Ask Leo! by Leo A. Notenboom

Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Windows » Windows Components

Comments

Read the article that everyone's commenting on.
RSS feed Subscribe to the RSS Feed for comments on this article.

Hey Leo,
I am having similar problems with the Internet that others are having. Everything works fine on my computer but when I look at systems processes there are 4 or 5 svchost.exe running. I use to live in a different state and had wireless Internet. They gave me a CD that had 4 programs to run that would take care of it. Since I have moved I returned the CD to the Wireless Internet Company. When I moved I just got dialup for a little while but now I have switched to DSL and my Internet is doing the same thing. (This is because I have reformatted my computer) My Internet goes slower than 56K and the ping is like 4000. I remember 2 of the programs on that CD were Windows XP Service Pack 1 and fixwelcha removal tool so I installed both of them. After running FixWelcha it said that the Welcha Virus was removed but my Internet Connection is still very slow (slower than 56k) and there are still 4 or 5 svchost.exe's running. Can you please help me? Thanks

Posted by: Matt at May 18, 2004 11:32 PM

hi leo.
i have 15 comp. in my class. every time after formatting i see this message. i use xp pro and win 2000 pro . i have this problem each comp. formatting not solution i can understand.i have one switch and each comp. connect that network.what can i do for solution thank you.

Posted by: firat at May 19, 2004 7:05 AM

Okay, I read the article, I tried the steps listed in it and about 15 other articles simmilar to it. Here's what is happening....

I have Win 2K, SP4. I run Ad-Aware 6 about once a week along with Spybot S&D. I update my virus defs daily. I updated the Windows install about a week ago.

Somehow my wife got a couple spyware programs on the PC. One was 180 something one was Lycos SideSearch. I removed them with Ad-Aware. I rebooted. It started giving me SVCHOST.exe errors. I restored all the files and key entries. Still getting them.

I have reinstalled SP4 (but it was intigrated on my install in the first place), I have run the various patches to correct the exploits. I have ZoneAlarm as my firewall, and AntiTrojan Guard on watch as well. She runs NetRatings from Neilson (tracks websites she surfs to, like the Neilson Ratings on TV) which I have disabled. I have replaced the svchost.exe file with one from another PC that is not having this problem. I have checked for files that are named similarly or different sizes, hidden in folders and so on. Nothing.

I cannot connect to the Internet with this PC anymore. Now copy/paste/move is disabled completely now. I have backed all this data on the C drive to another to preserve it as it was before I started making changes. I can't see the contents of WINNT folder or any subfolders. I can't see the contents of the Control Pannel. I ran Windows 2K repair program from the original disk. I have not used the recovery console yet, and I don't see any reason that it would help when the other solutions offered are not.

THis is my last plea before I format C and loose almost a year's worth of data and installations for myself, my wife and my daughter. This is time critical, I only have a half an hour left here at work.

Thank you.

Posted by: Eric at May 19, 2004 1:41 PM

Matt: Pretty much all the advice I have at this time is in the article that you've just added your comment to (http://ask-leo.com/archives/000105.html ). It is normal to have several SVCHOSTs running (see this article: http://ask-leo.com/archives/000030.html )

Posted by: Leo at May 19, 2004 4:16 PM

firat: I'm having trouble understanding your description problem. Taking a guess: if one computer in your class is infected, it could be reinfecting the other computers immediately after they've been reformatted. I would take all the computers off the network, clean, virus scan, reconnect and patch each one in turn so that you know only clean machines are connected to the network.

Posted by: Leo at May 19, 2004 5:19 PM

I reformatted and reinstalled everything. I ghosted the C:\ partition to another partition to preserve my data. Nevermind on the post I made.

Posted by: Eric at May 19, 2004 9:54 PM

Sorry we weren't able to come up with a less severe solution for you. I'm glad you were able to save your data. :-)

Posted by: Leo at May 19, 2004 10:01 PM

I ran an online Virus test and found out I had 724 Viruses. Alot of them were Bagle.N and stuff like that. I used that removal tool 4 times but they just keep coming back. I have alot of other viruses to. Im just going to format my whole computer, Including the D Drive which all my stuff I really want to keep is saved on. I pray this works. Thanks for the help though.

Posted by: Matt at May 20, 2004 2:03 AM

Wow! Yes, that much could be very hard to clean up. Be sure to set up safety measures after you reformat to avoid problems in the future. This article might help: http://ask-leo.com/archives/000011.html

Posted by: Leo at May 20, 2004 8:39 AM

Hi Leo,

I believe my computer is suffering from a Svchost problem. I run XP Home ed. and I've been worried for some time that my dialup connections have been missing from the Network Connections folder. I can still connect, but only the Windows Task Manager actually acknowledges the connection. Everytime I create a new connection it just suddenly disappears. This started about 5 months or so back, and I was wondering if this has anything to do with Svchost problems, since I have a Svchost.exe at 21,200-21,400K 'spiking' every 10 seconds or so. I'd not really noticed it because it had hardly every caused any massive problems until now.

Posted by: Adrian at May 22, 2004 2:06 AM
Read the article that everyone's commenting on.
RSS feed Subscribe to the RSS Feed for comments on this article.
Post a Comment

Question? Ask Leo!