Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


svchost.exe Too many

  • Please log in to reply
1 reply to this topic

#1 bcarp2142


  • Members
  • 1 posts
  • Local time:04:11 PM

Posted 29 November 2009 - 05:24 PM

Hey everyone!
Im not too familiar with computer issues, but I have read various posts from here and other sites.
however I have not been able to find a clear answer for my issue.

the problem I have is when I review Windows Task Manager, i see around 30 processes running and 11 of which are svchost.exe. When I preform a system scan, Hijack this only detects 20-21 and only 7 of those are svchost.exe processes running. One specific svchost.exe is using an abundance of CPU when idling (svchost PID#1160). I have ran a tasklist /svc in the cmd prompt and thats where things get difficult for me to understand. I'm not sure how to check each service and weather or not they're harmful to my system or just simply not needed. Can anyone help me diagnose this issue please?

EDIT: HJT log removed. You might want to try Louis's suggestion first

also here this what my command prompt looks like when I tasklist /svc

Microsoft Windows XP [Version 5.1.2600]
Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Brett>tasklist /svc

Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 648 N/A
csrss.exe 704 N/A
winlogon.exe 728 N/A
services.exe 772 Eventlog, PlugPlay
lsass.exe 784 PolicyAgent, ProtectedStorage, SamSs
nvsvc32.exe 960 nvsvc
svchost.exe 992 DcomLaunch, TermService
svchost.exe 1064 RpcSs
svchost.exe 1160 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
HidServ, lanmanserver, lanmanworkstation,
Netman, Nla, RasMan, Schedule, seclogon,
SENS, SharedAccess, ShellHWDetection,
srservice, TapiSrv, Themes, TrkWks, W32Time,
winmgmt, wscsvc, wuauserv, WZCSVC
svchost.exe 1280 Dnscache
svchost.exe 1356 LmHosts, RemoteRegistry, SSDPSRV
spoolsv.exe 1512 Spooler
explorer.exe 1832 N/A
svchost.exe 1800 WebClient
svchost.exe 1976 hpqcxs08, hpqddsvc
svchost.exe 2004 Net Driver HPZ12
svchost.exe 2040 Pml Driver HPZ12
svchost.exe 544 stisvc
alg.exe 2208 ALG
wscntfy.exe 2432 N/A
svchost.exe 2568 HTTPFilter
notepad.exe 2688 N/A
wuauclt.exe 2904 N/A
notepad.exe 3644 N/A
firefox.exe 3664 N/A
HijackThis.exe 1292 N/A
notepad.exe 604 N/A
cmd.exe 292 N/A
tasklist.exe 856 N/A
wmiprvse.exe 1640 N/A

C:\Documents and Settings\Brett>

Edited by garmanma, 29 November 2009 - 07:22 PM.

BC AdBot (Login to Remove)


#2 hamluis



  • Moderator
  • 56,116 posts
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:11 PM

Posted 29 November 2009 - 05:44 PM

If you want to check svchost processes running...I suggest that you edit your original post and remove the HJT log. This is an XP forum and any post with a HJT log or similar data...is deemed to be a post that belongs in one of the malware forums.

What is svchost.exe And Why Is It Running the How-To Geek - http://www.howtogeek.com/howto/windows-vis...-is-it-running/

How to determine what services are running under a SVCHOST.EXE process - http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchost.exe-process/


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users