Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

I have a similar problem with svchost and crashing. svchost was continually taking >25% CPU, and I was getting intermittent crashing. I took all the precautions listed above, and the crashing seems to have stopped. However, svchost is still taking >25% CPU. It appears to be the Windows Management Instrumenation service that is doing it. When I shut this down the CPU goes back to normal. When I restart, or access the internet, the usage goes back up. Any idea what is going on here, and how to resolve it?

Regards,
Rupert

hayhey leo!
You should do something about the text colors on this page, you should have another color for your answers so that it will be easier to see what's the question and what's the answer.

Great article Leo!

Hi Leo

It's an excellent resource your site. I have a query reference this article.

Above you say ".... make sure that ports 135, 139 and 445 are not being forwarded ...."

I am running XP Pro - how do I check this out?

That has to do with your NAT router, and how to check it will vary based on which brand of router you have. Normally there's a web interface to the router that will allow you to configure these settings.

Thanks - I was looking inside out whereas I should have been looking outside in and then I would have understood.

I had no end of trouble with svchost.exe crashes and read everything on the damned net to help with it, to no avail. Most resources assumed I had a virus, which I did not (unless 4 virus checkers were wrong). I was also behind a hardware firewall with no infected machines on the LAN. I was completely patched and up to date as of April 2004 on win2k sp4. When the crashes were happening, Event ID 4097 was not uncommon in the application log, I was also getting i8042prt errors periodically (Event ID 28) though those may not be related at all, but the usual annoyance was the Event ID 26:

Event Type: Information
Event Source: Application Popup
Event Category: None
Event ID: 26
Date: 4/8/2004
Time: 6:08:10 PM
User: N/A
Computer: BLAH
Description:
Application popup: svchost.exe - Application Error : The instruction at "0x1000e765" referenced memory at "0x00000000". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

What ultimately seems to have fixed my frequency (up to 3x per day) crashes of svchost.exe which required reboots to restore copy/paste functionality in all programs.... was disabling the Server service in Control Panel> Admin Tools > SErvices and setting Server to disabled.

I was able to do this because the computer I was having this problem on (an IBM Thinkpad T23) wasn't sharing out any printers or folder. Server service also disables computer browser, so really the only change I needed to make in my usage was to reference file shares by IP address rather than by netBIOS computer names. In my usage, the affected machine had no shares of its own, but it accessed shared files and printers of other windows machines on my home LAN.

So, in summary, try disabling the Server service. Seemed to work for me.

I hope this helps someone!

Todd H
http://www.toddh.net/

MY SERVER IS SUFFERING FROM SVCHOST.EXE 100%CPU MAXIMIZATION PROBLEM. WHEN INTERNET IS NOT RUNNING ON IT THEN IT WORKS NORMALY AND SHOWS 2% CPU USAGE. BUT AS SOON AS IT CONECTS TO THE INTERNET IT AGAIN SHOWS IN TASK MANAGER THAT SVCHOST.EXE USING 100% CPU USAGE. AFTER THAT MY SYSTEM SOON GET HANGED. AND THEN I UNABLE TO DISCONNECT THE SYSTEM FROM INTERNET. IN THIS CASE I HAVE TO REBOOT MY SYSTEM AGAIN AND AGAIN BY DIRECLTY SWITCHING OFF THE POWER SUPPLY.
AS THIS IS SERVER IT IS NOT GOOD TO REBOOT THE SYSTEM AGAIN AND AGAIN.
SO SIR , I WANT PROPER SOLUTION FOR IT. SO, PLEASE HELP ME . AS MY IMPRESSION BEFORE MY BOSSES IS FALLING DOWN.SO, I NEED YOUR HELP.
ONE THING MORE I WANT TO TELL YOU THAT MY SYSTEM IS FREE FROMM VIRUSES. BECAUSE I HAVE SCANNED IT REGULARLY WIHT NORTON ANTIVIRUS (LATEST EDITION).

AS I AM UNABLE TO PURCHASE THE ANY SOLUTION IN DOLLARS OR RUPEES. IF YOU CAN HELP ME WITH FREE SOLUTION THEN I WILL BE VERY THANKFULL TO YOU.

THANKING YOU
URS FAITHFULLY
ANI KUMAR

Many people swear up and down they are not infected, only to find later that they ARE infected - I would certainly sugggest a scan with a different anti-virus package just to be sure. All AV packages miss *some* viruses. I have recommendations here: http://recommend.pugetsoundsoftware.com

If you're *positive* you're not infected, then the symptoms sound like you are being attacked from the outside as soon as you connect. The solution is to enable or install a firewall. This article could help: http://ask-leo.com/archives/000119.html

My cpu suffers the fate of 100% useage. Although only due to re-installing XP Pro. I removed the problem months ago and it never came back (until now). There was a easy description on how to get rid of it. It did include deleting it from the registry. Damn, I should have saved it.

If you are still using 98/me, make a text file with notepad in c:\windows and rename it SVCHOST.EXE and give it System and Readonly attributes so nasty websites can't replace it with their spyware.

I do this sort of thing to block recurring mal/spy/ad ware.

To post a comment on "Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.", please return to that article's main page.