Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.

Read the article that everyone's commenting on.
Subscribe to the RSS Feed for comments on this article.

Leo thanks mate for running this thread. 28 pages long and going. Wow! Just shows that this is a major problem.

Well thanks to you and Eric, I got my svchost sorted. Yippee.
Like others here, I run and up to date virus checker, AVG7 and firewall ZA. I also use process guard and wormguard, spyware guard, spywareblaster, TDS-3 with the last update, was using free version of ewido, scan regularly with Adaware and Spybot Search and Destroy and Acronis Privacy Expert. Despite all this I ended up with this problem. So maybe not a virus or spyware issue here.

To sort it I cleared my dns cache and disabled the DNS client.
To do this I did clicked start, run and type ipconfig /flushdns to clear dns cache. Then I clicked on start and run again. This time I typed in services.msc. I found the DNS client, right clicked and selected properties. I changed the startup type to disabled, clicked ok and exited services.msc. Rebooted and connected to the net with no delay and no freeze. :)

So thanks folks for your help.

Whoa! Almost as bad as packing a parachute with no D-ring:
svchost.exe at this end has been disabled (!) accidentally via System Mechanic. Now SM itself won't run--plus a "host" (no pun here) problems attending the tragic absence of this module.

CAN YOU HELP US RESTORE THIS GENERIC PROCESS?

Best regards

Leo:
Thanks for this thread. I tried everything that you have up here:
* Firewall is on
* I have two anti-virus (AVG Free and Windows OneCare Beta)
* Two anti-spyware (SpyBot SD and Microsoft Antispyware)
The problem I have had is that the svchost.exe (by the SYSTEM) is taking 100% CPU processing. This usually happens when I am trying to play a game from Jigzone.com. But, I get around it by disabling the process and then restarting afterwards. It is very annoying.
What I wanted to say though is that none of the virus scan or anti-spyware detected a problem and the firewall is on all the time. So, what else can I do to fix this problem?

Hi Leo,
Excellent article - most informative. I have a new twist. I have the 100% CPU occupancy problem, like everyone else. However, I don't quite have the latest Windows 2000 update - the reason: when I log onto the Mirosoft site and try to download it, it hits me with Error 0x80244024 - "Server does not support HTTP protocol used for request". When I did a Google search on this, I came across a discussion about this error. I have checked for all the recommended settings in the browser (IE), but no luck. I can't seem to convince Microsoft to let me have the update! Any suggestions would be MOST welcome!
George G in sunny Sydney Aus.

Might see if a different browser like firefox will let you download the fix. (Though I do realize that MS might require IE).

You should be able to order the most recent Win2000 service pack on CD - that might be an option.

Leo, I think you're missing something fundamental about svchost. Unfortunately, I don't know exactly what it is, but I have some data that don't match your assessment of the problem.

I see the same problem as everyone else: periodically, svchost.exe will chew up all the CPU cycles and everything else slows down.

In my observation, when this happens I'm also waiting for a network operation to complete. Now, the network services may be starved by svchost taking all the cycles, but it sure looks to me like it's the network operation that is causing the slowdown.

I'm certain that the problem is not a virus. I have a deskside and a laptop, both firewalled (the laptop uses ZoneAlarm), both with NAV updated daily. Yesterday, I got a new laptop for my wife and after I connected to the network, I started seeing the svchost bottleneck quickly.

It could be a port sniffing attack, but all three systems are behind a router, so that's what should be getting hit, not the computers.

So, my theory is that the problem lies in network caches being flushed, name servers or gateways getting jammed, or something along that line. Svchost is probably designed with the expectation that it can do a busy wait because it will always get an answer quickly, so if it does have to wait, it chews up the CPU. I think that svchost going to the peg may be a symptom of another problem, not the root of the problem.

Does that ring any bells for you?

By the way, the Task Manager says the user name of the svchost process is "NETWORK SERVICE". There are other instances running under my user name, but they're not the ones that are hogging the CPU. Hence, I suspect network issues.

Hello
Interesting! I am a complete novice. Have had problem for long, long time. After using my laptop for sometime, the cpu goes mad and then the computer shuts down and will continue to do so after restart. I can help the problem with a usb fan directed onto the intake vent? Anyway, when this happens,I have noticed in task manager that Sychost.exe (Network) is showing CPU use as 50 or thereabouts.This is zero when the problem is not active. I have mcafee and have tried numerous other spyware, virus programs but nothings show a virus. However, Microsoft Antispyware shows a reoccuring problems of c?window/hosts (2 signatures) which I regularly delete. I suspect this may be connected to the problem. Regard & Thanks John

am running Windows 2000 Professional with Internet Explorer 6. I have installed Windows Service Pack 4. I am getting the error "Svchost.exe has generated errors . You will need to restart the program". After this I can't open a link in a new window. I can't see contents of the WINNT folder. I can't copy paste anything. Everything becomes ok if I restart. I have scanned with AVG Antivirus but it detects no virus. What Shall I do to solve this problem?

Problem: svchost consuming 50% cpu constantly.
Setup: XP Pro SP2,Win Update (prompted), behind FW, NAV/Symantec with LiveUpdate, running Webserver, local network connection, lots of s/w

Solved: Reading the article, 300 comments, ....
Ran additional AV (Panda, AVG scan), SFC, Downloaded and installed the suggested Process Explorer. Found which service (SSDPSRV) was consuming. Changed this service to only start 'manual'. It was doing many many context switches and heap-alloc ... Killed that process, and now all seems quiet. Remainder of functions are operative in a normal way.

Thanks for the detailed detailed info. This thing was pestering me for quite a while !!

To post a comment on "Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.", please return to that article's main page.