Svchost.exe keeps crashing! Created 17 years ago2007-04-05 18:38:36 UTC by RotatorSplint

Recently, I've been having a bunch of trouble with one (perhaps two, I'm not sure) of my svchost.exe processes running in my background.

Normally, my problematic svchost.exe looks like this:But after I wait a few minutes:Svchost.exe takes up a shitload of RAM and CPU power (not seen in the screenshots above) and then crashes. As it crashes, M$ Visual C++ Debugger comes up in two instances, asking to debug two of the several svchost instances (That's why I'm not sure if it's one or two of them that's problematic).

Without this instance of svchost.exe running, I cannot play video and my computer can't put out any sound at all - not even music from WMP.

I have only been able to resolve the problem with a system restore several times, but a few days after each restore, it returns. I can't think of any program I may have installed to cause this problem.

Any ideas?

A windows update caused this.

See: http://twhl.co.za/userprofile.php?user=Habboi

Habboi's journal. He had the same problem me thinks.

Yes and no.

I don't no if this is the same problem but what I did learn is that more than one SVCHOST means one is a virus.

But MS released a patch to fix it...

http://swigartconsulting.blogs.com/tech_blender/2006/07/windows_update_.html#c23921593

Try reading that.

More than one svchost doesn't means its a virus.

As soon as I installed windows on my new computer, there was about 5 of them right off the bat without internet.

I dont even get what it does.

EDIT: http://www.neuber.com/taskmanager/process/svchost.exe.html

I've got five too.

I told you to de-activate automatic updates. People never listen...

Funny thing is that nearly every time I power down, it asks me if I want to install updates, which I know I already have. It's as if it's failing to install them. How would I turn them off?

Oh, and ZL, I was having this problem long before you told me to turn off updates

Also, I have SIX instances of SVC host running.

I just restored to 5 days ago and I'm still having trouble. No sound is being put out, and when I get warning messages, like "would you like to save this document", my case speaker beeps, rather than my regular speakers.

Lawl 6 oh noes.

If you bothered to read the link i posted, it doesn't matter how many, as each monitor a different area. It can go up to as many processes as you have if it wanted to.

Yes, I already know what svchost does. I'm not an idiot.

Reading posts saying that one too many could mean a virus, though, makes you a little suspicious.

I say you do a simple non-invasive reformat of all your drives and unplug the internets!

you can end the svchost procress. It'll start itself up again from fresh, and will therefor stop doing whatever its doing that's using that much RAM... But perhaps after a while, it'll just start doing it again, so not a long-term sollution.

And from that same article 'Don't end it cause your PC needs it to run...'

I actually ended it not too long ago and my PC lost it's desktop background and the theme was set to Classic and there were no other choices...

Yes, because when you killed svchost you terminated the themes service. Killing svchost doesn't cause any problems for me.

Meh well I can't say this PC is going so well at the moment so I guess that explains a few things.

Anyway yeah just scan for viruses and if you get zilch then I have no idea but maybe take on the re-format advice :S

Jeez, the solution is simple. Remove the kittens from your motherboard. They are obviously stealing all of your megahurtz.

Not much to contribute other than full virus scan, and possibly backup and reformat :

Symptom?
MEGAHURTZ DISAPPEAREDED.

Cause?Solution?
Remove kitty.

RotatorSplint, how'd you get resource usage down to 20 processes and 200MB? It's always 34 and 300MB here.

there are quite alot you can kill. I think thers only a few that MUST be running. You can kill "explorer" for example

Uh, you can't kill explorer or else you lose your taskbar

@Dave: Start > Run > MSConfig > Turn off a bunch of stuff

@Everyone else: I've done a full virus scan, opened MSConfig and turned off a few more programs, and did a system restore 2 days ago. The problem seems to have resolved itself, but I'm sure it will come back soon. I'll use this thread if it does.

Uh, you can't kill explorer or else you lose your taskbar

Who needs a taskbar? You can always restore it with ctrlaltdel -> start new -> explorer.

Make sure it isn't a fake svchost or a malicious service first. Search on C:/ for "svchost" (with Advanced Options ticked, so you can search for hidden/system files) and make sure there is only ONE copy on the drive, which should be located in "C:/WINDOWS/system32" or "C:/WINNT/system32".

"svchost" is a host process for apps that run as services, so it's is perfectly normal to have multiple copies running at once as there are a number of services that come with Windows that run under svchost.Look for any services that look suspicious, don't have anything todo with programs you've installed or drivers you are using, or that don't have the Manafacturer field as "Microsoft Corporation" in the Services tab in MSConfig. Having multiple copies of "svchost" running is TOTALLY NORMAL, I repeat, TOTALLY NORMAL, as many services use it as a host, hence why it is called "service host", however there are alot of trojans and viruses out there that masquerade as legitimate services that use svchost.

I've seen one virus that created 2 services which were flagged as "essential", and when one of them was disabled/removed/stopped the other one would recreate it, so be aware of what the usual processes that run under Windows are.

And don't go stopping random copies of "svchost" from Task Manager, as you aren't doing anything except from stopping services. If you stop the copy that is hosting the Remote Procedure Call, you'll get a cute message telling you that the RPC has crashed and your box will restart after a number of seconds (usually half a minute), this is normal behaviour too, as the RPC is a vital part of WinNT. If you stop the copy of "svchost" that is hosting "Windows Audio", your audio will stop working as this is a layer between the sound drivers and the kernel (if I remember).

As for your memory-hogging "svchost", you most likely have a malicious service, or a corrupted service being hosted under it. You should try disabling all but the necessary "svchost" services in services.msc (you can see which ones use it in their properties page) and reenabling them until you find out which one keeps bugging you, when you know which service is causing the problem, tell me which.

Will do.

what m0p said

qft.