Helping people with computers... one answer at a time.

When reporting a failure it's important to include all the relevant information. We'll outline some of the basics that help get your question answered.

I keep getting SVCHOST failures. Why?

I'm seeing a questions about svchost failures come by on the Ask Leo! web log on a regular basis. Unfortunately most of the questions are just about that detailed often without even including the message text. So I'll cover here what a good error report looks like and then include a few steps that may start to help identify the cause of some of these svchost related failures.

In order for any technical support resource to assist you with a problem there are a number of standard bits of information that you should just always provide up-front. Most are easy and if you don't supply those they're just going to ask you for them anyway. Why not speed up the process a little by providing these details from the very beginning:

  • The operating system you're running, and its version.

  • The machine brand, its processor speed and the amount of memory it has.

  • Any hardware add-on devices that you think might be related to the problem you're seeing.

  • Whether or not you are running a firewall, a virus scanner, or a spyware scanner, and what brand and version of each.

  • The exact text of the error message, if any that you are seeing. I know this can be a little bit of a pain, but the exact error can convey a lot of information. And trust me, this more than anything else, will be the first thing that your technical support person will ask about. (I've got a few tips on capturing those messages here.)

  • If the problem is reproducible a summary of how to make it happen.

  • A list of any changes that either happened or that you perhaps made to your computer around the time that the problem started; particularly any software or hardware that you installed or setup.

Now, on to svchost. Svchost is particularly hard fella to diagnose because as I outlined in a prior article there are typically several copies of svchost running at the same time.

In addition to the information above I would collect the following to begin diagnosing a svchost related problem:

Any change in behavior after the failure. Does something stop working once you've experienced the error message referencing svchost and if so what?

Capture the output of "tasklist /svc" if at all possible after rebooting but sometime before the svchost related failure. Then after the failure run "tasklist /svc" again and see what if anything is different.

That's not meant to be a solution but a starting point. That information might be enough to help you understand what's failing. If not it's valuable information for the technical support person you'll be talking to.

Article C1878 - January 7, 2004 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

9 Comments
LeoN
January 12, 2004 9:55 PM

See also the follow-up article here: http://ask-leo.com/archives/000059.html

Ben Nay
February 25, 2004 3:37 PM

When I start up my computer, the background freezes up and it takes a while to unfreeze. Then it shows an error message that says there was a problem with svchost.exe. The program had a virus before and I think my virus scan deleted it. How do I restore or fix the file? If it helps, I am running Windows XP on a Dimension 4550 computer.

Leo
February 25, 2004 5:42 PM

My recommendation is to read the article referenced in the previous comment, and then make sure your virus checking software has an up-to-date database and re-run. Some viruses are hard to clean, and depending on which, several virus software manufacurers have specific clean-up tools. I tend to visit Symantec (http://ask-leo.com/d-symantecavc ) they've proven to have very reliable information.

Good luck!

Leo

adrian3k
April 3, 2004 7:04 AM

C:\Documents and Settings\^nEgAt!vE>tasklist /svc

Nazwa obrazu PID Usługi
========================= ====== =============================================
SVCHOST.EXE 612 RpcSs
SVCHOST.EXE 648 AudioSrv, CryptSvc, Dhcp, dmserver,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, lanmanworkstation, Messenger,
Netman, Nla, RasMan, Schedule, seclogon,
SENS, ShellHWDetection, TapiSrv,
TermService, Themes, TrkWks, uploadmgr,
winmgmt, WmdmPmSp, WZCSVC
SVCHOST.EXE 724 Dnscache
SVCHOST.EXE 736 Alerter, LmHosts, RemoteRegistry, SSDPSRV,
WebClient


after the shutdown of the svchost.exe(99%CPU use) or after BEEP(and crash) i get this msg :

C:\Documents and Settings\^nEgAt!vE>tasklist /svc
BŁĄD: Serwer RPC jest niedostępny. (There is no RPC server)

-=-
this one is making problems :
SVCHOST.EXE 612 RpcSs
-=-
Any solutions Leo ? Thx :)

Leo
April 3, 2004 9:23 AM

That's almost certainly a virus. Check out the article and subsequent comments here: http://ask-leo.com/archives/000059.html

Good luck!

Leo

Mark Richards
July 8, 2005 11:27 AM

I tried every program that you mentioned in your article and I still have the error message at the start of WindowsXP. 'Windows cannot find C:\windows\svchost.exe. Make sure you typed the name correctly, and then try again. To search for a file, check the Start button, and then check Search.'

Any suggestions?

Thanks,
Mark Richards

Leo
July 9, 2005 8:44 AM

Sounds like something has added that to your startup. Have a look at this article and see if there's a startup entry for that you can remove: http://ask-leo.com/whats_all_this_stuff_running_after_i_boot_windows.html

Ilian
August 24, 2006 3:00 PM

I used Internet Connection Sharing For My second PC. And i Have problem with the Internet ... It's show one windows from Microsoft Visual Studio 2005 and it want to debug svchost.exe [ pid 1232 ]. and whes that windows show the internet at the second pc stop. i've check tasklist /svc for that proccess. It's show that:
svchost.exe 1232 AudioSrv, BITS, Browser, CryptSvc, Dhcp,
dmserver, EventSystem,
FastUserSwitchingCompatibility,
lanmanserver, lanmanworkstation, Messenger,
Netman, Nla, RasAuto, RasMan, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, TapiSrv, TrkWks, W32Time,
winmgmt, wuauserv, WZCSVC.
And when the windows for debug show there isn't the proccess svchost.exe with pid 1232 ...
Any solutions ???

Sorry for my Bad English

Gabriel
August 5, 2007 2:08 PM

System:
Microsoft Windows XP
Professional
Version 2.1.2600 Service Pack 2
Computer:
Intel(R) Pentium(R) CPU 1.50GHz 1.52GHz

Anti-virus:
NOD32 anti-virus system

Firewall:
Windows,also the firewall included in my antivirus

excuse me Leo i have a problem with svchost it keeps getting an error down here im going to type everything than appears on that error window:


Generic Host Process for Win32 has encountred a problem and needs to be close.

Error signature

Event type:BEX P1:svchost.exe P2:5.1.2600.2180
P3:41107ed6 P4:netapi32.dll P5:5.1.2600.2756
P6:432105e7 P7:0000a510 P8:c0000409 P9:00000000

The following files will be included in this error report:
C:\DOCUME~1\user\LOCALS~1\temp\WER9057.dir00\svchost.exe.mdmp
C:\DOCUME~1\user\LOCALS~1\temp\WER9057.dir00\apprompat.txt

that's all
i hope you can help me
Any soultions to this problem?

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.