Skip to navigation | Skip to content

Share your knowledge. Make a difference.

Svchost.exe and How To Deal With It Right

1 - I can do better 2 - Jury's out 3 - Pretty darn good 4 - Splendiferous 5 - Awesometastic (by 1 person)   Your rating: 1 - I can do better 2 - Jury's out 3 - Pretty darn good 4 - Splendiferous 5 - Awesometastic

Ranked #931 in Tech & Geek, #23283 overall

Donates to Cancer Research and Prevention Foundation

Rated G. (Control what you see)

Is it for good or not?

 

Mysterious Svchost.exe file wonders users all over the world. I'd like to shed light on it and explain, when this file is good and must-have and when it is malicious and must-kill.

Have a lot of svchost.exe instances in process list and don't know how to deal with them?

Your in the right place. I'll tell you here.

There a lot of speculations about this file. But what is truth?

Is it a virus? Or is it a Microsoft's conspiracy?



Are you in hurry? See Quick Solution here 

Find whether your svchost.exe is malicious or not and solve other svchost-related problems

Security Stronghold's anti spyware scanner has special module that scans your PC and tells you if you have malicious svchost.exe in your system. If yes, True Sword eliminates it in one click.

If you have other svchost-related problem, for example like ""Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience." write to Security Stronghold's support team with subject "Svchost Fix". They will send you their excellent Svchost Fix Wizard wich solves all error messages related to Svchost or Generic Host Process.

Download True Sword to scan your system for malicious Svchost.exe files

Write to Security Stronghold's Support Team to get your Svchost Fix Wizard

What is Svchost file in my processes after all? 

All truth is uncovered here

Svchost.exe file in your processes (also known as Generic Host Process for Win32 Services) is a legal and important Windows component existing on every computer. Its main purpose is to to host services that can't load on their own like those from dynamic-link libraries (DLLs). You can even see several Svchost files in your processes running simultaniously. In most cases you should not worry if you see five or six or even more copies of svchost.exe in the list of running processes because they host different services.

But can Svchost.exe be malicious? 

Unfortunately, yes...

There are several known spyware and trojans that pretend to be legal Svchost.exe. They usually have the same name or one of the following names: svchost.exe, svchosts.exe (which often causes svchosts.exe page faults), Generic.exe, svcchost.exe and several others.

Q: How I can find if my Svchost.exe file is malicious or not?

A: First of all, legal svchost.exe should reside in Windows\System32 folder and should not appear in startup list. But even if you have no Svchost files other than in your System32 folder and you autorun list is clear, you can't say for sure that you do not have malicious Svchost.exe file.

Use anti spyware scanners to find out if you have malicious svchost.exe file or a legal one!

Good anti spyware scanner which determines whether Svchost.exe in your system is malicios or not can be downloaded for free here

I see this error message: "Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry fo 

And how to solve all other problems related to Svchost and unrelated to malware?

There are several problems connected with Generic Host Process which are unrelated to spyware or trojans or viruses. These problems include error messages like this:

"Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience."

or like this:

"svchost.exe -- application error the instruction at "0x745f2780" reference memory at "0x00000000". the memory could not be 'read'"

If you encountered one of these error messages, here you will find how to get rid of them.

The are several possible reasons of this error message. (If you don't care of reasons and want to skip to solutions, scroll to next block of this page)

Reason 1: You have one these worms in your system: CashToolbar Downloader-MY, System1060, CoolWebSearch Svchost32, ADCLICK-AG, ADCLICK-AX, ADUYO-A, AGENT-V, AGOBOT-KL, AUTOTROJ-C and some others. Download solution for this reason here.

Reason 2: Some legal DLL used legal copy of Svchost.exe to run itself at Windows startup. This illegal DLL crashed and caused crash of the whole Svchost.exe service or the whole system.

Reason 3: You used Online Update feature and new update was download from Microsoft's web service which contains errorneous verison of Windows Installer or double-byte character set (DBCS) characters support (only occures in Microsoft Windows XP Service Pack 2 (SP2)).

Reason 4: You installed old printer or scanner drivers from Hewlett-Packard which are incompatible with the current version of Svchost.exe

There are two complex solution for all reasons mentioned above.

One is easy - get Svchost Fix Wizard which will solve all automatically. Just write to Security Stronghold's support team. Ask them to send you Svchost Fix Wizard which will solve everything automatically.

Another way is to try solve all these manually. I recommend this only if you know what you are doing because incorrect actions may cause even more serious problems than you have now.

Below I included manual solution algorithm.

How to get rid of error messages manually? 

Use on your own risk...

To completely solve "Generic Host Process for Win32 Services" problem you should:

1) Scan your PC for the following viruses: CashToolbar Downloader-MY, System1060, CoolWebSearch Svchost32, ADCLICK-AG, ADCLICK-AX, ADUYO-A, AGENT-V, AGOBOT-KL, AUTOTROJ-C

2) Go to Windows Automatic Updates properties (right-click on My Computer, then click on Properties and switch to Automatic Updates tab)

3) Choose "Turn Off Automatic Updates", click OK and reboot your PC

4) Manually update Windows using "Windows Update" shortcut in the start menu

5) Turn automatic updates on

6) If your problem is not solved on this step, uninstall old Hewlett-Packard printer and scanner drivers (if any) and download new drivers from the manufactures web site

7) If your problem is not solved on this step, use the following command to show all svchost.exe instances and associated services or libraries:

tasklist /svc /fi "imagename eq svchost.exe"

Then search for each of services and libraries shown in that list in the Internet to find out whether the entry is malicious or not. In case you find malicious entry, use msconfig.exe utility to disable the appropriate service entry.

This is long but effective way of Generic Host Process or svchosts.exe repair.

If you are not sure which files and registry keys to delete, write to Security Stronghold's support team and they'll send you their Svchost Fix Wizard.

Why I address to their Fix Wizard? They helped me to solve the same problem one day... I hope they'll help you as well.

Share your experience of Svchost.exe problem! 

Have you solved it? And how?

Here is also a good place to share your opinion of my advises. Were they helpful? Maybe you have something to add?

X
SecuritySavvyGuy

About SecuritySavvyGuy

Hi! My name is Konstantin Artemev and I am computer security geek. I hope my advises will help you in solving difficult security-related problems.

SecuritySavvyGuy's Pages

See all of SecuritySavvyGuy's pages