# svchost.exe



## peakhead12 (Feb 4, 2003)

For awhile now i have been having this problem. Whenever i run my pc (it doens't always happen at startup but it happens eventually) programs refuse to run. By programs i mean any and all programs that i click on. After trying some other things to fix the problem, i tried running taskmanager after startup and ending some processes one by one to see if that would help. This is what i came up with. Any time i started having the problem, i would end one of the svchost.exe (svchost not svhost, i dont' have a virus) processes, and then immediately all of the programs that i had clicked on previously would all open at once and i would be able to open any new programs that i wanted to. However, all of the services that the process was handling were disabled like my theme, and all sound through my sound card. Here is a list of the services inside the svchost process that i end to solve the problem(i always end the same one):
-----------------
helpsvc HidServ lanmanserver lanmanworkstation Netman Nla RasMan seclogon SENS SharedAccess ShellHWDetection srservice TapiSrv TermService Themes TrkWks uploadmgr winmgmt
-----------------
Also i would like to add that before i started having the problem msn messenger would act up and freeze, so i uninstalled it and removed all the registry entries, but the problem persisted. Also, messenger used to be in the above list of services run by the process until i uninstalled it.


Any ideas on what is wrong? I'm stumped 
or what i can do?


Here is a list of all of the processes i have running:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.718\StartupList.exe


----------



## SemmySweet (Apr 12, 2002)

From what I read it seems you're running a server. Are you using a WAN based internet service like AOL broadband? I am also unfamiliar with WinRAR. Do you know what program this is associated with? The rest seems normal to me.


----------



## SemmySweet (Apr 12, 2002)

Backing up, I re-read the post. Ignore the server statement. I think I need to go back to english class 101. Sorry


----------



## The_Egg (Sep 16, 2002)

I think you've inadvertently deleted the wrong registry keys.

svchost is messenger
MSN Messenger is MSN Messenger


----------



## peakhead12 (Feb 4, 2003)

I don't follow what you are saying...i was having the problem before i removed any keys...uninstallling messenger and removing the keys it left behind did nothing at all.


----------



## JohnWill (Oct 19, 2002)

SVCHOST is NOT messenger and you do NOT want to tinker with it! Here's a better explanation that I'm willing to type.  What is SVCHOST


----------



## peakhead12 (Feb 4, 2003)

oh, i know what svchost is and what i does, i understand that it is not messenger, but messenger is one (among many)of the services that svchost handles and messenger was the program that was constantly freezing so i decided to uninstall it. The only relevance it has to my problem is that the svchost process that i was ending was handling the messenger service.

I guess the question that i'm trying to ask is why would that instance of svchost be preventing me from running programs?...and is it a coincidence that messenger was constantly freezing and that it was one of the services being run by svchost?

Or better yet do you know how svchost could be involved in this problem? I don't want to mess with svchost, but i need to fix the problem.


----------



## The_Egg (Sep 16, 2002)

Yes, sorry for the confusion . . .
what I meant was svchost is handling the messenger service (netbios, net send), but this messenger service is not MSN Messenger, they are two entirely different things. So, what I was suggesting was that maybe you've deleted some registry keys relating to messenger, not MSN Messenger.

Here's some points of reference:
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q330904
http://www.jmu.edu/computing/security/info/winmsg.shtml
http://www.its.caltech.edu/its/security/users/windows_messenger.shtml

But as you said, maybe we're on the wrong path here, and the problem is being caused by something else entirely.

I think I must've misinterpreted your original post where you said:
"Also i would like to add that *before* i started having the problem msn messenger would act up and freeze, so i uninstalled it and removed all the registry entries"


----------



## yyz (Aug 12, 2003)

Hi people!

I stumbled in here for help with a problem I have been having recently.

I have been getting a window that states something to the effect that "svchost.exe" has caused an error, and an error log will be completed.

This pops up all of the time! Now, my computer wont allow me to do simple tasks.


Cut and paste
Copy and paste
Click on liks while in threads such as these
Add smilies to posts

I know it's piddly stuff, but it makes me angry, and I wonder about deeper problems as this this burries itself in my system.

I even tried reloading my Windows 2000 TWICE, and that damned thing keeps popping up!

All the help that I have been offered on other sites has come up bust.

PLEASE.........Someone rescue my sorry arse!


----------



## RGT (Aug 12, 2003)

I,m having the exact same prop. as YYZ. SVCHOST.EXE. Need help too...............


----------



## yyz (Aug 12, 2003)

I can't open programs, either.

My Norton AV no longer loads, I can't open any site from within another site...........I am ready to quit!


----------



## Asnerolf (Aug 12, 2003)

I thing its a worm, if you don't have a firewall INSTALL it as soon as possible I have the same problem yesterday.

Try to disconnect the netwrok and restart if svchost don't get crazy, you've found the problem.

TO SOLVE IT 
1)Install alarmZome, it prevents the attacks.
2)If you have Servicepack 2 try to install Windows2000-KB823980-x86-ESN.exe you can find it in the Microsoft page.

Good Luck!!!!


----------



## samnitzberg (Aug 12, 2003)

SAME EXACT PROBLEM HERE!!! Has anyone resolved it? Does Asnerolf's suggestion work?


----------



## Aka_Star (Aug 12, 2003)

I got the problem, a lot of people have it too, its a worm virus W32.Blaster. Its a virus that I'm trying to tackle at the moment, I've removed it but SCVHOST still crashes. I'm running the scan for the 2nd time now to see if it has respawned since last reboot. its very annoying because I don't have Servicepack 2 and my 56k modem is gonna struggle to download it -.-


----------



## ktrexler (Jul 13, 2002)

Just stumbling through this room but ya'll need to go look at the "last thread" 

(Shutdown of computer, caused by RPC - if this happens to you, read this..)

It is all about the MSBlast worm that is infecting XP, 2000, NT......


----------



## eric garber (Aug 13, 2003)

Hey guys,

I'm having the same problem with SVCHost.exe... Excel essentially falls apart -- embedded links won't work.. And Access loses all compatibility with Active X / OLE components.

Have any of you guys done the 32.blaster virus removal? did it work on the SVChost problem?

Any help would be appreciated...

Thanks!


----------



## yyz (Aug 12, 2003)

The blaster seems to have cleared up the problem for me.


----------



## spn2k (Aug 13, 2003)

Hello, 

I just installed Norton PF onto my system, and I put it on medium alert. I noticed that when I do a LiveUpdate, the "svchost.exe" problem comes up. Also, two nights ago, my NAV told me that I have that w32.blaster.worm, but when I scanned my comp again, I couldn't find it. Has anyone else go through something like this?


----------



## iamtonit (Aug 13, 2003)

I started having the same problem yesterday. My ISP offered a fix on their page. It is definitely the MSBlast worm. I don't know where I got it, but it is a pain and sneaked in with no warning.


----------



## china-doll (Aug 13, 2003)

I'm beginning to have this problem too [actually, for the last few weeks..], and I'm not sure if I understand, but I _THINK_ you guys said that downloading Serverpack 2 will kill the worm virus?

or should I download the Blaster Worm Patch instead? 

>___< ahhhhh! could someone who's solved this problem please help? thanks a lot!


----------



## Mark710 (Aug 13, 2003)

To secure the loophole that allows worms like msblast into your system you will need to download service pack 4.Do this first then remove msblast.exe from your registry.If you don't fancy messing with the registry then go to www.mcafee.com who have a stinger that you can download that will do this for you.But you need to download the service pack first.


----------



## bluecast (Aug 12, 2003)

I downloaded Service Pack 2 and my computer works fine.. I'm not sure if I should download SP3..


----------



## NatashaN (Aug 13, 2003)

:up: 
Hello.
I didn't know about the forum but, searching about svchost.exe on the web... As you can see, I had the problem with the popup "svchost.exe has generated errors and will be closed..." etc.
A) THE PROBLEM
------------------
As other guys said,
1) my pc turned automatically to safe mode and, 
no copy/paste, 
no download,
not even java were available/effective.
2) My NortonAntiVirus2003 didn't work (I didn't sleep a whole night, because I've unistalled and installed it from the beginning
(all of these terrible things, happened on August 11 to August 12 -perhaps someone had the "idea" of the virus, due to the full moon!!!)  
3) My IncrediMail was disabled!
4) No action was possible in Explorer 6 (I just could typing a site name and then, click the buttons). Trying to click on a link, there was no destination or, the page was blank!
B) THE CAUSE
--------------
Today, my reinstalled Norton, detected the W32.blast.worm and, fixed it! (I forgot to write that, when I reinstalled Norton, the Live Update was "stucked" on Viruses Definition! But, fortunately, a certain time in the morning -It's sure, I was asleep!- Viruses Definition was finally updated).
Although, shutting down and, connecting to the web, on opening the Explorer, the popup "svchost.exe has generated..." etc. appeared.
C) THE SOLUTION
------------------ 
(I hope so!... But, 31minutes on the web and, the popup didn't appear!!!)
1) I've visited www.symantec.com (NortonAntivirus) -they have a very useful tool, the "FixBlaster". You can download it for free and it will do the "dirty work" (it scans your system,detects and fixes the terrible W32.blaster).
(They suggest to run the tool once again after re-boot).
2) I've re-installed Explorer 6 (that didn't was very usefull...)
3) I've downloaded and installed the Windows2000-KB823980-x86-ENU (it is a patch).
I want to believe that the patch has done a very good job because, by now, there's no problem. 
Sorry for this enormous post but, I was mad about the svchost!!!
Good Luck to all of us!


----------



## NatashaN (Aug 13, 2003)

P.S. to my previous post!!!
The link to get the removal tool FixBlaster is: http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html


----------



## aenima (Aug 12, 2003)

i had the same problem, except my system didnt detect any virus, and all i had to do was install win2k service pack 4 and the patch Windows2000-KB823980-x86-ENU .
much easier than uninstalling and starting everything from scratch.


----------



## shy2040 (Aug 20, 2003)

Hi All,

I am a network administrator. I am also facing the above mentioned problems of copy and paste options unavaliable, svchost.exe file crashes .............and so on.

Can anuone reply me with a solution......

Thanks in advance,,,

can mail me the solution at [email protected]


----------



## Ferendon (Aug 13, 2003)

I'm on Service Pack 4, worm free, I have HJT, and SB-S&D, Kerio Personal Firewall.. tried everything... Still have problem's with svchost crashing, and it only happens after I get online, and I have a feeling it's caused by an incoming "net send", which my firewall is set to block, and it's causing the crash because of it. It's driving me up a wall, cause I need my copy and paste, and my new window links, and my WINDOWS MEDIA PLAYER!!!. Anyone have any FURTHER suggestions? and just for the record, WinRAR is an archiving tool similiar to Winzip.


----------



## sirajkm (Aug 21, 2003)

pls give me a solution - i have svchost.exe problem i am having win 2000 pls reply


----------



## Tech_JR (Aug 27, 2003)

Hi. I was reading about the posted messages. I've heard of this prblem before. If you're computer is not yet fixed by now, you might want to download SP4 for win2000 from microsoft.com. However, before you install it, you have to uninstall your video driver because the Service packs have issues with some video drivers. So just to be safe, uninstall the video driver, install SP4 then reinstall the video driver.

Hope it works.


----------



## dazucru (Aug 29, 2003)

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html

Worth running this tool (for some of you anyway)


----------



## bluecast (Aug 12, 2003)

"I'm on Service Pack 4, worm free, I have HJT, and SB-S&D, Kerio Personal Firewall.. tried everything... Still have problem's with svchost crashing, and it only happens after I get online, and I have a feeling it's caused by an incoming "net send", which my firewall is set to block, and it's causing the crash because of it. It's driving me up a wall, cause I need my copy and paste, and my new window links, and my WINDOWS MEDIA PLAYER!!!. Anyone have any FURTHER suggestions? and just for the record, WinRAR is an archiving tool similiar to Winzip."


okay.. did you even kill the msblast.exe process?
delete it from system32 folder
delete it, run a full scan, remove any viruses, post HJT log..


----------



## moose69 (Aug 20, 2003)

Hi 
First use spybot (freeware) to clear out unwanted junk from your machine. Disable your existing fire wall and try Zone Alarm the free version. This has worked for me and my machine is worging perfectly all week. Hope this helps.

moose69


----------



## 4nik (Nov 13, 2002)

I am running win xp , and have the exact same symptoms of the msblaster worm, without any of the actual indicators.
I lose copy and paste functionality, my norton fails to autoprotect, and my sound quits working. If i uninstall and reinstall the driver for my sound card the sound returns for a while, only to disappear again. 

On boot i dont get my desktop icons or systray or taskbar. In order to get the desktop back i have to ctrl-alt-del and kill explorer.exe as well as norton and the use the run command to run explorer.exe.

I have used the fixblast.exe and the fixwelch.exe, antitrojan with latest udates, spybot with latest udpates and a full norton system scan AND a Tren d micro online scan, none of whcih have found anything.

Any ideas?


----------



## ktrexler (Jul 13, 2002)

I used the Servicepack 2 and the following to clear my mom's xp of the blasterworm
http://securityresponse.symantec.co...moval.tool.html 
so maybe it isn't the worm?

Have you tried downloading spybot and spyware blaster? They are great programs to have anyway. Here are the links. I believe you need to post results on here (I got rid of everything that showed on my Spybot/Spyware Blaster but I've read on here where some of the members ask you to post results.....)

http://tomcoyote.org/SPYBOT/index1.html

http://www.javacoolsoftware.com/spywareblaster.html

Also.....and I certainly won't be able to tell you what to do...BUT someone knowledgeable will.......download HIJACK THIS then paste your results here and someone will help you. Don't do anything with the report until someone helps. 
http://www.tomcoyote.org/hjt/

Good luck, Elaine


----------



## 4nik (Nov 13, 2002)

i have applied ALL critical updates as well.

If i cant figure it out by tonight i am going to do an in place reinstall over the current install.


----------



## joeyben (Sep 17, 2003)

my os is windows 2000 pro. i had this exact problem: after 30 sec. from logging on the net this pop up appeared saying: "svchost.exe has generated errors and will be closed by wincows". i couldn't go from within one site to another, Excell was down and media player was not working either.
it was without a doubt a virus. the infamous msBlaster.
all you need to do is remove it - do it with the free FixBlast.exe tool you can get in Symantec.com. then download sp2 for free from microsoft.com and also the patch that FixBlaster.exe recommends.
this will end this problem for good - it did for me
good luck


----------



## 4nik (Nov 13, 2002)

does anyone read the posts???

I DID RUN THE REMOVAL TOOL (nothing found)
I DID RUN CRITICAL UPDATES (all patched)
I DID RUN SPYBOT (nothing found)
among other things
I know you people mean well, its just just easier to read than post.


----------



## joeyben (Sep 17, 2003)

if you read carefully yousaw that ihave win2000 pro, not xp.
i posted for general knowlege and public service and not specificly
good luck anyway.


----------



## ktrexler (Jul 13, 2002)

Dear Nik4.......like Joeyben just trying to help out but I don't see where you posted your HJT info.


----------



## joeyben (Sep 17, 2003)

you can get some answers on this page (microsoft.com):
http://search.microsoft.com/search/results.aspx?View=en-us&p=1&s=0&c=3&st=b&qu=svchost.exe&na=30
i tried no. 319161 - http://support.microsoft.com/default.aspx?scid=kb;en-us;319161 did nothing to solve my problem
hope it will work for you


----------



## wuverton (Sep 20, 2003)

I had a similar problem. Something caused excessive CPU use (at or near 100% all the time) and excessive memory use (kept increasing to near 1GB). This drastically slowed response time of applications. Also, kept breaking Internet connection shortly after logon.

Virus scans did not find a virus or worm. 

I stopped the excessive usage once by deleting processes in task master. But I did not keep track of which process was the culprit. I tried again after rebooting, but could not stop the excessive usage again. Deleting svchost.exe did not help me. Also, svchost.exe kept coming back. Uninstalling things recently installed did not help either.

I did notice that the excessive usage did not occur in safe mode and svchost.exe is in the safe mode process list.

I finally stopped the excessive usage by restoring an earlier system state. Thats another tale of woe. Auto-generated system states would not restore. I had to use a system state I backed up out of curiosity, never dreamed I would have to use it. Of course, I also had to reinstall everything installed after that system state backup.


----------



## 4nik (Nov 13, 2002)

Interesting enough, if i just leave it alone, eventually it boots to desktop. I rebooted before work, came home and all was normal. its a boot time on the order of greater than 15 minutes, but at least it will boot (eventually)
svchost can be many different processes from what i read, different dll's and waht not


----------



## apple (Nov 10, 2003)

http://support.microsoft.com/default.aspx?scid=kb;en-us;319161

i'm hoping this will fix mine...


----------



## 4nik (Nov 13, 2002)

I have narrowed it down to the soundcard...
its a corrupted file related to the sound subsystem i think


----------



## BlackHorseman (Apr 27, 2002)

Hi,

Well, I had it too - svchost would die as soon as connected, or a little bit later, creating many problems, all of which have been listed in this thread (no copy & paste, browser barely functioning, Access can't fine some OLE object etc.....).

First thing I did was to blame ZoneAlarm for it (I have the free version, of course). Ended up installing and uninstalling 5 different firewalls yesterday night, thinking they must have been the cause. After reading this thread I did a full scan with AVG 6(nothing), then started installing updates. My first attempt to install all critical updates at once (I already had SP 4 installed on my win2000) failed. It just hung in mid-installation.

After restarting I discovered that 12 of the 17 updates had not been installed. I had to install them two by two, and restart whenever the svchost error message appeared, cos it rendered Windoze Update inoperative. I think that the problem ceased when I had yet 8 or 10 updates to do, sorry, don't remember which.

The thing that frustrates me most is that I have no idea of what had been wrong and how it's been fixed, or..... I have learned NOTHING from the entire experience, and I guess that was Micr$oft's intention when creating Windoze - to keep the user in the dark, as much as possible.

With Windoze XP we have entered a new totalitarian age.
Time for Linux.....

Daniel.


----------



## beenthere2 (May 21, 2005)

yyz said:


> I can't open programs, either.
> 
> My Norton AV no longer loads, I can't open any site from within another site...........I am ready to quit!


You may in fact have a virus known as the klez virus. That thing is nuts. i serviced a computer that had it. the only place to get the fix is at : http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html


----------

