Text 23523, 69 rader
Skriven 2006-11-11 16:14:10 av Jeff Guerdat (1:275/311)
     Kommentar till en text av Charles Scaglione
Ärende: Re: SVCHOST
===================
Charles Scaglione wrote:
> Got a mysterious one for you....
> 
> When I first boot up my desktop I have a process running (XP Home)
> called SVCHOST.  Actually there are several processes running with the
> same name (svchost.exe).
> 
> One of those svchost processes is eating up 100 per cent of my CPU and
> does so for about 5 minutes or so.  The process is called svchost.exe
> and is listed under "system".
> 
> While that is going on, the machine is like a zombie.  If I use Task
> Manager and kill the process, the machine comes to life again.  I
> can't figure out for the life of me what's causing it.
> 
> I've stopped services, uninstalled IE7, set some services to manual,
> etc.  Still no joy.  This only happens right after I boot up.  Once
> that process stops, the machine is normal.  This zombie like thing
> started around a week or so ago.  I haven't installed any new programs
> but have installed recommended security updates from MS.

Should have asked me a while ago when I was fighting with it.  ;)  There 
are, as you noticed, several svchost processes running.  One has 
virtually all the startup services using it while others are caused by 
some service that kicks off when you start another app.  I think this is 
basically the same thing as using inetd in *nix but don't know that for 
sure (inetd is a process that runs, listening for requests and starting 
the appropriate child process).  Here's a link to the MS KB article 
about it:

http://support.microsoft.com/?kbid=314056

A key command to check things out is "tasklist /svc" from a DOS prompt. 
  Locate the process ID (PID) of the offending process in task manager 
by clicking on the Processes tab and then View, Select Columns, checking 
off the PID (Process Identifier) checkbox.  Use that ID to correlate 
with what process(es) have started that particular invocation of 
svchost.exe.  That may give you a clue as to what is ACTUALLY chewing up 
the CPU.  Note also that the process name is svchost.exe and not 
scvhost.exe (note the transposition of the "c" and "v") which would be 
indicative of a potential virus or other Bad Thing.

What I had found, IIRC, was that the first PID of svchost was the one 
causing problems since it had damned near every service that starts up 
during boot in it.  To get things back to normal I started disabling 
services I didn't need (I found lists on the Internet and went through 
them one at a time to figure out if I wanted/needed them, disabling them 
if I didn't).  Obviously, you can screw things up with this so following 
recommendations as well as thinking it through will keep you from 
disabling a critical service.  Keep the DOS window open so you can use 
the output from the query to stop/modify services in the management 
window.  My goal was to have the system go into standby and not start 
itself back up without a network request (wake on LAN).  I ended up 
disabling many things but just recently turned most of the back on, 
using "manual" rather than "automatic" so the process will start only 
when needed.  The system seems to be running fine.

Unfortunately, there's a lot of possibilities as to what could cause 
this.  Any of the particular services hosted by that single svchost 
could be the problem.  Disabling (or perhaps just stopping the service 
temporarily so you can judge the result) services one at a time should 
get you the answer but takes time and a bit of pain.  And then it's 
still not necessarily clear as to what's causing that service to go 
haywire.  There's lots of questions and some answers on the Internet to 
slog through - perhaps you'll find a similarity to help you.  As noted, 
I had trouble and now I don't.  Is that because of manually starting 
services, a patch or just the phase of the moon?  Possibly all three...
--- Platinum Xpress/Win/WINServer v3.0pr5a
 * Origin: FidoTel & QWK on the Web! www.fidotel.com (1:275/311)