# Computer Help -- svchost.exe is eating up my computer



## RangerWickett (Sep 26, 2004)

I noticed that my computer was running low on space, and that it had added spontaneously about 500 MB of files.  I tried first to check for viruses, etc., but it didn't help.  The computer was making a lot of 'thinking' noises (y'know, the little brring that comes when the hard drive is working), and I eventually noticed on My Computer that the hard drive was filling up at a rate of about a meg per second.  Panicking, I started randomly closing programs on Task Manager, and eventually I discovered that svchost.exe was apparently the responsible program.  When I killed it, the space-eating stopped.

So, I'm afraid to restart my computer, in case the program starts up again and fills up my entire hard drive.  I need help to save my computer.

I'm using Windows XP, on an HP Pavilion.

I checked the Windows help, and it suggested I download the newest 'RSA ACE/Agent for Windows.'  I found the website that provides this, but I don't want to randomly download something if I don't know what it does.

I really hope someone here can assist me.  I love this computer, and I don't want to lose it.


----------



## Anime Kidd (Sep 26, 2004)

Svchost sounds familiar. I looked it up in Google and found this. Looks like it is a normal processing thing, but maybe you got something named the same thing and its doing bad juju? Sorry I couldnt be more helpful.


----------



## ASH (Sep 26, 2004)

We had a virus that was calling itself SVChosting... notice the ing at the end... Because we have lots of svc host's but only 1 with an ing.. it was making my cpu usage spike to 100 percent...

It was a virus. I cant remember how we finally got rid of it. But Drew, my hubby knows. Let me tell him tomarrow about it and he should post back...


----------



## jmucchiello (Sep 26, 2004)

How are you going to read this if you don't turn your computer on?

svchost.exe is a normal windows app used by COM objects to "run". Unfortunately, that include malicious COM objects such a ActiveX controls that download innocuously with webpages. A normal copy of XP will have several such running svchost.exe instances to handle normal processees like .NET services.

Assuming you have up to date virus software, you have probably caught some spyware. AdAware should take care of it. But you have to download it and run it.

If you can just kill it from the task manager easily, it may (note: MAY) be all right to just boot up and run a virus scan/adaware check. If neither latest virus scan signatures nor latest Adaware can find this COM object, it will take more Windows-fu than I can impart in this post to help you get rid of it. (It involves poking around in the registry which can be dangerous.)

If it is spyware that adaware takes out. Do yourself a favor and download mozilla since Internet Explorer is your primary culprit in receiving COM objects you don't want from the Internet.


----------



## BluWolf (Sep 26, 2004)

Another good anti-spyware tool is eTrust Pest Patrol from.

Go to www.pestpatrol.com


----------



## Mystery Man (Sep 26, 2004)

How much RAM do you have?

Running SP2 will block most pop-ups that throw spyware on your machine and kick in some new features to your builtin firewall. It also does not allow more than 10 connections to your computer. 
It also has the potential to cause your computer to never boot up again.


----------



## RangerWickett (Sep 26, 2004)

I'm currently just leaving my computer on all the time.  I have 128 MB of RAM.

It wasn't svchosting, just svchost.  And I ran Lavasoft's AdAware and found nothing.  Hmm.


----------



## Ferret (Sep 26, 2004)

My dad fixes comps so I asked him. He's heard of it before, a googling turns up this site about it: 

http://www.kephyr.com/spywarescanner/library/windir.svchost/index.phtml

This site should have about detecting and getting rid of it:

http://www.kephyr.com/spywarescanner/index.html

Basicly it uses the same name, so svchost is a windows file but also a spyware thing.


----------



## RangerWickett (Sep 26, 2004)

Ferret, do you trust this site's information?  Is this 'Bazooka' ad-remover better than Lavasoft's Ad-Aware?


----------



## Dismas (Sep 26, 2004)

Go to www.sysinternals.com and download process explorer, it can show you the command line that each SVCHOST process started with, which might give you more of an idea.

Another couple of useful utilities available are FileMon and RegMon, they show you exactly what files / registry entires are being read / written.

PS. For those really evil people out there it also has a Blue Screen of Death screen saver


----------



## jaerdaph (Sep 26, 2004)

Try Spybot Search and Destroy if AdAware doesn't get it. 

Spybot is probably the best free anti-spyware out there.


----------



## maransreth (Sep 26, 2004)

The only couple of files that add size to your HDD are the pagefile.sys and the hibernate.sys (if you are running it).

Honestly forget about the svchost as some of the others are saying. It is a normal Windows file that needs to do a lot of work.


----------



## RangerWickett (Sep 26, 2004)

So . . . I ought to download more anti-spyware software, and hope that it fixes the problem.  Hrm.


----------



## Ferret (Sep 26, 2004)

I've never used it, but my dad does so thats good enugh for me, he pretty much said "that should work". I have PestPatrol though, but I don't where I got it.


----------



## Truth Seeker (Sep 27, 2004)

*Possible Solution...*

Hi, you should have at least 5 of them running normally, three for System, one for Network Service, and one for Local Service, any more beyond that, then you have problems.

As mention by a few others here, virus, spyware, but also, did you DL the latest updates for your system (All XP related).

A similar case occured in another forum I visited, where the trobuled person, was formatting his system while online(Which is NO, NO, in all cases, never do that).

On the lack of space, with your onboard ram of 128, that means your virtual memory, set by default by XP, is forced to transfer most daily routines to the hard drive's virtual space, to help solve some of the problem, please locate the System icon in the Control Panel Menu, once done. Click on the Advance tab, locate the Performance tab, you will see it deals with Virtual Memory, click the Settings button.

Look for the Second _Advance_ tab again, there, at the bottom of that page, Virtual memory will be.

You will see a number, stating the current size of the _Paging file, _it should be running in 2000's to 3000's mark, this is set by MS, you will have to change this, manually.

Click on the _Change_ button, and now you have enter the _Virtual Memory_ setup, if you have one hard drive, that is okay, if you have two seperate ones, you can shift the virtual memory to another drive, away from the main OS.

Now, since it is set on Default, you will be switching it to manual, don't worry, it will be fine, unless there are more problems you are not telling us about.

Okay, please click on the _Custom Size _feature, the current number in the _Intial Size_ table(both numbers) will be change by you, now, since you have only 128mb Ram onboard, in some writes up, you are suppose to give virtual page of no bigger 1.5 times of current ram, or 2.5, this all depends on what you have originally.

So, it will go like this, in the first box, you would put the number of(1.5 example) 192MB, the second box, the same number, you will be telling the system, it cannot go higher that in use, it is a fixed allocation of resources., but since you have only 128, go with the 2.5 multiplaction 

Once you do this, with the boxes, press the Set Button, and you will be prompted for a reboot, go through that, after clicking all the OKay's to return to main menu.

And there, you will have a virtual memory, that will not expand on demand, as set by MS, and some space is return to you.

It does sounds you don't play games, online, because that 128 will not do. And honestly, I would kick up that memory to 512 at least, trust me on that, XP operating on 128, fully functional is a myth. 

And if you are the type that DL music, burn it off to CDs or DVDs, and get some space back on your system.

Good luck.


----------



## RangerWickett (Sep 27, 2004)

Thanks for all the suggestions and help.  I've got about 4 options lined up now and I'm going to hope one works.  *grin*

At first I thought perhaps it was a bit of spyware, but my server checks how much data gets sent back and forth, and it keeps a running tally.  Even when I had no internet traffic going on, the computer was still using up its memory.  To triple check, I unplugged the ethernet cable, and it did not relent.  So it's certainly a local problem, some sort of program that makes files (though I tried a few searches and couldn't find new files that I couldn't account for, and certainly nothing of 100+ MB).  Maybe it's just using up Virtual Memory, as Truth Seeker suggested.

As for XP working, I just use this frikkin' computer for MS Word, the occasional Photoshop project, and music.  Oh, and did I mention it was originally an older model?  The hard drive's only 6 GB.  I just was worried because the computer had worked flawlessly for the 8 months since I updated to XP, and out of the blue, this problem appeared.

I don't even get the blue screen of death.  I'm not so lucky.  *grin*


----------



## Truth Seeker (Sep 27, 2004)

RangerWickett said:
			
		

> Thanks for all the suggestions and help. I've got about 4 options lined up now and I'm going to hope one works. *grin*
> 
> At first I thought perhaps it was a bit of spyware, but my server checks how much data gets sent back and forth, and it keeps a running tally. Even when I had no internet traffic going on, the computer was still using up its memory. To triple check, I unplugged the ethernet cable, and it did not relent. So it's certainly a local problem, some sort of program that makes files (though I tried a few searches and couldn't find new files that I couldn't account for, and certainly nothing of 100+ MB). Maybe it's just using up Virtual Memory, as Truth Seeker suggested.
> 
> ...



Ugh....only 6gigs????   No wonder, XP updates and installment takes up at least 3/4 of that...wow, it is a miracle it is still running.  And by the way, when your space is being reduce by whatever you DL, you also shrink the virtual space reserve, forcing the system to take some drastic measures, if it is 'system' function on the scvhost.exe, all that the OS might be doing, is trying maintain functionally with all current operations, with what room it has.

And since you DL music, if you are using Peer to peer...those things are active software always.  That might be something you may need to discontinue.

Good Luck.


----------



## Mystery Man (Sep 27, 2004)

Truth Seeker said:
			
		

> Ugh....only 6gigs???? No wonder, XP updates and installment takes up at least 3/4 of that...wow, it is a miracle it is still running.



That and 128 megs of RAM is just barely enough. 512 would be the best, least amount. I have 2 gigs of RAM and my hard drive only spins with I load a program.  You might want to throw a bigger hard drive on there, or run linux.


----------



## Henry (Sep 27, 2004)

I'll go ahead and move this to the computers and software forum, but it looks like you're in pretty good hands, R.  I would definitely follow up on the "more RAM, more Hard Drive, more anti-virus and anti-spyware" suggestions, if feasible. XP has a STRONG need for up-to-date patches and preventative-ware, with or without SP2, and the more software on there, the worse your need for resources gets.


----------



## Plane Sailing (Sep 27, 2004)

Dismas said:
			
		

> Go to www.sysinternals.com and download process explorer, it can show you the command line that each SVCHOST process started with, which might give you more of an idea.




I second Dismas' suggestion. It is really helpful to find what is running in each SVCHOST process if you've got any suspicious about nasty activity going on.

Cheers


----------



## Truth Seeker (Sep 27, 2004)

Plane Sailing said:
			
		

> I second Dismas' suggestion. It is really helpful to find what is running in each SVCHOST process if you've got any suspicious about nasty activity going on.
> 
> Cheers



Oh smack, nice program, just DL it...oh yeah, do get this...one of many steps of curing the ills of computer woes.

*Update*: Just to let you know, this software will possibly make the OS run a sixth svchost exe, after DL that program(and ran it), I notice the increasement, not to worry though, it is not a virus run. Just wanted to kill the fear if you see it running higher in count.

*whistles blowing, hit the 500 mark*


----------



## RangerWickett (Sep 27, 2004)

Heh.  I've had this computer's hard drive since 1999, back when it was operating on 64 MB of RAM, Windows 98, and a 366 MHz processor.  She's been loyal to me, even through two formats of the hard drive and one crashed motherboard.

I've backed everything up, so it's time to check the virtual memory thingy and restart the computer, hoping for the best.


----------



## driver8 (Sep 27, 2004)

Truth Seeker said:
			
		

> Ugh....only 6gigs????   No wonder, XP updates and installment takes up at least 3/4 of that...wow, it is a miracle it is still running.  And by the way, when your space is being reduce by whatever you DL, you also shrink the virtual space reserve, forcing the system to take some drastic measures, if it is 'system' function on the scvhost.exe, all that the OS might be doing, is trying maintain functionally with all current operations, with what room it has.
> 
> And since you DL music, if you are using Peer to peer...those things are active software always.  That might be something you may need to discontinue.
> 
> Good Luck.





Ok I came to this thread late, but it does indded sound like your machine is laboring. A small HD and 128 megs of memory running Xp isnt good. More memory and a bigger HD will probably help. All the processes that Xp has on by default probably all cant get enough to run at the same time.

Did you always have Xp or upgrade to it? Maybe going back to 98 might be easier for you?


----------



## RangerWickett (Sep 28, 2004)

My computer is now down to 220 MB of free space, going down about 1 MB per second, so I have to type fast.  I don't know what's going on, but I know that if I turn off svchost.exe, it stops.  But maybe I should let this run its course.

I've had XP for 8 months, and there has been no problem at all.  My computer looks like it'll die in the next three minutes, so I'll return to this thread from another computer, and hope someone knows how to fix what went wrong.  *sniff*

P.S., this is the result of changing nothing.  I just restarted, on the off chance it'd solve itself, and the computer is still going nuts.  I'm pretty convinced it's not a 'virus,' but maybe some weird coding is going on.  Why would my computer be filling up its memory?


----------



## RangerWickett (Sep 28, 2004)

Okay, so I stopped the process when my computer was down to 86 MB of free space.  *sigh*

I did a search for files modified in the last day.  I turned up one 110 MB file, called:

WindowsXP-SP2-x86fre-USA-2180-psf.blob

Does anyone know what that is?  It's in 
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\8b5e9cdb91dddbb342695fbdc36fe0e4\download

Most of the other files in that folder were created back in 2001 or 2002, so that means they probably came on the XP CD, but this one was both created and modified today.  It looks fishy.


----------



## drakhe (Sep 28, 2004)

*Is it SVCHOST that is eating your PC... not SCVHOST*

Are you shure it was SVCHOST and not SCVHOST? (mark the vc cv difference)

Some time ago I discovered the same kind of symptoms and noticed that there was a couple of SVCHOSTS and one SCVHOST process running (you hardly notice it until you sort the processess on name) Googling for SCVHOST, I found that the latter was indeed a mallicious program. Don't know exactly what I had to do, but I do remember I had to delete a number of files that had 1 letter different from genuine XP processess and had to do some editing in the registry. (notably removing a bunch of entries in the different "run" sections.

So I would say, make double sure what program is causing your problem and if it is SCVHOST, have a google for it and you'l find plenty of hits with removal instructions.

Sorry I can't be more of a help, but I thought the hint might be usefull.

I did get rid of this pest, put took me some effort, initialy I probably missed some files or registry entries and it just kept on coming back. As I understood from some of the pages, has something to do with the system restore function. Most of the pages have you shut down system restore before doing the cleaning.

Do run a good firewall and anti virus program. I've had 2 friends get virusses and worms in the span of a couple of minutes after conecting to the net. ("I'll install the firewall and stuf later, I just want to see if my internet is working.... did they get a wake up call!)


----------



## drakhe (Sep 28, 2004)

RangerWickett said:
			
		

> Okay, so I stopped the process when my computer was down to 86 MB of free space. *sigh*
> 
> I did a search for files modified in the last day. I turned up one 110 MB file, called:
> 
> ...



I'm not sure, but could you have autoupdate active and could it perchance be service pack 2 downloading? The .blob extension would mean Binary Large OBject.


----------



## RangerWickett (Sep 28, 2004)

Re: Drakhe.

I did just swing by the Microsoft website and see 'Service Pack 2' being announced on their main page.  But the thing is, as far as I can tell the problem still happens even when the internet is disconnected, so it can't be downloading something.

Dang it.  I would much rather deal with a crashing computer going to blue-screen than some sort of crazy self-writing loop or something.  And whatever happened to the good old days of "Just make sure you don't open any .exe files from the internet, and you won't get a virus."  Now apparently viruses can just tell my computer to get infected.  I don't like it.


----------



## Truth Seeker (Sep 28, 2004)

Damn, I am sorry to hear that, but with the foremention use of MS software DL on your system, sounds like a preset setup by MS. Let me explain, if your system is still SP1, your system is being prepped by MS for SP2, there will be minor changes, like on your Window Update Menu, that gets a new facelift.

Judging from what you have stated on the space being 'eaten', it does sounds like the system is trying to prep files, and there is almost no space to use.

_The virtual memory(all free space taken up by files) , the 128 memory, almost swallow by OS operations, in other words, you have deny the OS to function normally, and it is force to ultilize what is space there, is left._

RW, I am sorry, but the best bet, of two choices, remove all the non- important stuff, you will need to get a gig of space, and that is pushing it, or...new hard drive, with bigger space.


Sorry my friend, but that HD is done, but please check the spelling on those programs, which I did forget myself, on the letter mixup. I will be posting links (on a new thread) to sites that helps with program file description function, I hope that the mod can make it a stickie, in fact, anyone should post very Helpful links on that, but not before that software was tested by that person themselves(yes, you will have to police yourself, be honest...getting banned is not nice).

It will be up later, hopefully around 1:30 a.m. (sorry, work up to the midnight shift)

*fingers crossed for RW*


----------



## Truth Seeker (Sep 28, 2004)

*Knowledge is Power...*

http://support.microsoft.com/default.aspx?kbid=837783&FR=1


Okay, read this, and see if it make sense to what is going with your system.


----------



## RangerWickett (Sep 28, 2004)

Hmm.  I've got a sudden urge to rewatch 2010, and re-experience the fear of Jupiter turning black, while Dave Bowman assures us that what we are seeing is "something wonderful."

Here's hoping my computer is just trying to evolve into the next level of Pokemon.


----------



## Truth Seeker (Sep 28, 2004)

RangerWickett said:
			
		

> Hmm. I've got a sudden urge to rewatch 2010, and re-experience the fear of Jupiter turning black, while Dave Bowman assures us that what we are seeing is "something wonderful."
> 
> Here's hoping my computer is just trying to evolve into the next level of Pokemon.



Hey RW, I am online, on AOL IM, if you want any more help.


----------



## RangerWickett (Sep 28, 2004)

I deleted a ton of files, defragged my hard drive, and I'm about to restart and see if my hunch is correct that the computer is just trying to do something, and that it didn't have the space to finish doing what it needed to.

My current problem, though, is that I can't get my computer to copy files to CD.  I drag files to the D: drive, they show up as ready to copy, and I click Write to CD, but the computer insists there's no disk in the drive, when both I and my friend watched as we put the disk in and closed the drive.  Unless I've got a portable hole in there, something's fishy.


----------



## Truth Seeker (Sep 28, 2004)

RangerWickett said:
			
		

> I deleted a ton of files, defragged my hard drive, and I'm about to restart and see if my hunch is correct that the computer is just trying to do something, and that it didn't have the space to finish doing what it needed to.
> 
> My current problem, though, is that I can't get my computer to copy files to CD. I drag files to the D: drive, they show up as ready to copy, and I click Write to CD, but the computer insists there's no disk in the drive, when both I and my friend watched as we put the disk in and closed the drive. Unless I've got a portable hole in there, something's fishy.



Okay, let us know the results...nite, nite.


----------



## Plane Sailing (Sep 28, 2004)

RangerWickett said:
			
		

> I did a search for files modified in the last day.  I turned up one 110 MB file, called:
> 
> WindowsXP-SP2-x86fre-USA-2180-psf.blob
> 
> ...




Definitely sounds like WinXP service Pack 2.

It sounds as if you have "Windows Update" set for automatic background downloading of fixes. If you can see the windows update icon in your taskbar (a little world with the windows flag superimposed), click that to show the list of things it thinks you need to download and then look for the link right at the bottome of the dialog that says "Change automatic update settings".

What does it say there? If you are on either of the first two (automatic or download but let me choose when to install them) then that is your problem. Select one of the bottom two (I suggest the third one - 'notify') and the magical growing file should cease to be a problem.

Cheers


----------



## RangerWickett (Sep 28, 2004)

Well, after deleting all my music and AMVs so that I had 900 MB of free space, I restarted and let the computer do its thing.  Eventually, yes, it installed Service Pack 2, but now I'm left with only 300 MB free.  Not really a victory in my eyes, unless perhaps when I restart the computer will clear out its memory cache or something.

Still, at least the computer's not busticated.


----------



## driver8 (Sep 29, 2004)

RangerWickett said:
			
		

> Well, after deleting all my music and AMVs so that I had 900 MB of free space, I restarted and let the computer do its thing.  Eventually, yes, it installed Service Pack 2, but now I'm left with only 300 MB free.  Not really a victory in my eyes, unless perhaps when I restart the computer will clear out its memory cache or something.
> 
> Still, at least the computer's not busticated.




300 MB? Wouldnt your life be easier if you just got a new HD?

Keep us posted please. I want to hear how you make out. Good Luck.


----------



## RangerWickett (Sep 29, 2004)

You wanna pay for my new hard drive?  I've got no job, and E.N. Publishing ain't exactly paying the bills.  If you can get me a job, sure I'll buy a new hard drive, but right now I'm having to ration my tomato sauce and just eat pasta with salt.

Sorry for snapping.  I'm going to get to work.


----------



## redhawk (Sep 29, 2004)

Hate to say it, but if SVCHOST.EXE is crashing your machine, then you've got one of the Sasser variants. Update your anti-viral medicine and do a full scan.

If it's just bloating, then you've got spyware. Ad-Aware and Spybot will clear that right up for you.


Redhawk


----------



## Truth Seeker (Sep 29, 2004)

RangerWickett said:
			
		

> You wanna pay for my new hard drive? I've got no job, and E.N. Publishing ain't exactly paying the bills. If you can get me a job, sure I'll buy a new hard drive, but right now I'm having to ration my tomato sauce and just eat pasta with salt.
> 
> Sorry for snapping. I'm going to get to work.



RW, if getting a new drive will help the problem, then it is your's, but there is catch, your current PC's specs I would have to know, reason, the make and model, the bios and motherboard. The last two are important, because the bios is what runs the machine, and dictate how big of a hard drive you can have.

If you have a 6gig, I hope then it can take a 20 at least...I hope, let me know what you want to do.

Peace.


----------



## Truth Seeker (Sep 29, 2004)

redhawk said:
			
		

> Hate to say it, but if SVCHOST.EXE is crashing your machine, then you've got one of the Sasser variants. Update your anti-viral medicine and do a full scan.
> 
> If it's just bloating, then you've got spyware. Ad-Aware and Spybot will clear that right up for you.
> 
> ...



RedHawk, what is happening that his system has limited space to run the daily functions, he has stated before there has been no virus, what is happened, that Kernel configuration is forcing the issue of trying to use what space is left, that is all...the SP2 setup was the 'problem', as his system was being automatically being prepped for the update...I have posted a Knowledge page link on what space is needed for SP2.

RW's system has uploaded it, but the downside, still limited space, which leaves the virtual memory sector to be forced to work in a very, very tight area, and which of course forces the system itself to highly select the very important files to keep system functionally.

This is his troubles... and the fact, he does have a small single digit hard drive, just adds to it.


----------



## driver8 (Sep 29, 2004)

RangerWickett said:
			
		

> You wanna pay for my new hard drive?  I've got no job, and E.N. Publishing ain't exactly paying the bills.  If you can get me a job, sure I'll buy a new hard drive, but right now I'm having to ration my tomato sauce and just eat pasta with salt.
> 
> Sorry for snapping.  I'm going to get to work.




Hehe no need to apologize. Ive been unemployed too. I was sorta harping on the HD. 

Anyway, good to know at least that like you said, your machine not totally fubared up.


----------



## redhawk (Sep 29, 2004)

I was just going by the symptoms mentioned. I understand he's got a severe space crunch, but one of the things Sasser does to you is it lets you be used as someone else's remote storage dump for infected files.

I do tech-support for a living. 

Redhawk


----------



## Truth Seeker (Sep 29, 2004)

redhawk said:
			
		

> I was just going by the symptoms mentioned. I understand he's got a severe space crunch, but one of the things Sasser does to you is it lets you be used as someone else's remote storage dump for infected files.
> 
> I do tech-support for a living.
> 
> Redhawk



Any openings???


----------



## anky73 (Feb 22, 2017)

I have got some similar problems in the past. (having high cpu usage by svchost)
I did a google search and landed onto this blog post.
https://usefulpcguide.com/18385/svchost-exe-netsvcs-high-cpu/
Do the exact steps mentioned here and let us know the outcome.


----------



## Nagol (Feb 22, 2017)

anky73 said:


> I have got some similar problems in the past. (having high cpu usage by svchost)
> I did a google search and landed onto this blog post.
> https://usefulpcguide.com/18385/svchost-exe-netsvcs-high-cpu/
> Do the exact steps mentioned here and let us know the outcome.




Well, 13 _years_ later I suppose it might still be applicable...


----------



## trappedslider (Feb 22, 2017)

Holy super Necro batman!


----------

