Comments for What is svchost, and why is there more than one copy running?

Comment from Leo on 2008-10-24

2008-10-24T22:23:08Z

Comments are closed on this article. Please visit Svchost and Svchost.exe - Crashs, CPU maximization, viruses, exploits and more.

- Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-15

2004-04-15T20:51:09Z

I'd set that always forbid rule. A remote computer should not be attempting to initate a conversation that way ... they're probably attempting to exploit a vulnerability in Windows (that's since been patched as well).

If you're curious, you can enter the IP address into a "reverse DNS" tool, such as http://ask-leo.com/d-reversedns and see a) if there is a host name for that address, and b) if the host name is something you recognize.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from John K on 2004-04-15

2004-04-15T20:45:11Z

Over the last few months, with increasing frequency, I receive the following message on my screen. It's in Norton Internet Security, but it's not the usual Alert Tracker screen I get when Norton detects an attempt to hack in. It's more like the screen I get when a new programme - like RealPlayer for example - tries to connect to the internet for the first time.

The message says:
A remote system is attempting to access Generic Host Processes for Win32 on your computer.
Application: C:\WINDOWS\system32\svchost.exe
Protocol: TCP (Inbound)

It also tells me the IP addrss of the computer from which the attempt is being made - I think it's diferent each time.

I have always asumed it's someone trying to hack in or plant a trojan or whatever it is these people do, and refused the connection, but, before I set a rule to always forbid such connections, I just wondered if it is a legitimate programme or something which I ought to be allowing for the good running of the computer.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-12

2004-04-12T23:13:38Z

Nothing. You probably have XP Home, which apparently doesn't have the tasklist command. I'll be writing up an article shortly on how to use Sysinternals Process Explorer (http://ask-leo.com/d-31017a ) to get the same information. In a nutshell, run procexp, doubleclick on a svchost instance, and then select the "services" tab, and it'll show what services that instance of svchost is hosting.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Allmen Quester on 2004-04-12

2004-04-12T17:10:46Z

Running in a command window (WinXP home) the "NET START" command works; however, when I type "tasklist /svc" I get the folllowing error message"
['tasklist' is not recognized as
operable program or batch file.]
What am I doing wrong?
Thanks,
Allmen Quester

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-10

2004-04-11T01:47:24Z

Well, step one is simply to take care in what sites you visit and software you download ... typically these downloads are given to you transparently be less-than-reputable vendors.

Second, tighten up your browser's security settings. This will prevent many.

Finally, Spy Bot does have have a monitoring function that will watch for, and block at your option, many of the bigger offenders. AdAware may also have something like this in their pay version. There's also a tool called StartupMonitor which can keep reins on what gets added to your startup (http://ask-leo.com/d-startupmonitor ).

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from marty on 2004-04-10

2004-04-11T01:29:59Z

windows xp pro,, i have a free DL of ad ware for finding spyware,,, i find about 7 per 24 hrs, always comet cursor and tracking something,, both are called data miners,, they arein my registy key and files,, ad ware get rid of them but they always come back,, how can i stop them from coming back

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-09

2004-04-09T16:23:24Z

SVCHost is a required system component, so you can't adjust it's priority, or kill it. You either have or are being attacked by a virus. Check out the various comments in http://ask-leo.com/archives/000059.html - in short: update and patch Windows, update and run virus checking, and make sure you've got some kind of firewall in place.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Lakshmish on 2004-04-09

2004-04-09T07:07:37Z

I have SVCHOST and SVCHOST running in my system whenever i boot the system. And windows task manager shows 100% of my CPU is being used by these 2 process. when i disable / set the priority to below normal,the system doesn't allow the operations like COPY/PASTE/MOVE FOLDERS, etc.
Can you please help me ? And if you reply plz send me an email so i can see what is the problem :P btw. maybe there is a way to look why this process use 100% of my CPU ?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-05

2004-04-05T17:41:46Z

Tracy: sounds like the windows messenger *service* is still running and being attacked. This article: http://ask-leo.com/archives/000017.html has instructions for turning that service OFF, which you should do. Or visit Gibson Research (http://ask-leo.com/d-grc ) and grab "Shoot the Messenger" which does the same thing ... disables the service.

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-05

2004-04-05T16:48:42Z

http://ask-leo.com/archives/000059.html
and
http://ask-leo.com/d-blkrpc

should both be helpful.

Good luck.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Gustavo on 2004-04-05

2004-04-05T16:35:45Z

Hi. I have a question...
I have four SVCHOST.EXE running after restarting computer ... but after 1hour (or more) one of them is using my CPU in 100% ... when i disable it i can't COPY/PASTE/MOVE FOLDERS, etc.
Can you please help me ? And if you reply plz send me an email so i can see what is the problem :P btw. maybe there is a way to look why this process use 100% of my CPU ?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tracy on 2004-04-05

2004-04-05T15:18:07Z

Question. I had the common problem of recieving about a dozen popups every 5 minutes. I installed the STOPzilla pop-up Blocker and the pop ups stopped. However, I now have a problem that is just as bad as the pop up ads. Whenever I'm online I can hear the audible sound that alerts me that a pop-up has been blocked. But about twice per hour this results in a major slow or complete freeze of my system. What could be the cause?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from MyXPUser on 2004-04-05

2004-04-05T08:13:45Z

Hi There...

I has a problem with my PC's,
I'm using WinXP Pro, and i had this Generic Host Process For Win32 Services. Where each time the dialog box pop up, i try to close it and there is a dialog box tell that the PCs need to shut down. After a few times faced this problem i try to find a solution in internet and found out it is a MSblast. i been search a file named MSBlast.exe but did not found it. finally i found out that the generic host.... actually point to the svchost.exe.
can anyone help me to settle my problem???plzzz???

Thanks.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-03

2004-04-04T03:22:00Z

Is the task bar still visible when the problem happens? I'm wondering if it's jsut auto-hidden? Right click on an unused area on the task bar, hit properties (you may need to unlock the taskbar), and check the auto-hide and on-top settings.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Kyle on 2004-04-03

2004-04-03T23:19:08Z

Hey Leo, I got a question for yah...(obviously). I run windows xp, and for some reason or another, after I reboot my compt, my task bar gets locked up and I am no longer able to use it. I can still minimize programs and alt+tab back into them. I just cannot see them on my taskbar...mainly because it will later dissaper after running a few progams...IE games and such. I ran norton...nothing found...ran spy bot, search and destroy...found a few things, didnt fix my problem. I got the latest xp updates and such. But when i opend up my task manager, and ended svchost, my taskbar came back up and was working fine. svchost does not mainly take up alot of my cpu, but it does have it's spikes at moments where it will shoot up. Any idea what might be going on?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from adrian3k on 2004-04-03

2004-04-03T22:55:55Z

thx Leo ... i solve my problem myself :)
This was the attack on the RPC to run commands :) I think it was Gaobot attack from LAN network :)
antivirus + patches for xp + little time ... and i solve the problem :)
btw. nice site - keep up the good work :)

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-03

2004-04-03T17:21:22Z

That's most certainly a virus. Check out the article and subsequent comments here: http://ask-leo.com/archives/000059.html

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from adrian3k on 2004-04-03

2004-04-03T12:12:53Z

Hi. I have a question...
I have four SVCHOST.EXE running after restarting computer ... but after 1hour (or more) one of them is using my CPU in 99% ... when i disable it i can't COPY/PASTE/MOVE FOLDERS, etc.
Can you please help me ? And if you reply plz send me an email so i can see what is the problem :P btw. maybe there is a way to look why this process use 99% of my CPU ?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-04-02

2004-04-03T00:45:08Z

Good question. Does mIRC give you any information as to *what* trojan it thinks you have? You might also try an additional virus scanner (there are several free ones on the net that make for a good second tier scanner).

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from steve on 2004-04-02

2004-04-02T11:48:05Z

Hello

itried to conecct to mIRC and it says i have a trojan ??? ive ran spy-bot , ada-awre and norton2004 i also have a personal firewall enabled , how do i find the trojan thats lurking on my system please ?? i run winXPpro thanx for your assistance

steve

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from SAMIR on 2004-04-01

2004-04-01T09:43:30Z

THE SOLUTION SI PATCH "KB823980". I HAWE DO THAT BEFORE 7 DAYS AND NOW I DO NOT HAVE ANY PROBLEM WITH MY COMPUTER. THANK YOU "LEO".
SAMIR, BOSNIA & HERZEGOVINA

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-31

2004-04-01T04:10:24Z

First, I'd try the system file checker:
http://ask-leo.com/archives/000074.html - then I'd make sure you had an up to date virus scan.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Lereno on 2004-03-31

2004-04-01T04:01:44Z

I'm having problems with IEXPLORE.EXE and EXPLORER.EXE...
I think both are corrupted, because when i'm opening certain folders with images or photos or even larger number of files it goes like this:
- "EXPLORER.EXE (or sometimes IEXPLORE.EXE) generated errors and will going to close"

how can i solve this problem?
I think just reinstalling Windows is not enough, so i appreciated if you could give me an answer.

Big Thankx

Lereno from Portugal

p.s - i've got Windows XP Professional(sorry about my English!!!)

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-30

2004-03-30T17:16:21Z

No way to know, since you didn't say where you found it. There are such tools ... I would start at Symantec's anti-virus site and download one from there. http://ask-leo.com/d-symantecavc

Best of luck,

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from sham on 2004-03-30

2004-03-30T16:02:46Z

my computer is infected by virus w32.WlechiaB.Wrom .
when ever i run antivirus say virus found in c:\windows\system32\drivers\svchost.exe.

how to over come this.
i searched on net i founf some thing saying run given exe it will delete the file infected, is it ok?

waiting for u'r reply.

THANKS IN ADVANCE.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from andrei on 2004-03-29

2004-03-29T18:39:20Z

I think I`ve closed one of svchost and from that I have some errors that appear on my screen... at numeber of error 10053 and 10054... how can I put the svchost again... I`ve installed the windows again and no effect. If I`ve written wrong, please scuse me, I am from ROMANIA and I have 11 years old. Can I fix the problem????

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-27

2004-03-27T18:19:59Z

No, it looks like the firewall is doing its job. Further, based on the IP addresses, it looks like one of the other computers on your network may be infected with a virus.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from diz_jays on 2004-03-27

2004-03-27T10:56:16Z

my sygate peronal pro firewall tipes that it is a critical problem and blocks incomming messages to svchost.exe. firewall desdcribes it in that way: 03/26/2004 20:56:08 Intrusion Detection System Critical Incoming TCP 192.168.11.52 192.168.11.191 svchost.exe 4 03/26/2004 20:56:08 03/26/2004 20:56:08
is it wrong if firewall blocks these connectings?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-25

2004-03-25T23:45:42Z

I *highly* recommend sysinternals. In fact, you'll find them mentioned in several of my articles, and on my recommendations page. The tools you list are part of my "take everywhere with me" arsenal :-).

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Sketch on 2004-03-25

2004-03-25T23:43:30Z

Thank you, Leo. Yes, mine is XP Home.
While searching for TASKLIST.EXE, I found great free tools from the following site:

http://www.sysinternals.com/ntw2k/utilities.shtml

Free tools of this sites such as Process Explorer, TCPView, FileMon, RegMon seem very good.
Would you check them out and give me opinion?
I'll appreciate again.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-25

2004-03-25T17:33:48Z

Tasklist is only in XP Pro, I'm guessing you have XP Home edition. You can copy it over from an XP Pro system, if you have access to one. You might also be able to find a copy on-line if you search.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Sketch on 2004-03-25

2004-03-25T09:49:37Z

I have a Dell 2.0Ghz running on XP.
After I read the posted here,I tried TASKLIST /SVC on CMD window; but I've got only an error message saying:

'tasklist' is not recognized as an internal or external command, operable program or batch file.

Why is TASKLIST /SVC not working on my XP?
I'll appreciate your help.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from sakol nisarut on 2004-03-24

2004-03-25T02:50:37Z

when i use my notebook with battery. This running program "svchost.exe" are alway run and take a lot of power from my notebook!!
What and how should I do in this case?
Thank You for your comment.
Sakol Nisarut
sakol@sec.or.th

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Alex on 2004-03-23

2004-03-23T23:15:47Z

Thanks Leo, going throught the pain of trying to ensure I have all the windows updates & just looked at the symantec security site for the worm removal tool. Printed it off, too tired to plough through that tonight.

Thanks for your advice, truly appreciated.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-23

2004-03-23T22:15:07Z

try:
tasklist /svc | more
or
tasklist /svc >filename.txt

If your processor is pegged in svchost, you likely are infected with a virus, and need to run a virus scan or removal tool.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Alex on 2004-03-23

2004-03-23T22:06:21Z

How do I capture the output from tasklist /svc before it disappears?

svchost.exe is constantly taking between 80 & 99% of processor & is bugging me.

If I can capture the output this will tell me which version of SVCHOST.EXE is running what programs, but how do I change them?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-22

2004-03-22T23:42:17Z

My initial reaction is that you are both infected with a virus. Updating virus signatures frequently is a *must* in today's environment - I update nightly. Update those virus scanners and get the latest round of updates from Microsoft for your system.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Richard on 2004-03-22

2004-03-22T14:16:28Z

Hi Leo
I've just encountered a similar problem to Korsaria. I have a Dell 2.4 Ghz + 512 Mb +80G HD running XP. I have Norton anti virus and also Norton Firewll but they have not been updated for a ouple of months.
this morning I found that every application was being interrupted and it would sit there and do nothing for about a minute before it stumbled on and then stopped again. I used task manager and found that the CPU was running at almost 100% with SYSTEM PROCESS. The only other thing that was running at this time was SVCHOST.EXE but this was not taking up much CPU time and was intermittant. Something is causing SYSTEM PROCESS to commandeer the CPU. Do You have any thoughts.
Many thanks
Richard

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Korsaria on 2004-03-21

2004-03-22T07:07:39Z

I hava a big problem with svchost.exe. 2500 MHz, 512MB, 128M ATI Radeon 9600 Running Windows XP,
it work perfect about 5 min and then CPU usage become 100%. What can I do?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-20

2004-03-20T19:36:55Z

Or you can do nothing, if Norton no longer complains. It's typically OK to delete *the quarantined file* (NOT the *real* file). If you're not sure about the difference, then leaving it as quarantined should also be fine. Since SVCHOST is a required system file, deleting the wrong one could be a problem.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Tim Coley on 2004-03-20

2004-03-20T09:22:09Z

Norton recently told me that my svchost file was infected with "Download.Trojan". It could not be repaired, so I quarantined it, but what should I do now? If I can't repair it, then should I delete it?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-17

2004-03-17T19:40:44Z

svchost.exe is a required system file. Removing it is most definitely the *wrong* thing to do to try to resolve this problem, and is pretty much guaranteed to hose your system.

Assuming you're running XP, my recommendation: try system file checker first. http://ask-leo.com/archives/000074.html

If that gets your system somewhat runable, then follow get all the patches from Windows Update.

And definitely read the comments here ... there have been several good suggestions on how to proceed depending on your system, your connectivity, and what state of disarray you are in.

Good luck,

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Zeak Harbors on 2004-03-17

2004-03-17T19:31:26Z

I had one of the Walchia worms and it said my svchost.exe was infected. Norton tried to get rid of it but it was unable to get into the file. To fix this i restarted in safe mode and ended the process trees of all the svchosts running on my computer after that i looked up where there were located and deleted them. While this was happening my computer was shutting down because of the msblast. When i restarted no a lot works including microsoft explorer. I'm not sure how to restore the correct svchost. I hope you can help.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-16

2004-03-16T23:52:59Z

Step one: turn off the windows messaging *service*. There's a paragraph with the quick steps on how to do that about 2/3rds down this article: http://ask-leo.com/archives/000017.html - then, get youself a good spyware scanning program (recommendations here: http://pugetsoundsoftware.com/recommend.html ).

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from chris on 2004-03-16

2004-03-16T23:31:28Z

i have a big problem. i have a 1.6 gig processor, and im constantly overloaded. the problem comes when C:windows/system32/svchost.exe gets pinged by a number of different ip adresses, and i get a pop up (ping) from different ip adresses that try to get my to pay 19.99 to www.windows-patch.info. i need a solution bad. can anybody help?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-15

2004-03-16T01:06:12Z

rpcss is a normal service. Unfortunately it's also the service that had a vulnerability that virus writers exploited. You can read more about it, and try downloading the patch for that vulnerability from here: http://ask-leo.com/d-rpcvuln

Some variations of the viruses actually prevent virus scanners from updating, so it sounds like that's what you have. Try the patch above and see if that doesn't let you make progress.

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from idan on 2004-03-15

2004-03-15T21:31:44Z

Hello Leo !
I have a question for you:
I hav norton NIS+NAV installed on win xp pro, and it can't run anymore, when I restart windows it I can see the icon of nav and nis(with x) and after a few seconds they disapear and I can't run any norton application besides live update, which dosen't work as well. I even tried to install windows on another partition and re-install NIS before even conecting to the internet, and the same happens again... I did update all the leasts updates from microsoft update. I think its a virus, but I can't find it with the pre-installed nis that on the nis-setup-cd or with trend micro online antivirus or fixblast.exe...
is the rpcs service of svchost run is normal ?
if I tried to close it I get the 60secs countdown as in the blaster worm... should this service run by normal use? or is it some kind of virus?

thanks!

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Ovi & Adi on 2004-03-13

2004-03-13T17:44:18Z

My computer is running really slow. A lot of CPU usage is taken by svchost. What can I do? Where can I look for the problem?
10X

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-10

2004-03-10T17:30:21Z

I'll assume you meant "Norton" firewall :-).

So, to find out what 207.46.130.100 is, I went to a command prompt, and typed the following:

ping -a 207.46.130.100

And it tells me that that IP address is "time.microsoft.com" ... so you are correct, it was Microsoft. That instance of svchost is supporting the time service, and has asked time.microsoft.com for the current time. You can change the server it uses, or turn off the auto time update completely, in the same place you set your PC's clock in Windows.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Franz J. Polster on 2004-03-09

2004-03-10T07:37:09Z

I learnt about the existence of svchost.exe just
yesterday, when my Norman firewall, under Windows
XP professional, asked whether task
c:\windows\system32\svchost.exe should be allowed
outgoing communication with protocol UDP
to remote address 207.46.130.100.
What is the purpose of svchost.exe accessing
the internet? What if I deny access (which I did,
without observing any negative consequences)?
Who/What is behind 207.46.130.100 (Microsoft, I
guess!?!)?

Thanks for your reponse in advance

franz

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-03-09

2004-03-09T21:06:50Z

Well, you didn't say whether or not you've run an anti-virus check, so certainly do that. Also check out this article: http://ask-leo.com/archives/000059.html for more steps to take on the svchost problem (read the posted comments as well, many people contributed valuable info). You also didn't say what kind of popups. If you're running XP or Win2k you should disable the Windows Messenger Service (not the IM client, but the service.) I talk about that one in this article: http://ask-leo.com/archives/000017.html

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from theresa darius on 2004-03-09

2004-03-09T18:39:54Z

i cant seem to get rid of my popups, i have used ad-ware 6.0 and spybot but these pop-ups keep coming back...sometimes 60 at a time...i think it is a virus that may have attached itself to my svchost.exe file, i want to remove them, how do i go about this....
help please Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-28

2004-02-29T03:07:45Z

svchost is a required system file - the system can't run without it. You'll need to use one of the removal tools. I recommend symantec: http://ask-leo.com/d-symantecavc - it's also worth reading this article: http://ask-leo.com/archives/000059.html .

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Mike on 2004-02-28

2004-02-29T03:02:20Z

I have a virus that attached itself to my svchhost.exe and svchoste.exe files, since they are running, I try to end process and then move the file to the virus valt (in AVG) - BUT when I end the process I am forced to reboot the machine.

anyone provide any assistance?

Im using WIN XP Home SP1 - thanks

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from khalid on 2004-02-28

2004-02-29T02:21:30Z

Thank you,
I have done that; SFC replaced a DLL and I should have written down which one but did not. My spooler is still not back! any other suggestions

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-28

2004-02-29T00:47:30Z

Yikes! I'd run the system file checker to see if that doesn't restore the spooler. I just posted an article on SFC: http://ask-leo.com/archives/000074.html

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from khalid on 2004-02-28

2004-02-28T21:48:27Z

Okay Leo, I need help, I am running winodws XP SP1 and print Spooler service disappered from Services list. There are no printers listed in printers folder. I cannot add printer. When trying to run the wizard I get Error: 'Operation could not be completed.'
I have deleted the print driver and cleaned the registery.
The only thing I can think of was I was trying to print .prn file from dos prompt and something remove spooler service.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-26

2004-02-27T05:45:23Z

svchost.exe is actually an important and required system component. If attempting to resolve a virus issue has damaged it, that can easily explain all sorts of remaining bad behaviour, even after the virus has been eradicated. My recommendation is to run the system file checker (sfc). I mention it and how to run it in this article: http://ask-leo.com/archives/000053.html - it should repair any damaged files.

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from David on 2004-02-26

2004-02-26T17:37:47Z

Jay trust me you had the blaster worm.....and it is a naste one too

You need to find a program called "FixBlaster" then you need to make sure that you have all the criticial windows updates and that will fix that problem.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from David on 2004-02-26

2004-02-26T17:34:35Z

I have had many of the same errors that you all are talking about but that is just how it all started for me. I got so bad that I could not open any web pages.

what you all should try is got to the site that makes nortons anti-virus and look up

wn32.blaster
wn32.walchia.worm
wn32.walchia.a.worm
wn32.walchia.b.worm
wn32.walchia.c.worm
worm.lovsan.a

That is what I have found no my computer, and only one of them Nortons corp pro found.

Now I have a question. I am really new to all this computer tek stuff and so when nortons or avg could not fix the walchia worm I paniced and tryed to delete every thing to do with the svchost that I could. I deleted the svchost.dll but the svchost.exe would not delete for it was in use to I tryed everything to delete it. One thing that I wish that I do not do was I opened up the properties and at the time there was six (6) tabs and i changed every setting in there that could be changed.

Now I got rid of all the worms but my computer is not working right at all, i think that is has to do with what I did to the svchost.exe. I tried to reformat my computer using my windows XP but it told me that my files were corrupeted and it can not be done.

Please any info about how I can reformate my computer would help.

thank you for your time
david

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-25

2004-02-25T16:21:20Z

That's classic behaviour for one of the viruses that manifests as a SVCHOST error. Check out this article: http://ask-leo.com/archives/000059.html

Good luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Jay on 2004-02-25

2004-02-25T11:16:59Z

Everytime i connect to the internet... after 10 mins or 15... and "SVCHOST.exe - Application ERROR" appears... and when i click... OK my connection will stop responding... and if CANCEL it will debug... but still stop responding... what was it?!?! thanks!

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-24

2004-02-25T04:25:02Z

Tasklist.exe is in \windows\system32 if present. You should be able to find it on your Windows XP CD as well.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-24

2004-02-25T04:22:06Z

Recommend you follow the instructions here: http://ask-leo.com/archives/000059.html and the several good ideas in the comments that follow.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Paul on 2004-02-24

2004-02-25T02:51:37Z

When I type tasklist /svchost I get the following message.

"tasklist not a known internal or external command, operable program or batch file"

I am running XP home on a Compaq presario notebook. The reason I would dearly like to run the program is that my PC is running at 100% busy even though there are no programs active and I am not connected to the net - or anything else.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Bien on 2004-02-24

2004-02-25T02:12:47Z

One of the svchost.exe's on my computer is making my computer's CPU run at 100%. It slows things down on my computer, even though I have good parts. Do you know what's going on?

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Thomas on 2004-02-23

2004-02-23T22:00:37Z

I'm using zone alarm too. and i choose "yes" - nothing bad happend since then.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Kees on 2004-02-23

2004-02-23T10:01:41Z

Through Zone Alarm I learn that svchost.exe want to act as a server. Literally:
Do you want to allow Generic Host Process for Win32 services to act as a server?
Tech Inf.: source IP: 0.0.0.0:Port 5000
Application: svchost.exe
Version: 5.1.2600.0 (xpclient 010817-1148)

["More info" in ZoneAlarm does not really give one more understanding or "yes/no" advice.]

I guess I am not the only one who gets this Question. Pls mail... tks
Curious Kees

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-19

2004-02-19T20:13:54Z

Having everything listed twice certainly seems suspicious. I'd have you start with this article:
http://ask-leo.com/archives/000032.html it's about system slowdowns in general, but many of the same techniques apply. It also points to another article on controlling what happens at startup with instructions on how to use msconfig. I'm curious as to whether msconfig shows everything twice as well. You didn't mention running any spyware scanning software - that's also a frequent cause for startup issues. Again, the article I just referenced discusses that also.

Best of luck!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Bill on 2004-02-19

2004-02-19T17:58:04Z

Leo, thank you for your online forum. My laptop, Toshiba Satellite 1415-S173, cable modem, MS WiFi, Symantec AV and full Security suite has recently required longer and longer to boot. I have tried to find the bottleneck to no avail. Numerous tweak scripts, exhaustive startup manager trials. 1.5 to 2 minutes to get the logon screen and another 2+ to load the desktop. I just found in MS Sys Info, Sys Summary, Software Environment, Startup Programs.....each file is listed twice with NT AUTHORITY\SYSTEM one user and .DEFAULT the other user. This is true for every file listed. Any thoughts? Otherwise, the system performs quite nicely. thanks in advance

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-02-18

2004-02-19T05:20:27Z

I'd use tasklist /svc, as documented in this article, to try and determine which svchost is causing your trouble, and what services it is attempting to provide. That may provide a clue. Naturally I'd also make sure you're up to date on service packs, windows update, virus checks and so on.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from [ZN]-ShiftViper5 on 2004-02-18

2004-02-19T04:20:46Z

On the task manager, I always see svchost.exe. I know that there are several of them, but there's one (listed as LOCAL SERVICE) that steadily takes up CPU usage. When it reaches 50-80%, my programs start to slow down. What causes this and how can I correct it?

2700 MHz, 768MB, 128M nVidia GeForce4 Ti4200-8x (0x0281)
Running Windows XP

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-01-28

2004-01-28T19:18:16Z

Please read this article: http://ask-leo.com/archives/000059.html

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from hridya on 2004-01-28

2004-01-28T19:12:25Z

when i connect to the net after surfing for few minutes i get the svchost.exe error. its a msgbox, asking OK to terminate the program or Cancel to Debug. I am unable to find a solution. I have Win.2000. When u click on Cancel it opens a Visual studio window. I have already formatted the comp and even loaded the latest Internet Explorer version. The problem still persists.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from edd on 2004-01-18

2004-01-18T13:05:38Z

i can't copy and paste since i had the msblast and lovsan viruses.

emil me please on how to fix the problem, thanks

eddstanley@hotmail.com

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-01-12

2004-01-13T05:56:45Z

Everyone who's having SVCHOST errors, please read this article: http://ask-leo.com/archives/000059.html

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from carlo on 2004-01-11

2004-01-11T14:22:35Z

When I connect the internet, I will get the error message: svchost.exe error. Windows will terminate this program. After that I cannot get linked on any website, and my office2000 program will have trouble to run, like cannot run the "copy", "cut" and "paste" fuction, and cannot link to anyother file. What is wrong? what shall I do to avoid this? Please help me. Thanks!

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2004-01-08

2004-01-09T01:34:57Z

I'll point you all at http://ask-leo.com/askleo.html for those of you that need a quick and specific answer. Since this is so common, I'll try to come up with a general answer if I have the time to do the research.

In the mean time, I also encourage you to read http://ask-leo.com/archives/000056.html . Regardless of who you take this question to, there are some common bits of information that will help.

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Rong on 2004-01-07

2004-01-08T07:12:27Z

Right now when ever I connect the internet, I will get the error message: svchost.exe error. Windows will terminate this program. After that I cannot get linked on any website, and my office2000 program will have trouble to run, like cannot run the "copy", "cut" and "paste" fuction, and cannot link to anyother file. What is wrong? what shall I do to avoid this? Please help me. Thanks!

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from jose luis on 2004-01-07

2004-01-07T23:56:36Z

I have a machine like a server, in this pc I`ve intalled dll's, this dlls are functions that make transactions in sql over acces. All work fine, but in any moment appears "error en svchost.exe" this error in the server machine. in the side of the client appear an error "error en internet".
What I can do? what is this error? how can I avoid this?
Please write me to mi e-mail. joseguero@yahoo.com
thank alot for the attention to this trouble.
atte. Jose Luis sanchez from Toluca, Mexico.

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from Leo on 2003-12-14

2003-12-15T05:58:07Z

Question 1: it depends entirely on the operating system version, the filename that should have been specified in the error message, and potentially the applications installed on your machine.

Question 2: svchostC is most likely a virus, I believe. Make sure you're runing a virus scanner, and that the signatures are up to date.

If you need more specific or detailed help, please submit your question here: http://ask-leo.com/askleo.html.

Thanks!

Leo

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.

Comment from GLORIA on 2003-12-14

2003-12-15T04:27:48Z

QUESTION 1:
WHEN I START MY COMPUTER, THE COMPUTER SAYS :ERROR STARTING, MISSING .DLL FILE. HOW DO I RESTORE THE FILE?
QUESTION 2:
WHEN I SHUT DOWN MY COMPUTER, THE COMPUTER SAYS :NEED TO CLOSE SVCHOSTC PROGRAM. I WASN'T AWARE THAT I WAS RUNNING THE SVCHOSTC PROGRAM. HOW DO I CLOSE THE PROGRAM>

PLEASE HELP!

]]>

A comment on: What is svchost, and why is there more than one copy running?

Tech Questions? Get Answers! - Ask Leo! ... by Leo Notenboom
Leo's Answers Newsletter - Ask Leo! in your inbox every week.