Helping people with computers... one answer at a time.

If automatic time update is turned on, then it may simply be svchost periodically attempting to access the internet.

Why does svchost access the internet?

This manifests a couple of ways: your firewall warns you that svchost.exe is attempting to the internet, or it attempts to dial your internet provider.

It's probably simple.

You probably have automatic time updates turned on. That runs as a svchost hosted process (What is SVCHOST?), and periodically attempts to connect to an internet service to set you clock for you. You can turn that off by right clicking the clock in your task bar, selecting Adjust Date/Time, and clicking on the Internet Time tab.

Article C2176 - September 1, 2004 « »

Share this article with your friends:

Share this article on Facebook Tweet this article Email a link to this article
Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

29 Comments
Ted
September 16, 2004 11:45 PM

Thanks, Leo. That was helpful information. I'll certainly be on the lookout for the sCV.exe file in future.

Joe
October 14, 2004 6:55 AM

Thanks,Leo for jogging my memory on switching off the clock auto update WRT svchost. It worked!

satya
October 19, 2004 6:32 AM

is it possible to change contents of registry by some program (without users notice). if this happens, i tell/warn u that chances are that it could send critical info to hackers.

If someone can help me by explaining weather registry contents(services part) can altered/added/changed and how this can be ahcieved then i would be very thankful to those whoever helps me.

Iain
November 4, 2004 9:50 AM

I think that you will find that it attempts to access the net far more frequently than you realise (averaging out about once per minute).
I am using XP Pro - SP2.
I have written an email program and it is not allowed to connect to the POP server unless I let svchost.exe send whatever it wants to send!

Jr
July 5, 2005 3:43 PM

svchost IS definately required to connect to the internet in once instance. that is for updates from the Windows update website, if it is disabled when trying to connect then the site will not work.

Tom
July 21, 2005 5:28 AM

It's very likely that windows' automatic updater is at work here. What is very strage is that on my machine, it sent out far more data than it downloaded. From now on, only manual updates for me.

Steve
August 22, 2005 8:47 PM

I'm having problems with my office network in that my client computer continually dials out to the internet and the only way to stop it is restrict access to that unit.

I installed a firewall and that indicated to me that svchost.exe is the culprit and as above, I've switched off Windows XP auto-update and the date/time synchro, but the little bugger is still trying to connect to the internet.

Given that svchost is merely the 'taxi service' to the internet, how do I check to see who the passenger is? ie: which program is using the svchost to get to the internet?

Leo
August 26, 2005 8:03 PM

You should be able to use sysinternals process explorer ( http://ask-leo.com/d-procexp ) to see the command lines and parameters used for each instance of svchost. With procexp running, right click on the svchost you want to look at and hit properties.

Herbert Talabis
December 5, 2005 7:16 AM

Thank god for clearing it up! It happened to me last week & not knowing what the problem & to do. Just unbelievable! It consumes & create incoming traffic activity on my internet connection. Stupid of me leaving the problem behind!

Victorious
January 2, 2006 1:13 AM

Great info -

I think you may have some of the best info and best callers on the web.

So then it is ok for SVChost to access the internet? I currently have it blocked by my firewall (ZA).

Steve
September 9, 2006 1:04 PM

I accidently deleted the svchost.exe for my interent (I ended the process in Task Manager because it was hanging up). How do I go about reloading it since my internet does not work any more?

Thanks for any help that you can give me.
Steve

setagem
October 6, 2006 11:38 AM

I have several svchost processes running, local, and system. I have ended these processes in task manager they just come back. When I ended the system svchost my system automatically starts to shut down says nt authority system will shut down and starts at 59 seconds. when I bought a new laptop before I had access to the internet I checked task manager and svchost was a running process upon 1st boot. How do I find out who is using this system, can someone provide link to obtain detailed info about this process? Also why doesn't any of the anti-spy etc software even acknowledge this process if it is indeed spying?

Leo A. Notenboom
October 6, 2006 11:59 AM

Because svchost is not spyware - it's a critical system component, and there are SUPPOSED to be multiple copies running. Check out this article: http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html

Rui Rocha
October 30, 2006 10:14 AM

I have the same problem. When i turn my modem it appears lots of black windows and in the top there is name of the program: scvhost.exe. You say that i must click the clock in my task bar, select the function "Adjust Date/Time" and to click on the "Internet Time tab". I use the windows 2000 and i don't find the "Internet Time tab". Can you please tell where is it? Thank you very much.

David
May 1, 2007 4:17 AM

i also have timed sync turned off. automatic updates turned off, automatic updates uses this process, and have also tiem sync in services.msc and in the registry disbled, however it still tries to access the internet on XP SP2, i have no malware, viruses, etc.. I've scanned ....


only time i need to allow svchost access to the internet is when i do a manual auto update thru the MS website, i only do that to see what i need to download from the download section, once that is done i deny it again. Also when i allow it access or turn the firewall off to allow all, and since auto updates is turned off and stuff, and i have processguard, it downloaded something and wanted to install a pack or something from the updates distribition folder and minad you i am spyware clean, it did this twice, I only allowed all once because i was too lazy to go back into the firwall rules and re-allow MS player access to the internet to get info. on the CDs i am ripping or just ripped to mp3..

So MS spyware is = true

Beware of this and DO NOT allow it access to the internet, unless you do autoupdates which you should not, or allow it access only when looking to see what updates one needes to download manually.. and also to re-check to make sure one has the right ones...

AGAIN THIS IS MICROSOFT SPYWARE DON't DELETE IS AS IT WILL MESS UP YOUR SYSTEM. just don't allow internet access unsupervised..

Yogi
February 9, 2008 1:47 AM

google pack's updater, updates using svchost.exe. so if u have the google pack installed, probably thats what is happening.

Anthony
March 7, 2008 11:47 PM

Why?
Why?
Why?

Hohoho...
First, I have turned off my Automatic Updates, and I have trun off Automatic update for my clock, but, it still access my internet connection, and it have used 20MB per hour!!!
Please guide me, Thanks...

samer
May 19, 2009 1:03 AM

Hi every one I trun off the time update but it's still sending packets

Foog
June 27, 2009 5:31 PM

Mine tries to connect 50000 times a day and I have time service and automatic updates off.My services have NOTHING that should need to connect to the internet I have static ip mac filtered through a NAT router.
So it is definitely MS spying because the IP's are MS ip's.
BLOCK IT!!And Explorer.exe.
They are spying on you.

Ferry
July 4, 2009 3:35 AM

But if i blocked it...i can't access to the internet...i can log in on yahoo messenger or browsing from my firefox..
I've turn off time update...but it keep trying to access the internet...
if i allowed it...the send and receive bytes is increasing...although i don't use anything...help me ~~'

Ferry
July 4, 2009 3:36 AM

i mean i can't log in...

Naheed
July 9, 2009 10:41 AM

When I view my firewall I see svchost.exe using the internet even when all my applications are closed. I have turned off automatic updates. Is this because of a virus or something? Any idea please help.. Thanks

Rehan
October 2, 2009 1:23 PM

Its because svchost.exe is a windows process and when we visits many websites in a small span of time
the cached data & temp internet files saved in our PC request svchost.exe to avail them out bound internet connection.
simplest way to get rid of such happening is that always remove temp files & clear cache items.
check your antivirus firewall their you can stop all out bound TCP connection which will make your internet connection stable until you access it.
Enjoy surfing

Temp files have nothing to do with svchost.exe accessing the internet.
Leo
03-Oct-2009

HumanCHeck
October 17, 2009 8:19 AM

People please do not allow svchost.exe to allow access to internet I WARNED YOU.

What you are seeing is a rootkit masked as a svchost to access to the internet. Trust me if you check task manager there will be tones of svchost .exe there but there is one hidden svchost .exe that is running hidden which is why firewalls are reporting the service trying to access the internet .

Most of the time it will contact some Russian servers and relentlessly retries to connect them if you engage internet lock.

la2atom.ru 81.177.157.74
battlecore.ru

SmarterThanYou
December 22, 2009 8:07 AM

You are full of BS, MS is NOT spying on you. Why would they even care about you anyway? Windows also tries to update root certificates as well. You can disable that by removing update root certificates from the Add/Remove Windows components. If your computer was part of a domain at work, and you brought it home, it will try to find the domain periodically as well.
Please stop spewing garbage.

Chem
February 25, 2010 5:47 PM

i've been tracking SVCHOST.exe each time he tried to access internet.I've notice what their IP are.
Of course,there is microsoft,but there are also strange things at strange moment.
When i install a program for example,SCVHOST connect to an ip with no Relation-ship with the installed program.This programs may want to access internet but why SVCHOST ???

Another thing is that most ip concern concern internet access provider CONCURRENT to mine.
I have nothing to do with them.why SVCHOST try something with them...

Finally,i decided to block it temporarly

Kevin
March 16, 2010 10:23 PM

Recently my firewall popped up saying that svchost.exe is invading, i know almost nothing about computers so i blocked it thinking it is something bad. But this warning would keep popping up every few mins so i decided to allow seeing what will happen.
nothing happened untill i closed the laptop and opened it again the next day.
when ever i would try to open internet or firefox it would just close by it self automatically.
i tried to change the firewall but there are many svchost, i tried blocking them all and allowing them all but nothing would happen

Brendan
October 12, 2010 7:22 AM

Don't ask me why but utorrent udp connections can show up as svchost in your firewall log. Though I am sure that many applications can can be the cause.

Killerbeenl
January 27, 2011 1:38 AM

I've simply disabled windows time sync. And svchost didn't try to connect to the internet anymore. Proving this "request" was for the clock in my case.

Be sure to keep your clock sync'ed some other way then. It's important for several reasons.
Leo
27-Jan-2011

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to http://askleo.com/ask to ask your question.