Getting Started with SVCHOST.EXE Troubleshooting

Geek Lectures - Things geeks should know about » Blog Archive » Getting Started with SVCHOST.EXE Troubleshooting

Fri, 11 Jan 2008 15:09:34 GMT

PingBack from http://geeklectures.info/2008/01/11/getting-started-with-svchostexe-troubleshooting/

re: Getting Started with SVCHOST.EXE Troubleshooting

Marcelo — Sat, 12 Jan 2008 06:54:36 GMT

If those services are all smashed in a shared process by default, what would be the IMPLICATIONS in isolating them in its own process? If would not have some obscure dependency aspects (e.g. shared memory for data exchange among some of them, semaphores or locks beind made easier once in a shaed process)... would not they "by default" haveits own process? Before 'isolating' a service I would ask to the team who programmed it WHY they decided to leave that code in that particular shared process/group. BTW, I HATE my wuau - it periodically lenghts computers and their 'cousin' services in their shared svchost. I really have ANY idea what wuau have to do with bits or helpsvc, to be in the same process...

re: Getting Started with SVCHOST.EXE Troubleshooting

Pavan Kumar AR — Sun, 13 Jan 2008 04:58:09 GMT

today, all of us need to be aware of those viruses which will have the names like svchost.exe, svvhost.exe, scvhost.exe and many more which run on administrator/user. If it is a rootkit, then even tuff the situation is, we need to <a href="http://miraclesdooccur.blogspot.com/2007/10/getting-rid-of-svchost-virus.html">get rid of svchost virus</a>. Better be careful than suffer after getting affected.

re: Getting Started with SVCHOST.EXE Troubleshooting

Rob — Sun, 13 Jan 2008 17:18:41 GMT

Marcelo,

Larry Osterman,http://blogs.msdn.com/larryosterman, has some posts about services which share an instance of SvcHost that might be of interest to you:

http://blogs.msdn.com/larryosterman/archive/2005/09/09/463018.aspx

http://blogs.msdn.com/larryosterman/archive/2005/09/12/464077.aspx

re: Getting Started with SVCHOST.EXE Troubleshooting

rob — Mon, 14 Jan 2008 06:43:15 GMT

great post!!

process explorer is also good at peeking whats inside svchost's

re: Getting Started with SVCHOST.EXE Troubleshooting

Gis Bun — Mon, 14 Jan 2008 19:50:36 GMT

First. This is just more like a preamble to troubleshooting. For example, if you looked at the screen capture and found out that the PID ID #1016 was sucking up 100% of CPU time, how would you know which service is causing the problem.

Second. for every SVCHOST.EXE running, it's chewing up memory but I suspect it's small compared to what the actual services running. that said, from the screen capture, would there be any harm combining two or more (such as 2132 and 2192 PIDs).

re: Getting Started with SVCHOST.EXE Troubleshooting

Willy — Tue, 12 Feb 2008 00:39:38 GMT

sc config was THE command I was looking for,, THANKS

re: Getting Started with SVCHOST.EXE Troubleshooting

Jon — Sun, 09 Mar 2008 09:03:44 GMT

my laptop has been crashing for a while, and i ask my friend why this was happening and he said that this svchost.exe has been hogging my memory, its using about 2 times as much memory than that of my firefox.exe, the only problem is that i have no idea how to fix it, if anyone could help me that'd be great.

my e-mail is meluckycoin@aol.com if you want to e-mail, or just post back.

thanks a bunch,

jon

re: Getting Started with SVCHOST.EXE Troubleshooting

Larry — Sat, 10 May 2008 04:42:36 GMT

This is all well and good, but I opened the command prompt and input [tasklist /SVC /FI "IMAGENAME eq svchost.exe"] the system said tasklist is not recognized as an internal or extenal command. Now what do I do?

re: Getting Started with SVCHOST.EXE Troubleshooting

William — Fri, 16 May 2008 05:48:58 GMT

Fantastic information! Thanks!

I've isolated the wuauserv process and even though it still wants to take 25% of my quad system, I now have the ability to lower priority or change affinity w/o affecting the other critical services in the netsvcs group.

It makes no sense to my why they would group these things. Seems to me like it defeats the whole purpose behind a multi-threaded OS.

Of course, I also can't figure why this particular process should need to consume such resources.

Thanks again,

William

re: Getting Started with SVCHOST.EXE Troubleshooting

Geminye — Thu, 12 Jun 2008 00:49:14 GMT

I've had incredible issue with an svchost utiliziing half my duo core 2 cpu and it's a pain in the ass!!! I can't wait to get home to utilize the sc config command to hopefully see this bizarre behavior "go away" - no viruses or spyware/malware and this process seemingly out of nowhere (obviously came from an update or something I can't remember) is driving me nuts... THANK YOU for light at the end of the tunnel... this is neat stuff that may save my sanity :)

re: Getting Started with SVCHOST.EXE Troubleshooting

Dan Huff — Wed, 13 Aug 2008 16:36:29 GMT

You guys are GREAT!

Thank you so much.........

re: Getting Started with SVCHOST.EXE Troubleshooting

Jordan — Mon, 17 Nov 2008 22:17:38 GMT

It doesn't make the problem "go away" but it does let you isolate it. Windows Update is being a pain for me as well.

re: Getting Started with SVCHOST.EXE Troubleshooting

satveer — Wed, 21 Jan 2009 21:31:37 GMT

svc host.exe-application error

the instruction at '0*c00000fd' refference memory at location "0*5b878abg" the memory could not be read.

whenever i am on net my pc hangs wid this error...wat to do

re: Getting Started with SVCHOST.EXE Troubleshooting

Jepethiel — Fri, 04 Sep 2009 09:57:29 GMT

I have the problem of a winlogon screen popup

Svchost:

The instruction at "0x7c91b21a" referenced memory at "0x00000010". The memory could not be "written".

I am running XP Pro +SP3.

Prior to this some months back I acccidentally delete the \Service key in the registry under

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

I discovered this problem when following similar Microsoft documentation (previously Q314056) on SvcHost. This document seems to have more detail. The info about using tasklist /FI "IMAGENAME eq SVCHOST.EXE" /FI "PID eq <PID NUMBER>" wasn't in the document I had.

Also I am wondering why under

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost there are

no REG_MULTI_SZ entries with the services listed

keys are:

DcomLauncher

dot3svc

eapsvcs

HTTPFilter

LocalServices

netsvcvs

PCHealth

termsvcs

most have only one or two

DWORD values such as

AuthenticationCapabilities

CoInitialistionAccess (??? noted at 1:25am)

Are the REG_MULTI_SZ entries necessary for these keys?

Can the deleted Service key values be re-instituted?

If so how?

Do the PID groups e.g

PID Services

1112 6to4, AppMgmt, AudioSrv, Browser, Cryptsvc, Dhcp,

dmserver, EventSystem,

FastUserSwitchingCompatibility, helpsvc, HIDServ,

hkmsvc, lanmanserver, lanmahworkstation,

Messenger, Netman, Nla, Rasauto, RasMan, Schedule,

seclogon, SENS, SharedAccess, ShellHxDetedtion,

srservice, TapiSrv, Themes, TrkWks, XuTuneUp,

winmgmt, Wmi, xmlprov

require a key under HKLM\...\Services\Service to run properly?

Jepethiel