Computer Support Forum

SvcHost: What is really running?

Question: SvcHost: What is really running?

Examination of my system during execution reveals that there are many processes (UserID: System) that are consuming memory, CPU cycles, and Disk I/O resources.

This also tells me that perhaps our buddys at Microsoft are logging things about our habits that I (perhaps others) would consider an invasion of privacy. For example, there is a hidden system file called $LOGFILE; that MS logs web sites you visit along with other stuff you wouldn't think MS would be interested in. $LOGFILE doesn't keep a big history, and is part of the hidden sectors at the beginning/ending/and middle of the disk, but it is sufficient to hold a good amount of data.

This brings me to my real question: How is it possible to determine exactly what is running on my system - specifically the threads that are launched/managed by SvcHost.EXE? (One such thread consumes more than 20MB RAM; performed more than 360M Writes; is running at highest priority; and was launched by the system).

I also know that some tasks may be launched, and their setting prevents any (standard?) visable means of detecting their presence. They are configured to hide themselves from the standard Windows Task Manager, process list.

This brings me to my next question: How can I see these "hidden" processes?

Thank you for any assistance you can provide in this area.

Relevance 100%
Preferred Solution: SvcHost: What is really running?

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: SvcHost: What is really running?

paranoid are we?

one good program to see all processes running is process explorer, from sysinternals.. http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

one that I just came across that shows hidden windows and processes is this..

http://www.brothersoft.com/Utilities_Miscellaneous_TaskManagerCS_17327.html

3 more replies
Relevance 46.33%

Hi Dear AllAnyone can help me to resolve the situation of takes up 100% CPU that windows running svchost.exeIt has the following symptoms:(1) The mouse pointer disappear.(2) System and applications hang out with no response at all.(3) Cannot access to internet.I have downloaded the ComboFix and run the program, the following is the log report.
 ComboFix.txt   17.14KB
  4 downloadsThanks for the quick reply gentleman.I think I can try to switch to safe mode and proceed as according to your suggestion. Actually I can access to internet in normal mode. The svchost.exe application running at the back and only sometimes it will take up to 80-90% in cpu usuage. I am using a very stupid method in frequently monitoring the task manager once the percentage boost up then I delete the task in order to lower down the workload. It works for sometime but then it happens again.There is also have another problem that sometimes windows will automatically shut down. It happens several times in the past few weeks.Should I switch to safe mode and perform the work in this situation? Can you tell me where I can download the RKILL application?Something weird comes up early today.I've run a full system scan with NOD32 antivirus program last night and nothing comes up in the report. A dialogue box from ESET pop up around 15 minutes later after I switch on the computer this morning and notify me the program did quarantine a file that carry trojan. The quarantine action per... Read more

Answer:100% CPU Use Up From Running SVCHOST.EXE

Hello , And to the Bleeping Computer Malware Removal Forum. My name is Elise and I'll be glad to help you with your computer problems.I will be working on your malware issues, this may or may not solve other issues you may have with your machine.Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen. Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.-----------------------------------------------------------If you have since resolved the original problem you were having, we would appreciate you... Read more

29 more replies
Relevance 46.33%

I have Windows xp installed on my system. I see around 9 processes of svchost.exe running on my system till today's date. Of which 4 svchost belong to SYSTEM, 2 of NETWORK SERVICE and 3 of LOCAL SERVICE as I see in the Task Manager.I am a knowledgible person and what solution u tell me i can understand.I scanned with Spyware Doctor's latest version, Avg anti-spyware's latest version and NOD32 anti-virus latest version, But didnt find anythng. So I used HijackThis and here is the log file of processes:Process list saved on 10:13:43 AM, on 12/4/2007Platform: Windows XP SP2 (WinNT 5.01.2600)[pid] [full path to filename] [file version] [company name]572 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation672 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation716 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation728 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation884 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation1052 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation1088 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation1440 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation1820 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 7.5.1.36 GRISOFT s.r.o.1872 C:\WINDOWS\System32\svch... Read more

Answer:Help: Too Many Svchost.exe Running

Hello distroyer,

Welcome to Bleeping Computer

There is nothing malicious in your log, and you do not have an unusual number of svchost.exe running. Lots of people have even more than that at one time, and I myself average at least 6. Not to worry.

Regards,
tea

2 more replies
Relevance 46.33%

Hello everyone, i have a little question, i have ADSL, using an ASUS modem, and i have like 7 svchost.exe's running, and i know svchost.exe is something needed for the internet, because when i end the process, my internet crashes, i don't really see many people with 7 running, usually 1 or so, so is there a way to fix this or is it needed for ADSL.

Any replies would be much appreciated, thanks!
 

Answer:7 svchost.exe's running

Probably perfectly normal. FYI, I happen to have 8 running right now, and there's nothing wrong with my machine.
 

1 more replies
Relevance 46.33%

Recently, I installed Foxit Reader, then decided I didn't like it. When I attempted to re-install, I received the error message that "the windows installer service could not be accessed." It was listed as running in the services applet of administrator tools, but would not work.

While then exploring the system, I found other things that wouldn't work--for example, audio, which is what put me on to the same problem last May--and others. I got many "class not registered" errors. SFC won't run. When booting to the CD and running SFC, I got the old message about a pending repair, although I can find no trace of one. Ran malware scanners, of course, and the system came clean. Defragged, did scandisk. Clean boot was not useful. Trying to do a repair in place results in the error message that setup can't find any information about the discs on the system.

The most significant thing I have found, which is probably at the root of this, is that in task manager, there are no instances of svchost running, unlike the usual ten or fifteen that normally run. In the services list, some services say they are running, but aren't. Windows audio is an example.

I had this problem in May, and ended up doing a complete re-install of Windows 7 Home Premium. I would like to avoid going through that again. It's difficult with visual impairment.

Thoughts?

Answer:No svchost running at all

My error; I had not ticked the box to show processes for all users. Svchost is indeed running and multiple instances are listed.
Then that makes the whole thing even dicier.

2 more replies
Relevance 46.33%

I was looking through my taskmanager and I noticed I have 3 different svchost.exe processes running at the same time. Is this draining my system performance or what does it mean?
 

Answer:3 svchost.exe's running?

I have the same thing, sometimes 4, sometimes only 2. They relate to what windows files are needed at the moment. Nothing wrong with it, and if you close them it generally reboots the computer.
 

3 more replies
Relevance 46.33%

ive just ecountered this... my computer just formatted but somehow theres lagg occuring here and there and when i opened the task manager, it shows cpu usage of 100% under svchost

ive read this solution but havent tried it due to some of the cmments posted says its not wrking --> http://www.technibble.com/how-to-fix...u-memory-leak/

i wud like to receive guidelines on how to solve this matter from you pros in this forum.... please help!!

More replies
Relevance 46.33%

Yesterday, I installed Foxit Reader, then decided I didn't like it. When I attempted to re-install, I received the error message that "the windows installer service could not be accessed." It was listed as running in the services applet of administrator tools, but would not work.

While then exploring the system, I found other things that wouldn't work--for example, audio, which is what put me on to the same problem last May--and others. I got many "class not registered" errors. SFC won't run. When booting to the CD and running SFC, I got the old message about a pending repair, although I can find no trace of one. Ran malware scanners, of course, and the system came clean. Clean boot was not useful.

The most significant thing I have found, which is probably at the root of this, is that in task manager, there are no instances of svchost running, unlike the usual ten or fifteen that normally run.

I had this problem in May, and ended up doing a complete re-install of Windows 7 Home Premium. I would like to avoid going through that again. It's difficult with visual impairment.

There is one potential similarity to now and the situaton in May, other than the symptoms described above. In May, I had tried installing a new nvidia card, which Windows wouldn't recognize, so I took it out and when I booted back to Windows, the above symptoms appeared. Yesterday, I saw in event viewer a dcom error, which traces back to the nvidia updatus "user."

Though... Read more

Answer:No svchost running at all

  
Quote: Originally Posted by Cruncher665


Yesterday, I installed Foxit Reader, then decided I didn't like it. When I attempted to re-install, I received the error message that "the windows installer service could not be accessed." It was listed as running in the services applet of administrator tools, but would not work.

While then exploring the system, I found other things that wouldn't work--for example, audio, which is what put me on to the same problem last May--and others. I got many "class not registered" errors. SFC won't run. When booting to the CD and running SFC, I got the old message about a pending repair, although I can find no trace of one. Ran malware scanners, of course, and the system came clean. Clean boot was not useful.

The most significant thing I have found, which is probably at the root of this, is that in task manager, there are no instances of svchost running, unlike the usual ten or fifteen that normally run.

I had this problem in May, and ended up doing a complete re-install of Windows 7 Home Premium. I would like to avoid going through that again. It's difficult with visual impairment.

There is one potential similarity to now and the situaton in May, other than the symptoms described above. In May, I had tried installing a new nvidia card, which Windows wouldn't recognize, so I took it out and when I booted back to Windows, the above symptoms appeared. Yesterday, I saw in event viewer a ... Read more

3 more replies
Relevance 46.33%

hey guys. i know to have a couple svchost.exe's running in the task manager is normal, but i have 14. It is really slowing down my computer and i dont know what to do about it. anyone have any ideas? and yes, i have scanned my computer with adaware and spybot. here is my hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 6:40:18 PM, on 4/7/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Function Key Controller\FKC.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alienware.com/Mothership...%&ai=636E3D34313433323926706F3D34383234323541
R1 - HKLM\Software\Microsoft\I... Read more

Answer:14 svchost.exe's running

anyone?
 

1 more replies
Relevance 46.33%

I was looking through my taskmanager and I noticed I have 3 different svchost.exe processes running at the same time. Is this draining my system performance or what does it mean?
 

Answer:3 svchost.exe's running?

I have 5 - it is normal in most cases
 

2 more replies
Relevance 46.33%

I wanted to look and see what services or processes svchost.exe is running. What commands or steps must I take to get there? I am currently running Win XP with SP2 and is up to date with microsoft. Thanks for the help.

- Courtanee
 

Answer:Looking up what svchost is running?

Btt
 

2 more replies
Relevance 46.33%

Hey,
I have two hard drives on my PC. I was recently infected with (I think) some form of Virtumonde. I formatted and reinstalled my C: drive + and OS (windows XP). I left the E: drive because it is my backup drive.

Now, I still have 5 svchost.exe's running, (only is using 30,000kb memory - the highest memory hogging process on my PC!) even though the OS has been reinstalled.

Could the virus has infected my E: drive and survived? Isit normal to have so many svchost.exes and for one of them to be using so much memory?

Thanks

Answer:5 Svchost.exe's Running?

Svchost.exe is a generic host process name for a group of services that are run from dynamic-link libraries (DLLs) and can run other services underneath itself. This is a valid system process that belongs to the Windows Operating System which handles processes executed from DLLs. It runs from the registry key, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost where details of the services running under each instance of svchost.exe can be found. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. It is not unusual for multiple instances of Svchost.exe running at the same time in Task manager in order to optimize the running of the various services. svchost.exe SYSTEM (there can be more than one listed)svchost.exe LOCAL SERVICEsvchost.exe NETWORK SERVICE (there can be more than one listed)Each Svchost.exe session can contain a grouping of services, therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. The process ID's (PID's) are not static and can change with each logon but generally they stay nearly the same because they are running services all the time. The PID's must be checked in real time to determine what services each instance of svchost.exe is controlling at that particular time. Determining whether a file is malware or a legitimate pro... Read more

1 more replies
Relevance 46.33%

I have 4 of them running in total, this seems quite strange, is it?
 

Answer:svchost? How many should I have running?

9 more replies
Relevance 46.33%

While I am thinking about it I wanted to ask about this one as well.

I have a Windows 7 pro 64bit system with single core Sempron CPU and 2GB DDR2 RAM. This is primarily used as a gateway (the sprint air card I currently use is not compatible with PFSense, and my Cradlepoint router is not working correctly).

Every so often CPU usage will spike, and after several hours drop back. The process that is hitting it is an SVCHost process, and I have been unable to track down the cause. Though this is not really a big deal for what I am using the system for, I would like to have it resolved for when I am able to get some upgrades to expand it's functionality.

I have included the handles associated with this instance of the process.

Code:
Process: svchost.exe Pid: 1468

Type Name
ALPC Port \RPC Control\LRPC-68eea12945b9373a9e
ALPC Port \RPC Control\OLE9E9831D85FF34F39BBDB0135D9F2
ALPC Port \RPC Control\wcncsvc.wcnprpc
ALPC Port \RPC Control\wcncsvc.transport
Desktop \Default
Directory \KnownDlls
Directory \BaseNamedObjects
Event \KernelObjects\MaximumCommitCondition
File C:\Windows\System32
File \Device\KsecDD
File \Device\Nsi
File \Device\Http\ReqQueue
File \Device\Http\Communication
File \Device\Http\Communication
File \Device\Http\ReqQueue
File \Device\PcwDrv
File C:\Windows\System32\en-US\KernelBase.dll.mui
File \Device\Afd
File \Device\Afd
File \Device\Afd
File \Device\Afd
File \Device\Afd
File \Device\Afd
File \Device\Afd
File \Device\Afd
Fil... Read more

Answer:SVCHOST running CPU at 100%

Bump
 

3 more replies
Relevance 46.33%

Hi! Im not having a direct problem, yet, but as far as I'm concerned it's never healthy to have several processes of the same name running at the same time. I could be wrong but i wanted to this check with you guys. The thing is that i have 7 Svchost.exe's running simultaneously in the Windows Taskmanager process list. I've read on process information sites that Svchost.exe is a Windows process but that it can also be a trojan or backdoor for attackers to use. So what do you guys say? Is it really okay to have 7 svchosts at the same time? Is there any way to check if they are more than just windows processes? Thanks for any help
 

Answer:Several Svchost.exe's running..

6 more replies
Relevance 46.33%
Question: svchost running??

I have just checked windows task master and found SVCHOST.EXE in the process tab5 times should this be as is ???? or is there something wrong ????postie

Answer:svchost running??

This is normal. It is a Windows process and therefore nothing to worry about! If you want to find out more just type 'svchost.exe' in Google. CW

1 more replies
Relevance 46.33%

Running Windows XP Pro. Checked my Task Manager. Found 4 "svchost.exe" running:scvhost.exe - local service - 2,296kscvhost.exe - network service - 2,064kscvhost.exe - system - 11,940kscvhost.exe - system - 2,748kIs this right? 4 applications with the same name running?Someone please help ...

Answer:svchost.exe - how many should be running?

I've got 4 running as well....not anything to worry about....have a look here click here;en-us;314056

2 more replies
Relevance 46.33%

My computer has been doing some strange things recently.First thing it did was open a new browser window which told me that browsing porn sites had given me viruses and I should use this free webscan to fix them.I ignored it, closed the window, and ran virus scans since I'm not completely daft.Since then, my (one of) Svchost has started to run at maximum CPU usage on startup, and my sound has completely gone.I reinstalled drivers and codecs, but I no longer recieve sound from anything other than system warnings (the dings and error sounds).I have run Symantec virus scans, Adaware scans, Spybot scans, and updated my SpywareBlaster. Temp files have been cleaned and I have even performed a registry cleanup (which was long overdue). I have uninstalled a lot of unused programs, and deleted a few gigabytes of old data that was wasting space. I've run HijackThis and removed a few startup entries that I know were safe to get rid of, and nothing has fixed my problem.So in lieu of a format/reinstall of windows, I figure I'll let the experts have a look at my log.For the record, I have had zero success in getting to Safe mode on my computer, and I do not know why. F8 will not give me the options menu on bootup, and there doesn't seem to be any other way to get to it.Anyway, here is my log:Logfile of HijackThis v1.99.1Scan saved at 1:50:49 AM, on 28/05/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16441)Running processes:C:\WINDOWS\Syste... Read more

Answer:Svchost Running At 99% Cpu

1. Download this file - combofix.exe2. Double click combofix.exe & follow the prompts.3. When finished, it shall produce a log for you. Post that log in your next reply with a new hijackthis log.Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

12 more replies
Relevance 46.33%

OK, so I have a littany of problems right now with my computer:

Mainly, the problem is that my SVChost usually runs taking up nearly 100% of my computer. The svchost that takes up this space is running 25-30 processes on the computer, all of which (at least to me) are valid or minimally appear to be valid. I can't figure out which process specifically is hogging up all the memory, but this instance of svchost is taking up to 500 MB. This causes my computer speed to be very slow and/or crash. The path for this svchost is system32, so it seems I don't want to delete it and from looking at these services I need many of them...

Other problems I've had:

Cannot do system restore
Computer usually fails to shut down unless I manually turn it off (hold power button for ~10 seconds)

WinPatrol (and AVG) keep barking at me telling me I have new programs to start up that I don't actually want to run. Some of these are in System32. Interestingly, usually once WinPatrol barks at me my svchost stops running at 100% (until next restart) and my computer seems to operate fine (though there's probably something bad going on).

Log files and such attached (also attached a hijackthis log, dunno if you need it or not).

Answer:svchost running at 100% (sometimes)

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links.Link 1Link 2Link 3 1. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the r... Read more

14 more replies
Relevance 46.33%

Hi - I posted this in the Windows XP forum, and after I ran a Microsoft Security Essentials scan, MalwareBytes Scan and a SuperAntiSpyware scan, I'm still having the same problem. The SvcHost is for the wuauclt.exe program, per ProcessExplorer.

A member is wanting to rule out Malware, though I think it was caused from a Windows Update. He wanted me to post here and reference my original thread: http://www.bleepingcomputer.com/forums/topic425898.html/page__gopid__2461747#entry2461747

I have a demo I need to do on this laptop Friday, so I'm praying that I can get this resolved before then. Thank you in advance for any help you can provide.

Answer:SvcHost is running the CPU at 100%

Hi - I know you guys don't like bumping threads, but I haven't gotten a response for help in over a week. I really need to resolve this so I can get back to work. Please help!
Thanks,
Ken

19 more replies
Relevance 46.33%

Hello friends again.

I have been observing what i believe an extreme memory comsuption my just one of the many svchost.exe processes, that one is never below ~100.000K and sometimes goes well above the ~150.000K

Wonder I, it is that normal (Windows 7 Home Premium)

I have runned several times NOD32 Internet Security, last version and updated, adware, spybot, registry cleaners and what I could imagine, but none finds noting at all.

You tell me.

Thakns for your time.

Answer:svchost.exe "running in the sky"

Welcome aboard Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspxUnzip ProcessExplorer.zip, and double click on procexp.exe to run the program.Click on View > Select Colunms.In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.Go File>Save As, and save the report as Procexp.txt.Attach the file to your next reply.

3 more replies
Relevance 46.33%

I went ahead and ran task manager and I notice that I had eight SVCHOST.EXE running in the back round.
Four under user name as SYSTEM
Two under user name as NETWORK
Two under user name as Local Service
Is this normal?
please help.

Answer:How many SVCHOST.EXE should be running?

Quote:





Originally Posted by pacoloco2k


I went ahead and ran task manager and I notice that I had eight SVCHOST.EXE running in the back round.
Four under user name as SYSTEM
Two under user name as NETWORK
Two under user name as Local Service
Is this normal?
please help.





Hi. . .

I noticed the same thing a year ago - 13 svchost.exe 's running. This is completely normal whether in XP or Vista. Here is an explanation from the how-to-geek:

http://www.howtogeek.com/howto/windo...is-it-running/


regards. . .

jcgriff2

2 more replies
Relevance 46.33%

Hi to all,,
the installed windows seven is much older and sick, that's why I install a fresh copy of windows seven today, its work fine,, but when I open the task manager and its Process tab, its full of services specially svchost.exe. although I didn't install too many applications. I just install K-lite codec pack, Kmplayer, MS security Essential, IDM, Fire Fox, win rar, Utorrent and folder lock.
in previous installed, the Process tab it just had few services,
why is that,, pls reply me soon, because its very discomfort to me..
here is my tast manager Process tab screen shot..

Answer:Many svchost.exe running, plz help soon.

oh God,, its solved just unchecked an option,, sorry guys...

4 more replies
Relevance 46.33%

I have ran malwarebytes, cccleaner, and I have McAfee Security center and ran scans with all of the above. But I still have several svchost.exe instances running under windows task manager processes. IE8 and other apps are running very slow, so I think I still have and infection. I have attaced my hijackthis text file. Thanks!

Answer:Several svchost.ext running

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.Please download OTL from following mirror:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.Push the button.Two reports will open, copy and paste them in a reply here:OTL.txt <-- Will be openedExtra.txt <-- Will be minimizedIn the upper right hand corner ... Read more

2 more replies
Relevance 46.33%

Hi when playing games on my laptop it freezes alot, checked what task manager is showing and i can see 11 svchost.exe running when idling if i view the procces running for all users is this correct?
The laptop is using 55% of physical memory just when idling
 

Answer:11 svchost.exe running

svhost is a normal windows process. I have 11 running as well.

You most likely are overheating/have a rogue.

Do a full scan with malwarebytes
 

2 more replies
Relevance 46.33%

In XP home, system very slow, svchost is using 100% cpu. Can someone point me in the right direction please.

Answer:svchost running 100%

You need to go in the direction of running an anti-virus scan and also an anti-spyware scan. Download, install, update and run a scan with SuperAntispyware click here and Adaware click here

2 more replies
Relevance 46.33%

xp home, browsing the ctrl+alt+del (wtm) page and I COUNT 7 SVCHOST.exe RUNNING simultaneously.... 4 under system, 1 under local service, and 2 under network service...  i have DSL t1 thru AllTel... this cant be normal.. is it normal? virus check programs seem to think its normal. anybody else find this "7 svchost.exe" thing a bit fishY??? thanx

Answer:SVCHOST.EXE-- why 7 running at once???

Actually svchost.exe is a program that will launch other programs as a service. That you have multiple sessions is not a cause for alarm. If you want to be sure. Try using microsoft anti-spyware tool. The MS tool somewhat explains running services or at least finds the program using it.There are tools to monitor / trace or explain the complete services. Pprocexp.exe from Sysinternals does the job fine!

1 more replies
Relevance 46.33%

hey guys. i know to have a couple svchost.exe's running in the task manager is normal, but i have 14. It is really slowing down my computer and i dont know what to do about it. anyone have any ideas? here is my hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 6:40:18 PM, on 4/7/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16386)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Function Key Controller\FKC.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\notepad.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.alienware.com/Mothership...%&ai=636E3D34313433323926706F3D34383234323541
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.alienware... Read more

Answer:14 svchost.exe's running

11 more replies
Relevance 46.33%

Yesterday, I installed Foxit Reader, then decided I didn't like it. When I attempted to re-install, I received the error message that "the windows installer service could not be accessed." It was listed as running in the services applet of administrator tools, but would not work.

While then exploring the system, I found other things that wouldn't work--for example, audio, which is what put me on to the same problem last May--and others. I got many "class not registered" errors. SFC won't run. When booting to the CD and running SFC, I got the old message about a pending repair, although I can find no trace of one. Ran malware scanners, of course, and the system came clean. Defragged, did scandisk. Clean boot was not useful. Trying to do a repair in place results in the error message that setup can't find any information about the discs on the system.

The most significant thing I have found, which is probably at the root of this, is that in task manager, there are no instances of svchost running, unlike the usual ten or fifteen that normally run. In the services list, some services say they are running, but aren't. Windows audio is an example.

I had this problem in May, and ended up doing a complete re-install of Windows 7 Home Premium. I would like to avoid going through that again. It's difficult with visual impairment.

Thoughts?

Answer:No svchost running at all

My error; I had not ticked the box to show processes for all users. Svchost is indeed running and multiple instances are listed.
Then that makes the whole thing even dicier.

14 more replies
Relevance 46.33%

I have windows XP and in the task manager I have multiple SVCHost running at once. They seem to be taking up a lot of CPU. Is there anything I can do to cut some out....or are they all needed? Thanks for your thoughts!!!

Answer:To many Svchost running....??

I have 6 running...as far as I remember, they are supposed to be there. They shouldn't be using too much cpu, but mine uses like 14k of memory.

But they are a system file, so don't stop them.

4 more replies
Relevance 46.33%

I have three Svchost.exe 's running when I open my windows task manager and they are really eating up my resources...1st one says "System" and is using 4,268K...2nd one says "Local Service" and is using 3,548K..and the 3rd one says "Network Service" and is using 1,924...My question is, do I need all three of these running & if not, how do I go about removing them or atleast disabling them?
Thanks!
 

Answer:Svchost.exe..Do I need all three running?

Those are system files so you do need them.

In any case, that's not a lot 1,024K is 1Mb
 

2 more replies
Relevance 46.33%

Hi there,

I have a problem concerning some processes running at 99% of my CPU.
I posted this at the McAfee forum because most of the time it's SVCHOST.exe causing the problems, but sometimes it's btsendto_explorer.exe causing the problem, and i found info about it on a McAfee forum.

I refer to http://forums.mcafeehelp.com/viewtopic.php?p=473360#473360

I recently recovered my laptop to factory settings, installed Microsoft Office 2003, and started doing Windows Updates untill no essential updates were found anymore.
Then i installed McAfee Internet Security 8.0. After that, when my laptop starts, after a minute or so, SVCHOST.exe starts taking 99% of my CPU.
Disabling McAfee Privacy service, or disabling auto windows updates, or installing version 3.0 of Windows Installer and executing a patch afterwards didn't help.

The McAfee guys told me to perform a hijack this scan and post the log here.
Can anyone help ?

This is my log:
Code:
Logfile of HijackThis v1.99.1
Scan saved at 19:05:12, on 21/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\P... Read more

More replies
Relevance 46.33%

Recently, I installed Foxit Reader, then decided I didn't like it. When I attempted to re-install, I received the error message that "the windows installer service could not be accessed." It was listed as running in the services applet of administrator tools, but would not work.

While then exploring the system, I found other things that wouldn't work--for example, audio, which is what put me on to the same problem last May--and others. I got many "class not registered" errors. SFC won't run. When booting to the CD and running SFC, I got the old message about a pending repair, although I can find no trace of one. Ran malware scanners, of course, and the system came clean. Defragged, did scandisk. Clean boot was not useful. Trying to do a repair in place results in the error message that setup can't find any information about the discs on the system. Sysinfo also produces errors, but not info.

The most significant thing I have found, which is probably at the root of this, is that in task manager, there are no instances of svchost running, unlike the usual ten or fifteen that normally run. In the services list, some services say they are running, but aren't. Windows audio is an example.

I had this problem in May, and ended up doing a complete re-install of Windows 7 Home Premium. I would like to avoid going through that again. It's difficult with visual impairment.

Thoughts?
 

Answer:No svchost running at all

8 more replies
Relevance 46.33%

Have 14 svchost's running, why? & what do they mean?

What are they controlling "above the code & hdwe?" I chk'd out the tutorials on svchost host as to what svcs I 'do not need or can stop to free up mem to no avail.

Just looking for some "guidance" like if you have BP 175/120 you have hi BP?
Or if you're going 75mph in a 50mph you're going to get a ticket.

As I'm not a tech, I may have to provide more info if required which I'll do.

Below is an image of my 14 svchost's.

Answer:Have 14 svchost's running, why? & what do they mean?

Each instance of svchost.exe hosts one or more system services. It is not unusual to have 14 or even more instances. What you are seeing is normal and no cause for concern.

9 more replies
Relevance 46.33%

Hi All,
 
i have over 30 computer in the networks running svchost.exe at 99%, so the computer ther going relly slow, i did some research about the issue but no luck to fix it, i did scan for viruses spyware, u name it i look it for it, also i tried the  patch for windows XP Pro "IE8-WindowsXP-KB2870699-x86-ENU" still same issue, when i did check what svchost.exe running ther all related to the network withe the deployment service we use "Altiris" the rest of computer ther running the same services with less the 2% CPU.
Thank u all for any help 

Answer:svchost.exe running 99%

try doing a system restore to an earlier date on one of the systems, before this occurred

10 more replies
Relevance 46.33%

how many svchost.exe should there be running

Answer:how many svchost.exe should be running

Hi -

There is no fixed number, but it is not uncommon to have 12+ svchost.exe running at one time. There are 15 running on this system right now.

svchost.exe = Service Host = runs multiple system services under one umbrella as not all services are active all the time.

Regards. . .

jcgriff2

`

1 more replies
Relevance 45.92%

I need to know if this is normal to have so many svchost.exe running, its taking up alot of ram. My avg found earlier that about 9 or so svchost.exe are rootkits but it did not delete them, and warns me if i try do. also sometimes my internet gets really slow, and the network usage in task manager is at like max 1 percent so the internet must be restricted.Below is a screenshot of my taskmanager with the svchost.exe

Answer:Alot of svchost.exe running

LOL...no, that's not normal at all.I currently have 8 and that's the most I've ever seen on this system.The normal ones are the ones with System, Network Service, or Local Service as the user.I think I'd try to find out what all those others are...seems as if they are all installed programs.A tool you might use, http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspxLouis

3 more replies
Relevance 45.92%

Hi eveyone!

I googled a lot about this matter, but still dont know the clue.

I also find here a thread:
http://forums.techguy.org/windows-7/1011182-svchost-exe-high-usage-slow.html
I have the exact same problem like this guy. But I did not find the solution there.

I have the HJM logfile, that showed nothing problem.

Process explorer and task manager shows, that is consumes 190 mb memory.

Since I am a new member, I cannot contact "monkeyDLuffyPK" the previous thred starter.

If anyone knows how can I stop it the process, or what is means, it would be a huge help.

Kind regards,
Frank.
 

Answer:SVCHOST.EXE is running high

16 more replies
Relevance 45.92%

 I have found a thread for this but its from around 3 years ago and some of the images are missing.
 
My svchost is running at 99/100% and causing the computer to lag. Can anybody please help me with this so I can get another couple of months life out of this computer before I have enough money to upgrade to a newer model also to take off all the files that are on it.
Many thanks 
Marie
 task manager.jpg   61.93KB
  0 downloads

Answer:Windows xp svchost exe running 99%

Please download MiniToolBox  , save it to your desktop and run it.
 Checkmark the following checkboxes:  List last 10 Event Viewer log  List Installed Programs  List Users, Partitions and Memory size.
 Click Go and paste the content into your next post.
 Also...please Publish a Snapshot using Speccy,  taking care to post the link of the snapshot in your next post.
   Go to Piriform's website, and download the free version on the left.  Click Download from Piriform.com (the FileHippo link requires an extra click). Or if you want to use a portable version of Speccy (which doesn't require installation), click the builds page link and download the portable version. You will now be asked where you want to save the file. The best place to put it is the Desktop, as it will be easy to find later.
    After the file finishes downloading, you are ready to run Speccy. If you downloaded the installer, simply double-click on it and follow the prompts until installation is complete. If you downloaded the portable version, you will need to unzip it before use. Right-click the ZIP file and click Extract all. Click Next. Open up the extracted folder and double-click on Speccy.
 
     Once inside Speccy, it will look similar to this (with your computer's specifications, of course):
     Now, at the top, click File > Publish Snapshot. You will see the following prompt:
 &#... Read more

3 more replies
Relevance 45.92%

I'm looking at the running processes on a Dell Inspiron 6000 and it shows 7 instances of svchost.exe running. Is this normal? I think the system is clean, but maybe there are some bugs I missed?!?!?

Thanks guys (and gals)
 

Answer:Why do I have 7 svchost.exe processes running?

manard,

Here's a good article on svchost, you probably don't have a problem although there are some badware that may use this program.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/
 

4 more replies
Relevance 45.92%

hi only a minor problem but when i look at running proccesses i have about 7 or 8 svchost.exe running. To me that seems to many and probably slows my pc down. any ideas what to do?

Ill post a log latter
 

Answer:Multiple svchost.exe running

Its very normal with windows xp, to know more about svchost.exe read this article.

http://support.microsoft.com/?kbid=314056
 

2 more replies
Relevance 45.92%

No wonder I keek getting high memory usage errors. I've just checked my PC and there appears to be 16 versions of svchost all running at the same time. Any ideas?

Answer:why do i have 16 instances of svchost running

That's quite normal; nothing to worry about. Your errors are down to something else. Where do these errors occur, what is the exact message, and how much RAM do you have?

11 more replies
Relevance 45.92%

woke my LT form hib and the svchost was hogging cpu. Had this problem b4, abri help solve the problem by a cut a paste of 2 files. Been a few months. Tried stopping processes w/ PE, but they keep coming back. The programs used do not seem to be effected when they are shut down. Can I eliminate them completely?
 

Answer:svchost running in circles

Welcome to Major Geeks!


You need to be more specific as to what programs you are referring to and the processes associated with them.

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

If something does not run, write down the info to explain to us later but keep on going.
Do not assume that because one step does not work that they all will not.
READ & RUN ME FIRST. Malware Removal Guide

Notes:
If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools on another PC and burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

 

1 more replies
Relevance 45.92%

My svchost.exe starts growing and gets to over 170k then starts bottling up the rest of the processes. If I kill it all is OK but then I can not get my network to see others in my Workgroup. So I think I have a problem with the network svchost. Can anyone read the Hijack log and point me to something more specific I can fix?

Logfile of HijackThis v1.99.1
Scan saved at 9:37:10 AM, on 4/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\netdde.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\LogMeIn\LogMeInSystray.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\LogMeIn\RaMaint.exe
C:\Program Files\Windows Media Player\WMPNSCF... Read more

More replies
Relevance 45.92%

I have 11 instances of svchost running on my computer, which I scan regularly with AVG and Superantispyware (I have the paid version of SAS). I also run CCleaner once or twice a week.

After reading this thread I ran a search of my hard drive, which found no instances of the file.

I also googled svchost and found this procedure for fixing the problem but thought it would be wisest to check here before doing anything.
 

Answer:Ten instances of SVCHost running.

Hi

What Windows version and Service Pack (if applicable) are you using?

svchost.exe if spelled correctly like this is finem its a normal service and in the likes of Vista and Windows 7 there can be any number of them, I have 13 running at present, they all do different tasks.

A quick rundown of that svchost is here http://support.microsoft.com/kb/314056 and Here http://blogs.msdn.com/b/larryosterman/archive/2005/09/09/463018.aspx

Is svchost causing your CPU to be at 100% usage (look in Task Manager)? if not then its running fine.
 

29 more replies
Relevance 45.92%

I have 10 copies of svhost.exe running in processes. Have tried hijack this, and hasn't helped. what can I do about this???? please help!!!
 

Answer:10 SVCHOST.EXE running in processes

Closing duplicate.

Please do not start more than one thread for the same issue.
 

1 more replies
Relevance 45.92%

I have about 15 svchosts running in task manager. It hogs up about 200mb of RAM or so, and I was wondering why it was so much.It's not a virus either, unless its a virus thats undetectable and all it does is lag your computer.

Answer:Why so many svchost tasks running?

You know what I would also love to find out I have like 11 myself

4 more replies
Relevance 45.92%

My laptop seems to be seized up.  I can't seem to open or run anything and I open task manager and see svchost.exe is using up 100% of my cpu.
 
I treid ending the process and that didn;t allow me to open anything wither. It will start to open IE but it just shows a black page saying "conecting" but never gets anywhere.
 
This is an older Compaq Presario R3000 running Win XP sp 3.
 
I can't even run malware bites or and antivirus program.
 
 

Answer:svchost.exe running all the time

It could be doing Windows Updates at this time.

30 more replies
Relevance 45.92%

In the past few days the laptop's svchost.exe has been chewing up cpu at 40-50% on a continuous basis.
 
I became aware of it because my cooling fan is running all the time. I explored it with  "process explorer" and it showed that the culprit is the svchost.exe.
 
I  unsuccessfully tried killing the app. The PC informed me that the app could not be accessed (or found) for that matter.
 
I also have noticed that on different startups, the TID is different and that the CSwitch Delta is constantly changing.
 
Whereas yesterday the PID was 296, today it's 472 (host process for windows)!! Yesterday there was a ntdll.user thread - today the address is 0x0!!
 
I ran MalwareBytes (real time protection) yesterday and it found one PUP which it quarantined.
 
I have no idea what to do and any help would be greatly appreciated.
 

 
 

 
 
   

Answer:svchost running at 40-50% continually

Welcome aboard   Download Security Check from here or here and save it to your Desktop. Double-click SecurityCheck.exe Follow the onscreen instructions inside of the black box. A Notepad document should open automatically called checkup.txt; please post the contents of that document.NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.Make sure the following options are checked:
Internet ServicesWindows FirewallSystem RestoreSecurity Center/Action CenterWindows UpdateWindows DefenderOther ServicesPress "Scan".It will create a log (FSS.txt) in the same directory the tool is run.Please copy and paste the log to your reply. Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList Winsock EntriesList last 10 Event Viewer logList Installed ProgramsList Devices (do NOT change any settings here)List Users, Partitions and Memory sizeList Restore PointsClick Go and post the result. Please download Malwarebytes Anti-Malware (MBAM) to your desktop.NOTE. If you already have MBAM 2.0 installed scr... Read more

8 more replies
Relevance 45.92%

I have noticed for the past 3 days my CPU Usage has been at 100% Using XP Pro.
I ran some ad ware software to find all the junk (spy bot and Ad-Aware) but I am still pinned at 100% cpu usage. Anyone have any ideas how to find out what is running?
I see that svchost.exe is using a ton of cpu. How can I stop it safely and how do I know if it's a virus or just something else?

Thanks in advance
Steve

Answer:svchost.exe running wild

disable Windows Update Automatically

go to My Computer, Control Panel, Automatic Updates, change the thing to something else...

5 more replies
Relevance 45.92%

Hi
Multiple copies of svchosts are running on my machine. I recently installed Daemon tools, Power ISO and utorrent on my machine. Please help.. I am pasting the hijack this and silent runners log file. Thanks for all your help..

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:34:28 PM, on 8/19/2007
Platform: Windows Vista (WinNT 6.00.1904)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Creative\SBAudigy\Volume Panel\VolPanlu.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\PROGRA~1\NORTON~1\NORTON~1\navw32.exe
C:\Program Files\uTorrent\utorrent... Read more

Answer:10 copies of svchost.exe running

Hi,

Can some one please help me with this.. following what is done in other threads i am pasting the Kaspersky scan report.. Can some one please help!!!!



-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, August 20, 2007 9:02:00 AM
Operating System: Microsoft Windows Vista Home Edition, (Build 6000)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 20/08/2007
Kaspersky Anti-Virus database records: 385330
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
H:\

Scan Statistics:
Total number of scanned objects: 99821
Number of viruses found: 2
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 02:27:43

Infected Object Name / Virus Name / Last Action
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\NFWEVT.LOG Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked ... Read more

7 more replies
Relevance 45.92%

In Process Explorer I see 70 (yes seventy) instances of svchost.exe running.
some have threads (like ipoint.exe, itype.exe,..) which is OK, but most are not threaded.
The system poses no problem and works fine (CPU use is zero)
Is there a reason for that large number of svchost.exe instances and what causes it?
Can or should anything be done?
thanks for any answer,
gabri?l

Answer:Number of svchost.exe running

It is normal

Tip of the Day: SvcHost Service Refactoring in Windows 10 v1703 Tip of the Day

3 more replies
Relevance 45.92%

Hello,
I am having problems with svchost.exe file running at 40-50% all the time. I've traced problems with Windows Firewall not starting and BITS not starting and netman.dll restarting constantly. I cannot figure out what services are not enabled that need to be running. I have run PC Fix from microsoft and that was completely useless. I am running Windows XP Professional with SP3 and all latest updates. I have onboard NIC which never shows up in Network Connections. I have been spinning my wheels on this for many months now and still no closer to fixing the problem.
Please help!!!
 

Answer:svchost.exe running at 50% all the time

14 more replies
Relevance 45.92%

ok so recently i been wanting to get my desktop fixed to play some new games at high detail that my lap top wont be able to handle.
What i have tried so far is:
1. PC tools Registry cleaner
2. Updating my computer
None of them worked, all tho my computer feels a little faster.
My friend told me to DL Hijack this and post it some place for some one to help, so here i am looking for your help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:54 PM, on 9/27/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16890)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\hp\KBD\kbd.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Registry Mechanic\regmech.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=548... Read more

More replies
Relevance 45.92%

I have recently noticed that my computer is running from 16 to 18 different processes of svchost at once, and without running any programs uses 30% of my RAM.



That screenshot was taken when running nothing but Opera.

I have scanned my computer with MalwareBytes and Kaspersky but neither found anything.

Any solutions/explanations?

Answer:16+ svchost.exe processes running

Hi, welcome to the forums

I think that's normal as I have 11 at the minute and it increases/decreases as certain services are used or stopped.


OS

4 more replies
Relevance 45.92%

In Process Explorer I see 70 (yes seventy) instances of svchost.exe running.
some have threads (like ipoint.exe, itype.exe,..) which is OK, but most are not threaded.
The system poses no problem and works fine (CPU use is zero)
Is there a reason for that large number of svchost.exe instances and what causes it?
Can or should anything be done?
thanks for any answer,
gabri?l

Answer:Number of svchost.exe running

It is normal

Tip of the Day: SvcHost Service Refactoring in Windows 10 v1703 Tip of the Day

more replies
Relevance 45.92%

HI, I had a problem with my svchost about a month ago. it was running at about %100. My computer did a Microsoft update and the problem was fixed(or so I thought). Now it's doing it again. My laptop is extremely sluggish unless I go into the Task Manager and end the process. I only have 6 svchost processes running( which I didn't think was too many). I have taken the steps given to remove or fix the problem. Nothing has worked. Now I have read the instructions given and installed HJT in my program files and renamed it. Can someone please take a look at the attached file and tell me if they recognize something that shouldn't be there. I really appreciate anyone's help in this matter. THANK YOU !
 

Answer:svchost is running at almost %100 cpu usage. Can someone please help?

Many times when svchost is eating up CPU time, it is not due to malware. They only way for us to be able to exclude malware is for you to run our full malware cleaning procedure given below. HijackThis logs are not adequate by themselves. And your HJT log is even a prime example of that statement. Your log shows no problems at all. If I went totally based on your HJT log, I would already be sending you off to the Software Forum. That could still happen, but if it does, at least you will know you are malware free.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
Make sure you check version numbers and get all updates.
Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
Downloading, Installing, and Running HijackThis​Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some... Read more

1 more replies
Relevance 45.92%

Hello! This is my first time using this forum and I hope that someone will be able to help me out. I believe that I have some kind of bug in my system I am not sure. My computer is slowing down on me because I have svchost.exe and ieplore.exe constantly running on my system. Can someone please help!

Shawn (sel311)
 

Answer:svchost.exe and ieplore.exe always running

That sound normal.
What are your system spec?
How much ram, CPu, Harddrive size and space available.
What is the paging file size?
What application load at startup?
 

3 more replies
Relevance 45.92%

Ok, I've come here from the "Security>Am I infected" forum. Topic referenced is here: http://www.bleepingcomputer.com/forums/t/237380/not-sure-what-im-infected-with/ ~ OB I am not sure what I have but here are some symptoms:No sound with youtubeCertain malware programs don't openFirefox won't openInternet stops working after a whileMultiple svchost.exe errorsThere are others, but these are the first ones I can think of. Any and all help would be appreciated. Thanks!!!DDS (Ver_09-03-16.01) - NTFSx86 Run by hfgjgg at 9:01:23.32 on Fri 07/03/2009Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_14Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2047.1636 [GMT -4:00]============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exesvchost.exesvchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Seagate\SystemTray\StxMenuMgr.exeC:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exeC:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXEC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\AIM6\aim6.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Do... Read more

Answer:Multiple svchost.exe running

Hello and to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.-----------------------------------------------------------We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, ... Read more

12 more replies
Relevance 45.92%

I have 10 copies of : running in processes. Have tried hijack this, and hasn't helped. what can I do about this???? please help!!!
 

Answer:10 SVCHOST.EXE running in processes

HijackThis is a reporting tool. It doesn't "fix" anything. Having multiple svchost.exe processes is not by itself a symptom of a problem.
 

2 more replies
Relevance 45.92%

For some reason, lately the SVCHOST , one of up to eight, is using 25% of CPU and driving the third core on and i3 crazy, near 100% continuously.  If I use the task manager to stop the process, the unit locks up.  Not run into this before.

Answer:WIN 7 SVCHOST running amuck

Have you traced which service this svchost is controlling?

4 more replies
Relevance 45.92%

Here's a screenshot:I know for a fact that this is NOT normal, and I have no idea what has caused it. It seems like the svchost.exe's have split themselves up, so instead of a few services under one svchost, they are individual. I read that running "SC Config servicename Type= share" would make them behave normally, but it doesn't help. I put all the commands and service names in a batch file, ran as administrator and they report success, but upon restarting nothing has changed.Please help, although I have recently taken an image backup I don't want to go through that hassle if it is a simple fix.Thanks in advance.

More replies
Relevance 45.92%

First - A bit of history b/c I've had nothing but problems for weeks now:

I have Windows XP got a rootkit infection that completely corrupted my hard drive - so had to have a new hard drive installed about a week ago (320 GB Internal 3.5" 7200RPM).

When I got the new hard drive, I installed Vipre Premium and Malwarebytes. I had Pirate Bay on my old hard drive and never had problems with it so I tried installing Pirate Bay and you guessed it, I got the infamous Searchqu/iLivid that took over Firefox.

I went online and followed directions by changing the home page by taking the steps: about:config, Keyword.URL, replaced the homepage to google, etc. It worked but somehow I did something and screwed it up. I can't even run "about:config" anymore - it goes to a page that says that it won't connect and to work off-line or something like that.

I was finally able to uninstall Firefox (it wouldn't let me uninstall it and I had to try about 10 times.) Now I'm using IE with a MSN.com homepage. Although it's annoying (I don't like Bing and want Firefox back) my computer was running fine. I reinstalled Firefox but it comes back with Searchqu every time.

The above is just annoying but now I have a much bigger problem: This AM when I turned my computer on, it was freezing or running so slow that I couldn't use it. I had to keep turning it off and on. Now it's an hour later and running fine.

This may or may not be impor... Read more

Answer:Multiple SVCHOST.EXE are running

With the information you have provided I believe you will need help from the malware removal team. Please make sure that you read the information about getting started first.Then start a new thread HERE and include or required logs.Including a link to this thread will be helpful. Good luck and be patient. Help is on the way!

4 more replies
Relevance 45.92%

Is it normal for me to have 5 Svchost processes running?!?!?! This morning when my computer was done starting up and loading everything, I opened up the Task Manager and discovered that I had 5 Svchost processes running:
All of them are registered as svchost.exe; one from Local Service, two from System, and two from Network Service. I wish there was a way to show the screenshot of the five svchost processes because I've never noticed that before and figured it's kind of odd.

Answer:5 Svchost Processes Running

Perfectly normal to have several instances of svchost running.I have 6 running now.A description of Svchost.exeThe Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.

10 more replies
Relevance 45.92%

A friend brought her laptop to me yesterday to have a look at it. She took it to the shop and they told her that "she needed to fix her cpu" (whatever that means) or replace it. That wasn't the problem.

When running Windows 7 in normal mode, after about 1 minute, an instance of svchost begins to leach all resources. 1.5ghz of the core2duo and all 2 gigs of ram. At this point it's impossible to even open the task manager. I'm sure there's a service running in it that is infected. I'm able to run everything in safemode just fine as whatever this service may be is stopped.

Where should I begin to remove this service?
 

Answer:Service running in svchost.exe

I've discovered that the svchost.exe is "netsvcs" and that the particular service is "Host process for Windows services". There are 2 instances of this running in the same svchost, each with a different PID and only one is out of control, using all memory and constantly downloading more.

Sorry, I think I read that wrong, I think that's just the header for the svchost running
 

2 more replies
Relevance 45.92%

 I have found a thread for this but its from around 3 years ago and some of the images are missing.
 
My svchost is running at 99/100% and causing the computer to lag. Can anybody please help me with this so I can get another couple of months life out of this computer before I have enough money to upgrade to a newer model also to take off all the files that are on it.
Many thanks 
Marie
 task manager.jpg   61.93KB
  0 downloads

Answer:Windows xp svchost exe running 99%

Please download MiniToolBox  , save it to your desktop and run it.
 Checkmark the following checkboxes:  List last 10 Event Viewer log  List Installed Programs  List Users, Partitions and Memory size.
 Click Go and paste the content into your next post.
 Also...please Publish a Snapshot using Speccy,  taking care to post the link of the snapshot in your next post.
   Go to Piriform's website, and download the free version on the left.  Click Download from Piriform.com (the FileHippo link requires an extra click). Or if you want to use a portable version of Speccy (which doesn't require installation), click the builds page link and download the portable version. You will now be asked where you want to save the file. The best place to put it is the Desktop, as it will be easy to find later.
    After the file finishes downloading, you are ready to run Speccy. If you downloaded the installer, simply double-click on it and follow the prompts until installation is complete. If you downloaded the portable version, you will need to unzip it before use. Right-click the ZIP file and click Extract all. Click Next. Open up the extracted folder and double-click on Speccy.
 
     Once inside Speccy, it will look similar to this (with your computer's specifications, of course):
     Now, at the top, click File > Publish Snapshot. You will see the following prompt:
 &#... Read more

1 more replies
Relevance 45.92%

I just got this Keylogger trojan virus and I'm tryin to clean it out but its dug in really deep. When I look in my task manager in Win Xp I see 4 svchost.exe processes running. I didnt think there was supposed to be this many, maybe 2 max. How do I know if one of them is a virus?

I've ran Norton 2002, The Cleaner 4, and Panda with no luck.
 

Answer:4 svchost.exe's Running, Wierd?

nah that's not weird.. i've got about 5 running at the moment. (and pc is virus-free )

but how to tell when a virus is running a svchost.. dunno have to check thatone
 

7 more replies
Relevance 45.92%

I know it's normal to have more than 5 running, but I checked my task manager after I saw in one of my gadgets that my RAM was running over 50%(2 GB RAM).

Here are some pictures of what I saw:




Click HERE for my virus total scan.

Is there anyway I can take down what it uses for memory? I've turned down its priority, and it doesn't make a difference.

Yes, I KNOW! svchost.exe is a big part of Windows, don't remind me!

Specs:
Windows 7 Ultimate x64 - SP1
2GB RAM
256MB ATI FirePro V3700 (FireGL)
Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz 2.33 GHz

Answer:Svchost.exe running at >100,000K?!

The two best solutions would be:
1) Buy more RAM. It's incredibly cheap at the minute.
2) Reduce RAM usage elsewhere.

There's not a lot you can do to reduce svchost's footprint. But you can probably free up some RAM by stopping various programs from starting up with Windows (pointless stuff like Google Update or Java Update or Nvidia 3D Service).

9 more replies
Relevance 45.92%

Hello.I think my PC is in quite some trouble. It all started when my virus scanner alerted me of a msvcrl.dll (a keylogger) which then got removed. After that my IE6 wouldn't work anymore because the .exe was corrupted, iexplore.exe thought he needed msvcrl.dll to start (but he doesn't). I could not update to IE7 because that gives a blue screen for some reason (of course Windows says it's something with my drivers that caused the problem, yea right..) Anyway I fixed that problem by overwriting the iexplore.exe with a working one from another PC which also had IE6 installed.After that I had some file windows2k6.exe, of which my virus scanner thought it might be a virus, so I removed that one too (and nothing bad happened...)But now.. When I open task manager I have SIX instances of svchost.exe running. I know this is not normal! There are 3 running from 'SYSTEM', taking about 4.2, 27.5 and 4.8 mb memory respectively. There are 2 running from 'NETWORK SERVICE', taking about 4.0 and 4.8 mb memory respectively. Then there's 1 running from 'LOCAL SERVICE' which takes about 4.8 mb of memory.My virus scanner recently told me that svchost.exe had downloaded a trojan for me (or something like that), which I then of course removed, but just now I have another trojan in my pc while I did nothing weird!So, to make a long story short, I suspect that some svchost.exe is corrupted, downloading all sorts of trojans on my pc. I googled some but couldn't really find any useful informa... Read more

Answer:6x Svchost.exe Running, Keep Getting Viruses

Your svchost's are correct and normalAre you in Argentina??If not do thisDownload Hoster from here:www.funkytoad.com/download/hoster.zip Run the program Hoster and press Restore Original Hosts, OK, and Exit Program.======================You may want to print this or save it to notepad as we will go to safe mode.Fix these with HiJackThis ? mark them, close IE, click fix checkedO4 - HKLM\..\Run: [SvcManager] windows2k6.exeDownLoad http://www.downloads.subratam.org/KillBox.zip orhttp://www.thespykiller.co.uk/files/killbox.exeRestart your computer into safe mode now. (Tapping F8 at the first black screen) Perform the following steps in safe mode:Double-click on Killbox.exe to run it. Now put a tick by Standard File Kill. In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box. C:\WINDOWS\System32\windows2k6.exeNote: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.START ? RUN ? type in %temp% - OK - Edit ? Select all ? File ? DeleteDelete everything in the C:\Windows\Temp folder or C:\W... Read more

1 more replies
Relevance 45.92%

I started a thread in the Operating System forum (http://forums.majorgeeks.com/showthread.php?t=59763 ) but I have been told that this forum may be more appropriate for my problem. I have a Windows XP, Service Pack 1 PC that at startup gives me a process named SVCHOST.EXE that utilizes 100 percent of my CPU. Also, I get no taskbar. I have done full virus scans and deep system scans for spyware to no avail. I have a Hijack This log if that would help. That is my last chance since I feel I've tried everything else. My next step is a system rebuild which I would like to avoid if at all possible. Any help would be greatly appreciated.
 

Answer:SVCHOST.EXE Running at 100%, No Taskbar

First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

Then run these online scans,

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After doing ALL of the above if you still have a problem:


Download HijackThis 1.99.1

Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file as your backups will not be safely stored.

Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

Run HijackThis and save your log file.

Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post as it will be removed).

Need help with HJT? See this thread: NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting
 

5 more replies
Relevance 45.92%

I recently bought this laptop, and searched for svchost.exe and found that 3-4 of the programs to run in the task manager is normal. Firefox is the only program I have open, and there are 11 svchost.exe's running in my task manager! They take up quite a bit of memory too. Anyone have any ideas or a solution?

I also have selective startup configured in msconfig, so there aren't all kinds of stupid programs are opening when I turn the computer on.
 

Answer:Vista64 SP1 with 11 svchost.exe's running!!

This happens to me also, 64-bit Vista, nothing else running....

My guess is that Vista is doing this to keep different processes from interfering with each other, for security reasons or whatever... Hopefully someone will have a better answer for us!
 

1 more replies
Relevance 45.92%

Hello, I just checked my task manager and saw 13 svchost.exe processes running. Usually I just see 2-3 of these running, so I think it's strange to see so many of these processes running again. This happened months ago, but I don't really remember what I did to fix it. 13 is a bit much isn't it? The task manager says physical memory is at around 37%...isn't that also a bit high? Well, here's a screencap:

Does anyone have an idea of what could be going on? Anything I can do to get the number of these processes to go down? It just seems strange.
 

Answer:13 svchost.exe processes running

Download and run Process Explorer. You'll be able to right-click on all of the svchost.exe processes and find out what services they are related to, by clicking on "Properties".
 

2 more replies
Relevance 45.92%

wtf does that mean? why so many?
 

Answer:5 instances of svchost.exe running

I currently have 6 instances running. As long as they are all spelled svchost.exe, your fine.
 

3 more replies
Relevance 45.92%

Hello,
 
My computer is currently running at 50+% with nothing open, making even basic operation painstaking.  Vista Home Premium 32 bit, SP 2.  I have Malwarebytes installed, and have run cleanups using CCleaner.  This is a relatively recent problem, I have had virus issues in the past but not operation issues like this one.  I tried HP support (wanted a boot disk, ended up paying for a tech to download Revo Uninstaller & MSE).  Uninstalled many non-essential programs.  First had an issue with svchost.exe for Windows updates; disabled the updates and that cleared up, only to be replaced by this.  I don't know that it is a good idea to end the process tree, and I have no idea what services are nonessential or how to identify a leak.  The services under the offending svchost.exe are: 
 
Winmgmt (Windows Management Instrumentation)
Themes
ShellHWDetection (Shell Hardware Detection)
SENS (System Event Notification Service)
Schedule (Task Scheduler)
RaasMan (Remote Access Connection Manager)
ProfSvc (User Profile Service)
MMCSS (Multimedia Class Scheduler)
LanmanServer (Server)
IpHlpSvc (IP Helper)
gpsvc (Group Policy Client)
EapHost (Extensible Authentication Protocol)
Appinfo (Application Information)
AeLookupSvc (Application Experience)
 
Any suggestions on what to try next?  Any help would be greatly appreciated.. this is making life just a little more difficult than it should be.
 
Update 10/6: I did a... Read more

More replies
Relevance 45.92%

Problem: My taskbar does not load on log on, I have tried CRTL + ESC, also I have tried the tool on Kellys... I receive a run time error. I cannot open mcafee. I have scanned with AdAware, SpyBot, eLaunch, Error Guard.

Thanks in advance for your help,
Steve

Here is my HiJack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 9:54:09 AM, on 4/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\KATIEB~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/sear... Read more

Answer:No taskbar and SVCHOST.exe is running at 100%

7 more replies
Relevance 45.92%

Ive been looking at why my computer isrunning s slowly and it seems to be running lots of svchost.exe's i know they are for random .dll's but they seem to be taking a lot of system memory and im unsure if ive got a virus as well. I have run avg and it picked up something theother day so im wondering if there is more ive mised or if my registry is a mess. anyways here is my HJT file if someone could help thanksC:\Windows\system32\taskeng.exeC:\Windows\Explorer.EXEC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exeC:\Windows\PLFSetI.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\ehome\ehtray.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Users\Gareth\AppData\Local\Temp\RtkBtMnt.exeC:\Windows\system32\wbem\unsecapp.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\Windows\System32\mobsync.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Users\Gareth\Downloads\HiJackThis.exeC:\Windows\system32\SearchFilterHost.exeR1 - HKCU\Software\Microsoft\Internet... Read more

Answer:SVChost/ Slow running

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until ... Read more

4 more replies
Relevance 45.92%

hello there i have 8 in total svchost.exe processes running on my computer,

4 system
2 network service
and 2 local service

i was told that svchost.exe can be a trojan which allows the attacker access my computer from remote locations. However, i am told that it most commonly handles processes executed from DLLS and thus, should not be terminated.

i was concerned about the number of svchost i had running,is it normal?

they all use diff memory, the highest 28 640 related to the system
the lowest 3 648 - network service

any information appreciated thanks
 

Answer:multiple svchost running

Five or more running at once is normal.
 

2 more replies
Relevance 45.92%

I immediately noticed my computer was running wayyy to ridiculously slow and checked the alt+ctrl+del menu and sure enough i see:

Name User CPU Mem Usage
svchost.exe SYSTEM 99 100,000+k
When I shut it down, my computer has no sound.

So: Two questions Why is this, and how do I fix it?

Thanks for any/all help, I only have this one computer and I like music.

~Matthew
 

More replies
Relevance 45.92%

All of the system services and processes are not running due to svchost.exe (is not running).when i run svchost.exe manually it says that insufficient system resources.

Answer:svchost.exe and other processes not running.

Did you check your PC with antivirus software in safe mode? I recomment to use malwarebytes or Security Task Manager

2 more replies
Relevance 45.92%

The computer has more than one user, some of whom do banking and pay bills online. The computer is running Windows XP Home Edition service pack 3 and Internet Explorer 8. Using Microsoft Security Essentials and Avira Antivirus.

When using IE8, the windows open and close verrrrrry slowly. Google is the IE8 homepage and when I type searches in the panel the letters of the words are slow to appear and users have to wait for the letters to appear.

Task manager shows three iexplore.exe and seven svchost.exe running under the user name SYSTEM (3) and two in NETWORK SERVICE and two in LOCAL SERVICE.

DDS file follows. Attach and Ark files attached.
Thanks for the help.
JD

The DDS.txt file shows:
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
mSearch Bar =
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\2.0.301.5672\swg.dll
BHO: MSNToolBandBHO: {bdbd1dad-c946-4a17-adc1-64b5b4ff55d0} - c:\program files\msn apps\msn toolbar\01.02.5000.1021\en-us\msntb.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc... Read more

Answer:three iexplorer.exe and seven svchost.exe running

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log... Read more

2 more replies
Relevance 45.92%

Hi everyone!

My name is Frank and I was adviced to move my Thread from Opsys to here.

My problem is that one of the svchost.exe is running high, between 500k and 130k
It is the svchost.exe PID: 2600 AudioEndpointBuilder, Netman, PcaSvc,
SysMain, TrkWks, UxSms, Wlansvc

I've had a decent antivirus and malware removal but it is still running high, which is quite disturbing.

Here is the previous Thread, and the resoult of the TSG Sysinfo.

http://forums.techguy.org/windows-7/1133199-svchost-exe-running-high.html#post8965200

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz, Intel64 Family 6 Model 37 Stepping 5
Processor Count: 4
RAM: 3828 Mb
Graphics Card: Intel(R) HD Graphics, 1722 Mb
Hard Drives: C: Total - 431937 MB, Free - 112162 MB; D: Total - 29690 MB, Free - 20382 MB;
Motherboard: LENOVO, MoutCook
Antivirus: COMODO Antivirus, Updated and Enabled

Thank you for your help in advance.

Kind regards,
Frank
 

Answer:SVCHOST.EXE is running high

16 more replies
Relevance 45.92%

Is this normal??? I got the info from Spybot. The reason I checked it in the first place was I kept getting an popup message saying svchost had caused some kind of fault in Windows and it was shutting down, but Windows never shut down. On the other hand, I can't get my Search function in Windows to work. Here's my hijack this thingy, although I'm not sure it really has anything to do with it.

Logfile of HijackThis v1.96.0
Scan saved at 4:24:53 PM, on 8/11/2003
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1

Running processes:
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\HPCD-W~1\DirectCD\directcd.exe
C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
C:\WINDOWS\loadqm.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\InterAct\Gaming Devices\JoyAct.exe
C:\Program Files\Software602\602Pro PC SUITE\602Tab\602Tab.exe
C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\claire\My Documents\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R0 - HKLM\Software\... Read more

Answer:svchost running 25 threads?!?!

Here's my Spybot report....

--- Search result list ---
Congratulations!: No registry inconsistencies were found. ()

Advertising.com: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

Advertising.com: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

Avenue A, Inc.: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][2].txt

BFast: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][2].txt

Commission Junction: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

DoubleClick: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

FastClick: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

Gator: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][1].txt

HitBox: Tracking cookie or cookie of tracking site (File, nothing done)
C:\Documents and Settings\claire\Cookies\[email protected][2].txt

HitBox: Tracking cookie or cookie of... Read more

1 more replies
Relevance 45.92%

Hi,

Almost everywhere it says if svchost is running under the PC's name or the user logon name then there's a problem, possibly malware. But now I just read this:






Beginning with Windows 10, an instance will start under the user context at
logon (with command line ?-k UnistackSvcGroup?).



Is this true? Must be...So what people have been saying is a sign of malware, is, at least in Win10 normal functioning. And svchost associated with it is in .../system32, where it should be. Supposedly MS is using it for telemetry.

Am I right about this? Thought I had some deep-seated malware but apparently not?

Thanks

Answer:svchost Running under User Name

I have never seen svchost running under user name, not in 10 either.
You should open file location an check, if it is really svchost in System32.
Then again, I have never allowed telemetry and I disable Unistack services.

3 more replies
Relevance 45.92%

Hello,
 
I have scanned my computer several times with diffeferent anti-spyware programs and i haven't found any malware or virus from my computer but i think that there might something because svchost.exe is running all the and uses very much of my cpu. My laptop heats pretty much even when idling because of svchost.exe running all the time. I don't know what do so i came here to ask help. I attached my hijackthislog. Thanks for help.
 
 

Answer:Svchost.exe is running all the time

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Please download AdwCleaner by Xplode onto your Desktop.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Click the LogFile button and the report will open in Notepad.IMPORTANTIf you click the Clean button all items listed in the report will be removed.If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.Close all open programs and internet browsers.Double click on AdwCleaner.exe to run the tool.Click the Scan button and wait for the process to complete.Check off the element(s) you wish to keep.Click on the Clean button follow the prompts.A log file will automatically open after the scan has finished.Please post the content of that log file with your next answer.You can find the log file at C:\AdwCleanerCx.txt (x is a number).===Download the version of this tool for your operating system.Farbar Recovery Scan Tool (64 bit)Farbar Recovery Scan Tool (32 bit)and save it to a folder on your computer's Desktop.Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first ti... Read more

13 more replies
Relevance 45.92%

Hey everyone, wasn't too sure if this was the right forum for this, fingers crossed.
I have a small problem with the processes menu in my task manager. I have 'svchost.exe' appearing 9 seperate times using an accumalitive memory usage of approx. 75,000k. As much as system does on its own. Im aware that svchost.exe is neccesary, but 9 times? Is this normal or is something going wrong?
All replies greatly appreciated.

Answer:svchost.exe running 9 times

The number of entries for svchost.exe tends to vary with what is installed, what Windows processes are engaged...IMO.I currently have 8 instances running with an estimated 60-65KB of RAM (I have 4GB installed) being used by these 8.What is svchost.exe And Why Is It Running the How-To Geek - http://www.howtogeek.com/howto/windows-vis...-is-it-running/ How to determine what services are running under a SVCHOST.EXE process - http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchost.exe-process/ Louis

5 more replies
Relevance 45.51%

Hello,
My PC is having problems. I ran through the malware removal steps, posted on that forum (everything is clean) and was told to post here.

Below are my problems:
1. When starting pc I initially get the following error:
svchost.exe Application error
The instruction at "0x7d4caa9b" referenced memory at "0x00000010"
2. I hit the cancel button on the popup, then desktop takes a long time to load.
3. Once desktop starts to load I get the following popups
- Sonic Update Manager
the feature you are trying to use is on a CD-ROM, insert disk (I cancel out but it keeps poping up).
- Microsoft Visual C++ Runtime Library (also pops up)
Runtime Error
Program: C:\Program Files\Dell\Media Experience\PCMService.exe
4. Unable to connect to router for internet connection. It keeps trying to connect and finds rounter but just can't connect.

Please help
 

More replies
Relevance 45.51%

Having issues with my compaq presarion cq57 laptop. svchost is runnnig alot of memory and maxing out my cpu. Several of these are running. one runs about 160K and sometimes another runs just as much. It locks my comptuer up alot. I have run my anti virus and malware byte scan and nothing.

Answer:SVCHOST running alot of cpu and memory

What do you mean under lock up.Download Minitoolbox - http://www.bleepingcomputer.com/download/minitoolbox/
Start the application.Set ticks everywhere and click GO button.After scan is done a log will appear.Save and attach it here.

1 more replies
Relevance 45.51%

Hm... Still probing my computer for reasons why she's running like dirt. I discovered 6 versions of svchost.exe running on my machine. One for LOCAL SERVICE, two for NETWORK SERVICE and three for SYSTEM. All together, the 6 of them take up 45.6 MB of memory. Security Task Manager tells me they're all legitimate and from Microsoft Corporation, but I've read cases of this file being a fake. All 6 run from System32. I'm thinking of going down the list and just ending processes until I get the bad one, but I'm not sure if this can cause permanent damage or if it will just force a restart. A knowledgable person would be greatly appreciated.
 

Answer:6 versions of svchost.exe running? Possible Virus?

10 more replies
Relevance 45.51%

I apologize if there is a thread already addressing this type of issue, I could not find in forum searches. My 'svchost' file, (Windows 7 SP1 64bit) is constantly running the win update module at a 13% rate, and only killing the process outright stops this, however it can often affect the loading of other third party apps and utils, rendering them painfully slow.
I installed a windows update claiming to address this issue, and it has not at all, CPU still being used at the same rate.
Is there a means of rectifying this annoyance without taking away from the rest of my windows experience?
Thanks, and regards..

Answer:Why is svchost.exe constantly running all the time?

This may help you: What is svchost.exe in Windows? Multiple instances, high system resources utilization explained

1 more replies
Relevance 45.51%

I got a bad virus somehow and i managed to delete it with the trial version of the buyable SuperAntiSpyware. Unfortunately it did not get rid of the entire virus. I then heard of A Squared and got that, I ran it and it found viruses so I chose "Fix". It couldn't fix it so I instead chose "Quarantine" and my computer crashed and I had to repair it with my XP reinstalling disk. Currently I have many svchost.exe's running in SYSTEM on my TaskManager and I am also getting IEXPLORE.exe running in SYSTEM randomly. Nothing bad has happened except for one instance where an IEXPLORE.exe in SYSTEM caused what I think to be a commercial(audio only) to be played in the background. There was no window for the commercial only audio coming out of my computer's speakers. Here is the DDS log I was told to post.


DDS (Ver_09-05-14.01) - NTFSx86
Run by Ghetto Muffin at 6:13:00.01 on Thu 05/21/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.992.576 [GMT -4:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobile... Read more

Answer:Multiple svchost.exe running in SYSTEM? Need help!

Can a moderator please close this thread. I am posting a more up-to-date version of this post. I have done some activity on my own and I do not wish to cause un-needed confusion for the helpful people on this forum. Thank you very much.

~~~Bookworm911

2 more replies
Relevance 45.51%

Hello all,

One of my clients' terminals gives an svchost.exe error on boot. The terminal in question is a Poitn of Sale terminal running WEPOS (Windows Embedded for Point of Service). Its using a 1.5MHz Celeron processor with 512MB of shared RAM.

Apparently, they were having trouble getting said terminal onto the 'net to process their credit cards and what have you. They called their IT guy and he went through the diagnostic routines. Tried different network cable, drivers and what not and so on, and it still wouldn't connect to the internet. Apparently, on a lark he tried to run winsock fix (the Option Explicit vers.). Winsock fix didn't do the job as the NIC was dead.

Now when the terminal in question boots, I get an svchost.exe error, a Dr. Watson Non Fatal Error and explorer locks up. The machine functions just fine, I just don't want to return it to them with the svchost error because they will be less than pleased.

The exact text of the error messages are:

Program Error (title bar)
Svchost.exe has created an error and will be closed by windows. you need to restart the program.
An error log is beign created.

Dr. Watson Non Fatal Error (title bar)
Cannot Open Dr. Watson Log File
Press OK to browse for new directory
Windows Returnd Error COde 3
The System Cannot FInd the path specified

THe system works, and as long as you just click through the error messages it's fine. But I would rather not return a system to 'em with error messages popping up... Read more

More replies