What is svchost, and why is there more than one copy running?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

svchost.exe is a required system file. Removing it is most definitely the *wrong* thing to do to try to resolve this problem, and is pretty much guaranteed to hose your system.

Assuming you're running XP, my recommendation: try system file checker first. http://ask-leo.com/archives/000074.html

If that gets your system somewhat runable, then follow get all the patches from Windows Update.

And definitely read the comments here ... there have been several good suggestions on how to proceed depending on your system, your connectivity, and what state of disarray you are in.

Good luck,

Leo

Norton recently told me that my svchost file was infected with "Download.Trojan". It could not be repaired, so I quarantined it, but what should I do now? If I can't repair it, then should I delete it?

Or you can do nothing, if Norton no longer complains. It's typically OK to delete *the quarantined file* (NOT the *real* file). If you're not sure about the difference, then leaving it as quarantined should also be fine. Since SVCHOST is a required system file, deleting the wrong one could be a problem.

Leo

I hava a big problem with svchost.exe. 2500 MHz, 512MB, 128M ATI Radeon 9600 Running Windows XP,
it work perfect about 5 min and then CPU usage become 100%. What can I do?

Hi Leo
I've just encountered a similar problem to Korsaria. I have a Dell 2.4 Ghz + 512 Mb +80G HD running XP. I have Norton anti virus and also Norton Firewll but they have not been updated for a ouple of months.
this morning I found that every application was being interrupted and it would sit there and do nothing for about a minute before it stumbled on and then stopped again. I used task manager and found that the CPU was running at almost 100% with SYSTEM PROCESS. The only other thing that was running at this time was SVCHOST.EXE but this was not taking up much CPU time and was intermittant. Something is causing SYSTEM PROCESS to commandeer the CPU. Do You have any thoughts.
Many thanks
Richard

My initial reaction is that you are both infected with a virus. Updating virus signatures frequently is a *must* in today's environment - I update nightly. Update those virus scanners and get the latest round of updates from Microsoft for your system.

Leo

How do I capture the output from tasklist /svc before it disappears?

svchost.exe is constantly taking between 80 & 99% of processor & is bugging me.

If I can capture the output this will tell me which version of SVCHOST.EXE is running what programs, but how do I change them?

try:
tasklist /svc | more
or
tasklist /svc >filename.txt

If your processor is pegged in svchost, you likely are infected with a virus, and need to run a virus scan or removal tool.

Leo

Thanks Leo, going throught the pain of trying to ensure I have all the windows updates & just looked at the symantec security site for the worm removal tool. Printed it off, too tired to plough through that tonight.

Thanks for your advice, truly appreciated.

when i use my notebook with battery. This running program "svchost.exe" are alway run and take a lot of power from my notebook!!
What and how should I do in this case?
Thank You for your comment.
Sakol Nisarut
sakol@sec.or.th

To post a comment on "What is svchost, and why is there more than one copy running?", please return to that article's main page.