SVCHOST.EXE annoyance

[Dan Drewry]

Lately, my ZoneAlarm firewall has been popping up with warnings that
Generic Host Process for Win32 Services is trying to act as a server,
and other times wants to accept connections from the internet. The
program is svchost.exe. I keep responding with "deny". This is happening
with increasing frequency - many times a day. When I asked about this
previously, I was told ZoneAlarm keeps allowing this to happen, even if
you tell it not to.
My question is - what is svchost.exe? Is it a necessary program that I
can't just delete? This thing is really bugging me.

 

[JS]

From Ramesh's web site: http://windowsxp.mvps.org/svchost.htm
Also: http://support.microsoft.com/?kbid=314056

To find out more about Svchost.exe entries try Process Explorer:
http://www.microsoft.com/technet/sysinternals/SystemInformation/ProcessExplorer.mspx

Once you have Process Explorer installed and running:
In the taskbar select View and check 'Show Process Tree' and the
'Show Lower Pane' options.
(This will provide some of the detailed info you may need)

Next expand the Process tree until 'Services.exe' has been expanded.
Next move the mouse cursor over the Svchost.exe process that you are
interested in.
Or expand the Svchost entry if you see a + sign to the left of Svchost
entry.
(You should now see a pop up with a list of services associated with the
Svchost.exe you selected)

Next double click on the Svchost.exe process that you are interested in.
The 'Properties' Window should now be displayed with numerous tabs
available.
(Two important tabs to look at are: Services and Environment)

Searching for web based information about a process:
You can also move the mouse cursor over any process, no just those
associated with a Svchost.exe process and you should see a popup
with some detailed info.
Then mouse over the specific process that's you are interested in.
Next click on that process to highlight it,
Now that it's highlighted, right click and from the options listed select:
Search Online
This should display what out there on the web about that process.

As mentioned before: You can also double click on any process
to open up a more detailed 'Properties' window.

Note: some entries like Explorer, System/Services, and
Svchost entries may need to be expanded to show the detail (sub processes),
in this case click on the + located to the left of the entry.

Another tool to try is: What's Running
http://www.whatsrunning.net/whatsrunning/main.aspx

JS
http://www.pagestart.com

 

[Nepatsfan]

Lately, my ZoneAlarm firewall has been popping up with warnings that Generic
Host Process for Win32 Services is trying to act as a server, and other times
wants to accept connections from the internet. The program is svchost.exe. I
keep responding with "deny". This is happening with increasing frequency -
many times a day. When I asked about this previously, I was told ZoneAlarm
keeps allowing this to happen, even if you tell it not to.
My question is - what is svchost.exe? Is it a necessary program that I can't
just delete? This thing is really bugging me.

If you're concerned about this warning you might want to post your question
here.

ZoneAlarm User Forum
http://forums.zonelabs.com/zonelabs

Good luck

Nepatsfan

 

[Chong Yuh Yih]

Hi JS,
I'm wondering whether can we stop the SVCHOST.EXE permanently? I've found a
website which claimed by the group that it works by following the steps below:

Website:How to stop svchost.exe using up 100% system resources (Windows XP
Only):
http://www.technibble.com/how-to-fix-svchost-using-100-cpu-memory-leak/

Steps:
Visit the Microsoft website and Download Windows Update v3
WindowsUpdateAgent30-x86.exe and save it to your C:\ drive
Download this file fix_svchost.bat (right click and choose save as..) and
save it to your C:\ drive
Download this file WindowsXP-KB927891.exe (right click and choose save as..)
and save it to your C:\ drive
Reboot the computer and log in to Windows XP in safe mode. To do this, press
F8 just before the WindowsXP logo shows up during boot and press up to choose
“Safe Modeâ€
Once Windows has loaded and you have the option of which user account to
use, log on as “Administratorâ€.
Click Start > Run, choose the Browse button and find the fix_svchost.bat
file you saved before, press Open, then OK.
A black screen will pop up and white text will scroll past. Wait for this
process to finish as it could take several minutes. It will close itself when
its finished.
Once the black screen disappears, Click Start > Run, choose the Browse
button and find the WindowsUpdateAgent30-x86.exe file you saved before, press
Open, then OK. Follow the prompts as it installs.
When Windows Update Agent finishes installing, Click Start > Run, choose the
Browse button and find the WindowsXP-KB927891.exe file you saved before,
press Open, then OK. Follow the prompts as it installs.
Reboot the computer

Please advice whether it is really working because I'm afraid that my pc
will be totally not responding after following the steps above.

Thank you
Rgds
Chong Yuh Yih
Malaysia

 

[JS]

This is a fix for a very specific problem,
my PC does not have this problem so I can not verify that it will work.

However before you decide to install the fix take note that if you start
'Task Manager' you will see about six SVCHOST processes
running and they need to be running. So if you have the problem of a
particular svchost memory leak then install the fix, but don't expect to
no longer see any svchost processes in task manager as the fix does
not eliminate then, it just stops the leak.

I would suggest that if you are concerned about your PC being
non responsive after installing the fix that you create
an image backup of your Windows partition (usually C
to a second hard drive (internal or external) or least to another
partition on the same hard drive. Storing the image backup to
DVD media will also work.

If you do not own any Image Backup software see:
True Image 2009 - has a 15 day trial version available.
http://www.acronis.com/homecomputing/products/trueimage/
(Trial version can create a Restore/Rescue Media CD,
but I have not verified this yet, see the user's guide as
you may need the Rescue CD to restore your PC
should you have any problems after installing the patch/fix)
User's Guide: http://us1.download.acronis.com/pdf/TrueImage12_ug.en.pdf

The 15 day trial should be more then enough time to recover
from any problems that pop up after you install the svchost fix.

JS
http://www.pagestart.com