What is svchost, and why is there more than one copy running?

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Question. I had the common problem of recieving about a dozen popups every 5 minutes. I installed the STOPzilla pop-up Blocker and the pop ups stopped. However, I now have a problem that is just as bad as the pop up ads. Whenever I'm online I can hear the audible sound that alerts me that a pop-up has been blocked. But about twice per hour this results in a major slow or complete freeze of my system. What could be the cause?

Hi. I have a question...
I have four SVCHOST.EXE running after restarting computer ... but after 1hour (or more) one of them is using my CPU in 100% ... when i disable it i can't COPY/PASTE/MOVE FOLDERS, etc.
Can you please help me ? And if you reply plz send me an email so i can see what is the problem :P btw. maybe there is a way to look why this process use 100% of my CPU ?

http://ask-leo.com/archives/000059.html
and
http://ask-leo.com/d-blkrpc

should both be helpful.

Good luck.

Leo

Tracy: sounds like the windows messenger *service* is still running and being attacked. This article: http://ask-leo.com/archives/000017.html has instructions for turning that service OFF, which you should do. Or visit Gibson Research (http://ask-leo.com/d-grc ) and grab "Shoot the Messenger" which does the same thing ... disables the service.

Good luck!

Leo

I have SVCHOST and SVCHOST running in my system whenever i boot the system. And windows task manager shows 100% of my CPU is being used by these 2 process. when i disable / set the priority to below normal,the system doesn't allow the operations like COPY/PASTE/MOVE FOLDERS, etc.
Can you please help me ? And if you reply plz send me an email so i can see what is the problem :P btw. maybe there is a way to look why this process use 100% of my CPU ?

SVCHost is a required system component, so you can't adjust it's priority, or kill it. You either have or are being attacked by a virus. Check out the various comments in http://ask-leo.com/archives/000059.html - in short: update and patch Windows, update and run virus checking, and make sure you've got some kind of firewall in place.

Leo

windows xp pro,, i have a free DL of ad ware for finding spyware,,, i find about 7 per 24 hrs, always comet cursor and tracking something,, both are called data miners,, they arein my registy key and files,, ad ware get rid of them but they always come back,, how can i stop them from coming back

Well, step one is simply to take care in what sites you visit and software you download ... typically these downloads are given to you transparently be less-than-reputable vendors.

Second, tighten up your browser's security settings. This will prevent many.

Finally, Spy Bot does have have a monitoring function that will watch for, and block at your option, many of the bigger offenders. AdAware may also have something like this in their pay version. There's also a tool called StartupMonitor which can keep reins on what gets added to your startup (http://ask-leo.com/d-startupmonitor ).

Leo

Running in a command window (WinXP home) the "NET START" command works; however, when I type "tasklist /svc" I get the folllowing error message"
['tasklist' is not recognized as
operable program or batch file.]
What am I doing wrong?
Thanks,
Allmen Quester

Nothing. You probably have XP Home, which apparently doesn't have the tasklist command. I'll be writing up an article shortly on how to use Sysinternals Process Explorer (http://ask-leo.com/d-31017a ) to get the same information. In a nutshell, run procexp, doubleclick on a svchost instance, and then select the "services" tab, and it'll show what services that instance of svchost is hosting.

Leo

To post a comment on "What is svchost, and why is there more than one copy running?", please return to that article's main page.