svchost problems

[tshad]

I have been having problem with my system where it would run fine for a
while than seem to freeze.

I was able to find out that in the task manager sorted by CPU that
svchost.exe would be at the top of list using about 6 megs of memory. I
found that if I ended that process the system would work fine.

I finally felt that Norton Virus program might be the problem (no way to
tell what was using the svchost.exe process) and uninstalled both the Virus
and Live Update programs. Now the system works fine and svchost.exe is not
there. So I assume that this was the problem. I have had problems with
Norton causing problems with other machines at work so I will not be using
this program again. I think I will probably be using either Trendview or
McAfee - not sure which yet.

My question is whether there is a better way to find out what program an
svchost.exe is connected to? At the moment I have 10 of them running and no
way to know if these are legitimate or not.

Thanks,

Tom

 

[MowGreen [MVP]]

Try Process Explorer v11.04 :
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

That will show you what each instance of svchost is spawning.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============

 

[tshad]

Try Process Explorer v11.04 :
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

That works pretty good.

It does show me that svchost.exe pid 232 was spawned from a service (716).

The ProcEx shows me that that service is owned by Microsoft but not what the
service is.

It is under Winlogon.exe and is taking around 95% of the machine. Not sure
what the difference is between the red and the green on the cpu usage graph
but it is showing between 94-97%.

The private bytes is showing about 95 percent yellow an 5.3 MB

The task manager shows it at 5,716K (5.7MB) - not sure if this is related.

I/O bytes is 0.

There is a NetLogon service but that isn't started

What would cause this?

In a few minutes, I will need to reboot the machine if I don't end the
process.

This happens everytime I start the machine.

Thanks,

Tom

That will show you what each instance of svchost is spawning.

MowGreen [MVP 2003-2008]
===============
*-343-* FDNY
Never Forgotten
===============

I have been having problem with my system where it would run fine for a
while than seem to freeze.

I was able to find out that in the task manager sorted by CPU that
svchost.exe would be at the top of list using about 6 megs of memory. I
found that if I ended that process the system would work fine.

I finally felt that Norton Virus program might be the problem (no way to
tell what was using the svchost.exe process) and uninstalled both the
Virus and Live Update programs. Now the system works fine and
svchost.exe is not there. So I assume that this was the problem. I have
had problems with Norton causing problems with other machines at work so
I will not be using this program again. I think I will probably be using
either Trendview or McAfee - not sure which yet.

My question is whether there is a better way to find out what program an
svchost.exe is connected to? At the moment I have 10 of them running and
no way to know if these are legitimate or not.

Thanks,

Tom