your machine will be faster as well as safer.

[tom]

BTW : It would be courteous to warn contributors that their email address will be added to this page ready for harvesting by spam mail bots, and that they can expect the address they use to be filled with Viagra adverts from shortly after they post :-(
( or you could fix the problem of course )

[Bernie Goldbach]

Typepad shows email addresses only when commenters place them in the box marked "email" without putting anything in the box marked "URL".

[Devendra Chauhan]

I have visited ur website.
It makes an impression on me..
I also want to luanch my web site Pls give me knowledge of it that how to choose domain and how to upload it..

Good bye

[berniek]

Hi. I'm running Win2K with all SPs and updates, NAV, Spybot, and the MS patch for the worm which infects svchost.exe. Nonetheless, on several computers, one instance of svchost.exe runs for 6 minutes preventing use of the computer. This was even the case with a fresh install of Win2K and all updates, plus one engineering application which was fine in the past.

None of the methods I've tried seem to tame the wasted time svchost.exe takes at first, even disconnecting the network cable. Any info on this using Win2K would be much appreciated. Thanks.

BernieK

[ISE]

svchost seems to be quite a problem in past few months again. had no problems before, and boom - every startup i get a 5-15 min. system hang because of the svchost.exe running 99% of CPU. it started on all the computers practically at the same time. all of them w2k or xp with sp2. I've watched processes and came to conclusion, that this problem is caused by automatic updates (well, at least in my case). I've turned off the automatic updates from the control panel, and svchost stopped eating my CPU's every start up. The reason of all that ... Heh, lets put this question to Microsoft...

[Dan]

I recently a clean install of windows xp on my main system. I reinstalled everything and installed SP2.Just after that I restarted the computer. After everything had loaded, suddenly the computer locked up. I quickly found svchost as the problem. I checked all of the modules loaded in svchost and all of them were free of viruses. This is not a virus in some cases but, a failure of the built in system update or other important system process. There are a couple articles on Microsoft's website that give some possible solutions. Svchost is important, the one that was giving me all the trouble had the kernel in it. The only way I was able to use my computer, was by killing the process. This apparently permanently disabled the firewall. My only choice was to reinstall windows, to fix the damage.

[Circus Monki]

I have a fresh install of XP and I still get the svchost.exe taking 100% CPU and blocks all new dll's/processes from starting up. It only happens if I have SP2 installed. I have also tried with different copies of XP and no success. Reinstalling windows does nothing for me. I couldn't find any viruses and the only way to use my computer was to open taskmanager (before svchost consumed 100% CPU) and close it down when it did.

BTW I could use programs that I had opened before svchost uses my CPU perfectly (unless an action opens a different process).

[Fred]

Ok, so what's the solution? I have 5 svchost running and one of them takes the 99% CPU usage. I downloaded a program called REGCURE which locks up my computer--avoid that one--and the problem remains. Apparently MS didn't think XP-Home should have a tasklist program so I can't even figure out what is causing the problem. Further, this is a widespread problem and everone who reports fixing it has a different solution.

what should I try?

[egas]

Folks, I too have been having the same problem!

I have done a fresh install on XP w/ SP2 on my laptop and still no success.

I read on this site
http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21379479.html
that this guy had some success.

SVCHOST is important. No doubt about that.
That this chap did was use this app http://www.sysinternals.com/Utilities/ProcessExplorer.html to see what services that particular instance of svchost was managing and then by trial and error found the trouble maker.

I haven't had the time to try this yet, but I pray that it works!

[mark]

I too have this svchost problem chewing away 100% of my CPU! Only recently reformatted the hard disk and put Win200 pro s/w on. Ran spybot and adaware, full virus check...nothing. i am certain it is linked to windows update. i cant even get to the windows update site. clicking on 'windows update' in control panel doesn't even open it so i cant turn it off. HELP!

[Barry Weintraub]

svchost.exe cpu 100% fix

I had this problem, checked the web, looked for viruses and called microsoft. Finally, I hypothesized that the problem was not something faulty or corrupt about svchost.exe -- it just had limitations. This elminated the problem.

1. Made sure that my bios was OK -- set it to a default state.
2. Defragmented my registry. (I used a program by uniblue registry booster which came with speedupmypc $29 total)
3. Defragmented my hard drive (which did need it)
4) just too be sure that the problem wasn't triggered by an outside hacker, put the windows firewall and my zone alarm firewall on max --I now use both firewalls despite recommendations that I should use only one of these firewalls.
5) I had been using goback (symantec's backup program) and windows system restore. I turned off ms system restore. Maybe the two backup program were trying to back up each other and creating an "infinite loop."

In short, I decided that cpu technology had not really evolved that much since the pentium 2 and that I would treat my 3.8 celeron processor with some kindness. BTW later adding a gig of ram to the 512 I had, didn't do anything about svchost.exe

Best to all.

Barry

[Big C]

I dont know if this will fix 100% cpu usage but it will stop the svchost.exe application error that kills your internet connection and your sound among other things
I actually found an even simpler way to fix this problem it was driving me crazy. All you have to do is
1.Go 2 the start menu
2.Right click "my computer"
3.Click "properties" then the "automatic updates"
tab
4.Choose "turn off automatic updates"
5.Reboot your computer
6.Go back to start menu and in all programs go to "windows update" you have to be connected to the internet.
7.Manually update windows.
8.Turn your automatic updates back on.
Thats it im running windows XP and after days of research thats what worked for me i actually found it on a website that makes you pay for answers to problems but my friend had a subcription that was years old but still worked.
Im no computer expert but i figure if this helps one person it was worth it for me to write this hope it helps c-ya bye!!!!

[MARK]

You may want to try something different. The svchost is a needed program, so that means some other program is calliong on its services to operate. Try this... go to www.download.com and download a program called Ad-Aware. Its free and I use it to maintain about 40 computers here at work. What i have found is that while surfing the net many site download trackers and trojans, this program will eliminate them. The second thing that you can do is get into your control panel and call up (click on)the "Internet Options" halfway down the fist page is a button that says "delete files" Click on that button, when the window opens chack on "delete all off line content" then click on "OK" ... this should solve about 98% of your problems... good luck and regards....... Mark

[kav]

Many thanks for this Bernie, hopefully it will help resolve the issue.

[john]

I followed the following URL from Microsoft, and fix my mother's PC.

http://forums.microsoft.com/WindowsOneCare/ShowPost.aspx?PostID=906329&SiteID=2

[gonczos]

Hey,
I had the following svchost.exe symptom: at startup it used 100% of my CPU resources for about 5 minutes.
I adopted Berniek's suggestion, and setting Windows(XP) automatic updates to "Notify me but do not automatically download or install them" seems to resolve the problem. (start menu/settings/controlpanel/automatic updates). Thanks Berniek!!!
Note: After reading various info about svchost.exe, I think removing it is a really BAD-BAD IDEA!!!.....grzz gonczos

[Messanger]

MS knows about this issue, but they said don't know how to fixes, NOW, they asking upgraded WSUS 3.0 will fix this problem. BAD BAD!!!

[Cho-Gaijin]

Yo, thanks for this, bro. I swear, I been goin through this same issue with XP, and recently had it with Vista. Though spyware aint my issue, this blog, and some of tha other comments helped me get it squared away.

[Shibaji]

Hi,

I have removed the temp1 and temp2 virus from my system, but now it looks for svchost.exe at startup. I need to clean the registry for this, there are legitimate svchost in registry, but there are illegitimate ones also, can anyone suggest which registry key I should delete to get rid of this permanently

[michael jones]

Thank you very much for the useful information! Antivirus programs are something essential for the computer security but we have to choose the right one because otherwise it will be useless!

[Registry Cleaner Reviews]

Hi, your post and comments helped me understand the problems on my computer. I am going to try n fix it. Thanks