Comments on: How To Identify What Programs Started svchost.exe in Windows

By: Md Rabeul Hasan

Md Rabeul Hasan — Thu, 15 Dec 2011 17:05:46 +0000

When i used internet in my computer after some time net connection error.then show a logo "svchost.exe-Application Error.so tel me what is the problem in my computer?

By: Damian

Damian — Mon, 28 Feb 2011 10:02:51 +0000

well Mike,
and mouse right-click anywhere on the cmd screen
gets you the command line cut and
paste option to avoid typing.

regards
Damian

By: Mike Boyds

Mike Boyds — Sun, 27 Feb 2011 21:08:50 +0000

@Damian

From the article:

Open a command prompt and enter:
tasklist /svc /FI "IMAGENAME eq svchost.exe"

Typing commands in "Run" will cause it to "flash". That's why you need to run it from a command prompt and not from the "Run" box.

By: Damian

Damian — Sun, 27 Feb 2011 16:41:19 +0000

Sorry mate,
but I can understand Bagby's frustration.

identifying is something different then ending up with
a variation of names (processes). that's what I came for
and I am left with this:

AudioSrv, BITS, Browser, CryptSuc, Dhcp,
dmseruer, EuentSystem,
FastUserSwitchingCompatibility, HidServ,
lanmanserver, lanmanworkstation, Netman,
Nla, seclogon, SENS, SharedAccess,
ShellHWDetection, Themes, TrkWks, W32Time,
winmgmt, wscsuc, WZCSUC

one of them recreates the System Volume Information (SVI)
although it was deleted before. System restore is off and no virus
for sure. Unlocker has to kill svchost.exe first before it can delete SVI.
after killing svchost the processes above dissappear from the list.
works sometimes until reboot , sometimes only for minutes.

so where to go from here?

regards
Damian

ps
xp "Run" flashes the list because of its auto exit.
that "tasklist /svc /FI "IMAGENAME eq svchost.exe"
needs to placed in a batch file adding the command "pause'
on a separted line.

By: Frank

Frank — Fri, 10 Dec 2010 08:59:41 +0000

@mariposa:
Try: Malwarebytes, Spybot, rkll, Avira. Read up as much as you can prior to use. They aren't too difficult to use. Also: C Cleaner, Advanced System Care, Iobit.
Whilst one antimalware may find some malware another may find other malware.
It is better if you can have two computers having the info on one whilst doing the job on the other. If you don't have two computers then print the instructions.
It can sometimes take a couple of tries with the above before things are cleared up. It can take a long time as one antimalware is used at a time.
Do the scans overnight, it can take 3 to 4 hours to scan my computer.
There is also chkdsk (checkdisk) which is in XP, part of MS Windows.

There is info' regarding the different types of malware and what they sometimes look like.

By: Aaron Hopkins

Aaron Hopkins — Fri, 10 Dec 2010 01:17:45 +0000

@Bagby>
What a turd burglar you are! your post proves you can read, but doesnt prove you can listen.

If "How To Identify What Programs Started svchost.exe in Windows" and
svchost.exe (768) DcomLaunch, PlugPlay, isnt clear enough for you; Then i suggest you buy a mac.

By: Bagby

Bagby — Mon, 06 Sep 2010 15:32:38 +0000

Just wanted to point out that the article *is* a failure.

The title is, "how to identify what programs started svchost", and in that, you have failed completely. The most relevant thing that you have to say is,

"It's unknown as to exactly how and why svchost.exe runs in this fashion,…"

I feel deceived and mislead. This does not tell me how to identify what started it, and so brings me no nearer to the solution to my problem.
I'm off to try to find something that actually answers the question that was asked. I'd appreciate it if you changed the title so that future searchers won't be mislead into coming here thinking there are any answers to that question.

By: Juicey

Juicey — Wed, 18 Aug 2010 22:17:12 +0000

@Watching The Net: I have Windows XP Professional SP3 and yet I get the same error as Justin O when I try to use the tasklist command in command prompt. Will look at Process Explorer. Several times I've killed a sprialing svchost.exe process which was eating up memory which has usually resulted in my sound device subseqently not being recognised by my pc until I reboot. I notice wmprise.exe regularly runs. Have AVG and FIREFOX which I'm aware seem to have conflicts.

By: Bill Gates Needs to Get Cancer

Bill Gates Needs to Get Cancer — Fri, 09 Jul 2010 23:12:19 +0000

I have had it with MS and the malware they call an OS. Switching to Ubuntu and getting Windblows off of my perfectly good Sony Vaio.

Die a horrible death Balmer and Gates.

By: Pharme140

Pharme140 — Thu, 08 Apr 2010 11:35:04 +0000

Hello! abgcefa interesting abgcefa site!

By: Frank

Frank — Tue, 26 May 2009 21:30:32 +0000

Sometimes the red light is on constantly on my PC.
Sometimes when I leave the comp' the red light is on constanly.
If I move the mouse or press a key the red light slows and then flashes slowly.
Recently I managed to open task manager and could see that svchost.exe and wuauclt were busy in processes.
The OS is supposed to be W XP Home, sometimes it is W XP Professional, it depends what I happen to look at regarding info' it has on it.
I was able to put the tasklist etc into command prompt and it gave a list of the svchost.exe.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\home>tasklist /svc /FI "IMAGENAME eq svchost.exe"

Image Name PID Services
========================= ====== =============================================
svchost.exe 700 DcomLaunch, TermService
svchost.exe 780 RpcSs
svchost.exe 848 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1116 Dnscache
svchost.exe 1268 LmHosts, SSDPSRV
svchost.exe 1844 WebClient
svchost.exe 2328 stisvc

I was able to select-copy-paste the result as you see it above from the command prompt.
Qs: Why are the numbers different?
Does anyone recognise any malware in amongst the list?

By: Arshan

Arshan — Wed, 25 Mar 2009 16:12:10 +0000

If you are comfortable working with the Registry, you can get a good understanding of the description & functions of Svchost.exe at http://support.microsoft.com/kb/314056

By: Watching The Net

Watching The Net — Fri, 20 Mar 2009 16:48:45 +0000

@Justin O I did a little digging and found that tasklist is not included with Windows XP Home editions. Instead, use Process Explorer (mentioned in the article). Or if you have access to a computer running Windows XP Professional, you can copy tasklist.exe to your computer (just copy it to \Windows\System32 folder).

By: Justin O.

Justin O. — Fri, 20 Mar 2009 13:59:56 +0000

I'm running WinXP SP2 Home. When I enter "tasklist….." in a command window, it says " 'tasklist' is not recognized as an internal or external command, operable program or batch file."

By: mariposa

mariposa — Mon, 23 Feb 2009 15:48:16 +0000

i have process explorer. and i know i have a yucky trojan/malware problem i have been trying to get rid of unsuccessfully so far. and i have concluded through various malwarebytes anti malware scans and sd fixes etc etc that the file or shellpaths of the 2 rundll32 processes listed are in fact this trojan. ive always been unsure about the svchost.exe processes… but when i looked at the 'properties' of the process, i noticed it named the "parent" of this rundll32 (run a dll as an app) process, which was svchost.exe and in parentheses (916)
and there is a svchost process (916) in my list. i want to kill the process but i want to make sure its not an important process that also handles things my computer cannot function without, despite its infection.
can you tell me if its ok or not to just kill that svc host process its parented by?
im super tired, i hope all that made sense

also, what happens when you "suspend" a process>?

THANKS!!