Svchost.exe is accessing jp2iexp.dll hunderds of times per second

I'm running Vista 64 and was trying to get rid of all the HD IO. So I ran sysinternals Process monitor and kicked the searchindexer.exe. But I also found that svchost.exe is accessing ...\jre6\bin\jp2iexp.dll hunderds of times per second. What is it doing? My JRE is 1.6.0_12-b04.

tbeernot wrote:
No. I have IE7, FF3, Safari4 and Chrome1 on my system and used them alternating for testing. In this case I indeed used IE to start process monitor.
Are you suggesting that the svchost.exe is IE and it is reading the DLL? Question then still remains: why?No, certainly not.
svchost is a required Windows process.
I am guessing from the naming of the dll p2iexp.dll
^^ xp or vista
^^ ie; internet explorer
^^ p2; dunno, maybe plugin version 2 ?A quick Google ( [svchost.exe|http://www.google.com/search?q=svchost.exe] )
gives a number of b0rked entries :-(
and a number of what seems to be useful entries;
[http://support.microsoft.com/kb/314056|http://support.microsoft.com/kb/314056]
[http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/|http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/]
[http://www.watchingthenet.com/how-to-identify-what-programs-started-svchostexe-in-windows.html|http://www.watchingthenet.com/how-to-identify-what-programs-started-svchostexe-in-windows.html]
[http://ask-leo.com/svchost_and_svchostexe_crashs_cpu_maximization_viruses_exploits_and_more.html|http://ask-leo.com/svchost_and_svchostexe_crashs_cpu_maximization_viruses_exploits_and_more.html]
[http://windowsxp.mvps.org/svchost.htm|http://windowsxp.mvps.org/svchost.htm]
[http://www.processlibrary.com/directory/files/svchost/|http://www.processlibrary.com/directory/files/svchost/]

Similar Messages

Svchost.exe - System error - "xul.dll is missing from your computer" need help resolving, I have uninstalled software 5 times, deleted folders, cleaned Mozilla entries out of registry and still get same message - aghhhhhhh!

get the message every time I login - when firefox is installed and even after it has been uninstalled

Sorry I missed your post. Anyone else with the same issue should find useful resources at Troubleshooting issues with iTunes for Windows updates.
tt2

WLCCP packets from 3 access points multicasting over 250 packets per second!?!

I've tried to discover why these three access points are sending WLCCP packets at this astonishing rate. I cannot determine when it started, however I believe it is causing many problems. I don't see any configuration items in the running config containing the keyword "wlccp". such as:
AP>(config)# wlccp ?
ap                                  Enable WLCCP AP
authentication-server   Authentication Server
wds                               Enable Wireless Domain Service Manager
wnm                              Configure Wireless Network Manager
Is it implicitly ON? Do I need to do "no wlccp ap" to turn it off.
I desperately need to make this stop?
Anybody have or have seen this phenomenon?

I have stopped the problem by putting tight multicast and broadcast storm control on every switch where an access point ingresses. That cleared up my wireless congestion. But the problem persists. The source MAC of the WLCCP packets are actually specific clients that are attached across the wireless via a work-group bridge. These are IP cameras and Network Video Recorders... why this? Hmmm.... no one knows....

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

Router continually accessing svchost.exe, cycling through all ports

Hi,
I recently did a clean install of Windows XP, since then my firewall (ZoneAlarm) has been continually blocking access attempts made by my router (WRT54G) to access svchost.exe, as shown here:
http://img28.imageshack.us/img28/9425/89700028.png
My router has a wired connection to my PC and by disconnecting the wire the access attempts stop. I don't know what is causing this or how to resolve the issue. So far I've only tried hard-resetting the router, which didn't help.
Any help would be appreciated

Firstly, thanks a lot for your help, I appreciate it.
Secondly, I'm reasonably sure that the problem isn't malware. Like I said in my first post, I only did a clean install of WinXP yesterday and since then I've only updated to SP3 and installed Firefox, ZoneAlarm, AVG, Adobe Reader and Flash. Just incase I just installed and ran Malwarebytes and Hijackthis and I couldn't see anything out of the ordinary. Of course I want to make sure that it isn't malware.
I've done what you said (this version of WinXP doesn't have tasklist apparently but I downloaded "Process Explorer" which serves the same function) and tried to find the process which needs those ports. The problem is that the ports accessed began at 10xx and continued all the way up to 25xx and probably would continue beyond. The svchosts with PIDs running in that range are running about 20 services... I'm not sure how I can find which service is causing the specific problem. I'm not even sure what services should be provided in the normal running of Windows.
e.g. termsrv.dll - Remote Desktop Session Host Server Remote Connections Manager
rpcss.dll - Remote Procedure Call (two instances of this running under two different svchost processes)
ssdpsrv.dll - permits discovery of UPnP devices on your home network
Should all of these be running normally as part of Windows? And seaching all of these processes on Google says that they COULD be a trojan/malware but I don't know how I could find out which are (outside of virus scanning - which I've already done). All are located in the windows/system32/ folder which makes me think they're not anything untoward but, again, I don't know for sure.
I appreciate that you can't help any more than you have but given everything I've tried is there anything else that I can do?
Thanks again.
Message Edited by LennethValkyrie on 03-09-2010 02:34 PM

Expected actions of svchost.exe - what is interesting, in the context of monitoring what svchost.exe is doing?

Hi,
I have seen numerous articles explaining svchost, and I think I have a reasonable grasp of it (although basic). My favourite article so far is
http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchostexe-process/#advanced, which I think is well written and very handy indeed!
My current issue is that I am tweaking a security program called McAfee Host IPS, currently running on 2003 R2 and 2008 R2 servers, and getting a lot of events associated with svchost.exe that I believe require exceptions to be configured. What I do
not want to do, however, is configure an exception that hides something that may be useful information, however there is a balance required in what I am doing.
Focusing on my current task at hand, I can confirm I have seen a large number of events associated with the below. The below is all of the information I have on the Host IPS signature in question, although I am currently digging further.
IPS Signature Name: CMD Tool Access by a Network Aware Application
IPS Signature details: This event indicates an attempt by a networked application to access, modify or execute a system program that may be used to modify the configuration of your system.
IPS Signature severity: Low
I have seen a large number of events with threat source process = C:\WINNT\SYSTEM32\SVCHOST.EXE, and the following files, either accessed or executed.
C:\WINNT\System32\tasklist.exe
C:\WINNT\System32\ipconfig.exe
C:\WINNT\System32\cmd.exe
C:\WINNT\System32\route.exe
As the above reference lists DLLs specifically, and not EXEs, I am not sure if this is expected (but am gathering it is, especially as the IPS signature details refers to 'system programs').
I am suspecting that my best action here is to configure an exception for threat source process <systemdir>\SVCHOST.EXE and target files <systemdir>\*.*, as my hypothesis is that even if I have not seen it in the tuning phase, there are
a lot of similar benign actions that could potentially trigger in the day to day workings of the OS. I am also assuming that I will see similar in later versions of Windows Server OS.
To throw a slight curveball, we are also integrated with a SIEM solution. As this signature severity is low, it is mapped to a log action so nothing will actually be stopped, but if there are no exceptions, relevant events would go through to SIEM.
They could be filtered there, but potentially used in correlation rules or troubleshooting, but that obviously takes more space in the McAfee (ePO) database and the SIEM solution, which needs to be taken into account.
Thoughts on this would be greatly appreciated - I genuinely wish I knew more about this subject!
Cheers,
Darren

Hi,
I am not sure what specific information you are looking for - could you clarify? I think I have covered the majority of what is happening in my initial post, however if there is a specific bit of information you are after, let me know.
The above is an article I had stumbled across, with the majority of the information contained in the link included in my initial post. The final paragraph under 'could this process be a virus' is interesting - I have copied it below - from your perspective
is this merely anecdotal or is there something behind it (references, if they exist, would be fantastic)?
"As long as you make sure that the location of the file is in your Windows\System32 directory, you aren’t dealing with a virus. There have been cases of certain viruses trying to mimic the same filename, but they are always located in another directory."
- source: http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/ , 09/01/15

Memory leaks- high memory usage svchost.exe

hello!
im having a kind of a similar problem. Im using a Q6600 with 4Gb of RAM running on Windows 7 x64. My physical memory usage history is 1.75GB idle but my CPU usage looks good ~ 0%.
In Windows Task Manager when i arranged the memory column, the process with the highest memory usge is svchost.exe with 116,572K. And i have 14 svchost.exe in my computer! I opened process exporer and check the legitimate of all those svchost.exe
and they are all legit. When i look at the properties of the highest svchost.exe in process explorer, the services which is running under it is as follows
AudioEndPointBuilder c:\Windows\System32\Audiosrv.dll
CscService c:\Windows\System32\cscsvc.dll
hidserv c:\Windows\System32\hidserv.dll
Netman c:\Windows\System32\netman.dll
PcaSvc c:\Windows\System32\pcasvc.dll
SysMain c:\Windows\System32\sysmail.dll
TrkWks c:\Windows\System32\trkwks.dll
UxSms c:\Windows\System32\uxsms.dll
wudfsvc c:\Windows\System32\WUDFSvc.dll
All are legit DLLS.
Is it normal to have 14 svchost.exe running at the same time(system, local service, network service in Task Manager)
and how can i reduce the memory usage of the svchost.exe?

Hi,
There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can
be run depending on how and where Svchost.exe is started.
If you would like to reduce the usage of this service, I could share the following article with you:
Getting Started with SVCHOST.EXE Troubleshooting
PRF: High CPU (SVCHOST.EXE)
Hope it helps.
Alex Zhao
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

'svchost.exe has encountered a problem and needs to close.'

I keep getting this error message svhost has encountered a problem and needs to close. I am running Windows XP 3, Does HP have a solution for XP-3?

Hi,
the error "svchost.exe" that you get is not necessarily because of your printer. i advice you to scan your computer for any kind of virus or trojan, or trt the following steps:
Method 1Leave the svchost.exe - Error dialog box open, and then follow these steps.Step1: Check whether settings for the Automatic Updates service and for the Background Intelligent Transfer Service (BITS) are correctTo do this, follow these steps:
Click Start, point to Run, type services.msc, and then click OK.
In the details pane, locate and double-click Automatic Updates.
Click the Log On tab.
Make sure that the Local System account option is selected and that the Allow service to interact with desktop check box is cleared.
Make sure that this service has been enabled in the Hardware Profile list. If this service has not been enabled, click Enable to enable the service.
Click the General tab, and make sure that the Automatic option is selected in the Startup Type list. Under Service status, click Start to start the service if it is not already running.
Repeat steps 2 through 6 for Background Intelligent Transfer Service (BITS).
Step 2: Reregister Windows Update componentsTo do this, follow these steps:
Click Start, click Run, type REGSVR32 WUAPI.DLL, and then press ENTER.
When you receive the "DllRegisterServer in WUAPI.DLL succeeded" message, click OK.
Type the following commands in the Open box, one after the other, and then press ENTER after each command:
REGSVR32 WUAUENG.DLL
REGSVR32 WUAUENG1.DLL
REGSVR32 ATL.DLL
REGSVR32 WUCLTUI.DLL
REGSVR32 WUPS.DLL
REGSVR32 WUPS2.DLL
REGSVR32 WUWEB.DLL
Step 3: Rename the Windows Update temporary folderThe temporary folder of Windows Update may be corrupted. In this case, you can rename the temporary folder of Windows Update. To do this, follow these steps:
Click Start, click Run, type cmd, and then press ENTER.
At the command prompt, type net stop Wuauserv, and then press ENTER.
Click Start, click Run, type %windir%, and then press ENTER.
In the folder that opens, locate and rename the SoftwareDistribution folder to SDold.
At the command prompt, type net start Wuauserv, and then press ENTER to start the Automatic Updates service.

IPod generates a svchost.exe error and blocks the computer

Ok, I got an iPod Nano 2GB Silver today and when I plug it in the USB port, a svchost.exe error pops up. The only thing I can do is to press OK, but when I do that, another and another and another... same error pops up. I have to reset the computer in order for the computer to start functioning normally.
I will try to translate what the Event Viewer says about the error (and this is what the error pop-up also states):
Opening application: svchost.exe - Program error : Instructions on »0x00000000« reffered to the memory on »0x00000000«. The memory couldn't be written.
The thing is though, it's working fine on some other laptop, but I don't understand why this is happening on my desktop?! And some of the older mp3 players (not iPods) are working just fine.
Please, help me!

I have a similar problem which began a couple weeks ago. Same svchost.exe closure, only I couldn't figure out what was causing the problem. Did the format C: and clean XP install, then gradually reinstalled software. When I got around to installing iTunes again, and about 24 hours goes by, I get the same message again. Both the popup and event viewer tell me that the iPod
Service caused the failure. Windows would only suggest that the problem was caused by Windows Update.
Before the fault bucket was generated, there was an Application Information message that states:
The description for Event ID ( 0 ) in Source ( iPod Service ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: Service started.
So now I am unable to keep my iPod updated, charged, used. Is this what I paid a premium price for?

SVCHost.exe

svchost.exe, is consuming 200-600mb of memory on start up and does not stop until i kill the process then does it again x2, then the display settings go from the sleek design to a windows 98 look then svchost.exe stops leaking but
why is svchost.exe leaking in the first place after not doing it for 2-3 years of owning this computer running the same os.
os: Windows 7 64 bit - fully up-to-date
thanks in advance

Hi Huzaifa,
Please make sure the svchost.exe file is located in the folder C:\Windows\System32. In other cases, svchost.exe is a virus, spyware, trojan or worm. Also check the user name of the process, it should be SYSTEM、LOCAL
SERVICE or NETWORK SERVICE.
This process manages system services that run from dynamic link libraries (files with extension .dll). Examples for such system services are: "Automatic Updates", "Windows Firewall", "Plug and Play", "Fax Service",
"Windows Themes".
First you need to know what service/dll sys is running by SVCHOST.exe.
Download Process Explorer from this website
https://technet.microsoft.com/en-us/sysinternals/bb896653.aspx?f=255&MSPPError=-2147217396
Information about pool monitor
https://msdn.microsoft.com/en-us/library/windows/hardware/ff550442%28v=vs.85%29.aspx?f=255&MSPPError=-2147217396
Open Process Explorer and find the problem SVCHOST.exe and check which service is taking resources.
Regards
D. Wu
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

2008 R2 - Memory Leak from svchost.exe - Module "rpcrt4" is the culprit

Hi All
Over the past week or so (after a set of Windows updates and restart) svchost.exe has increasingly used more and more memory. It probably gobbles up an extra 1GB per day and doesn't relent.
After running various diagnostics, the debug diagnostic tool finally provided me this information after a memory leak test:
rpcrt4.dll is responsible for 1.76 GBytes worth of outstanding allocations. The following are the top 2 memory consuming functions:
rpcrt4!AllocWrapper+2b: 1.76 GBytes worth of outstanding allocations.
rpcrt4!Ndr64ClientInitialize+964: 1.36 MBytes worth of outstanding allocations.
Detailed module report(Memory)
Module details for rpcrt4
Module Name rpcrt4
Allocation Count 946941 allocation(s)
Allocation Size 1.76 GBytes
Module Information
Image Name: C:\Windows\System32\rpcrt4.dll Symbol Type: PDB
Base address: 0x00000003`00905a4d Time Stamp: Sat Nov 20 13:13:18 2010
Checksum: 0x00000000`00000000 Comments:
COM DLL: True Company Name: Microsoft Corporation
ISAPIExtension: False File Description: Remote Procedure Call Runtime
ISAPIFilter: False File Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Managed DLL: False Internal Name: rpcrt4.dll
VB DLL: False Legal Copyright: © Microsoft Corporation. All rights reserved.
Loaded Image Name: rpcrt4.dll Legal Trademarks:
Mapped Image Name: Original filename: rpcrt4.dll
Module name: rpcrt4 Private Build:
Single Threaded: False Product Name: Microsoft® Windows® Operating System
Module Size: 1.18 MBytes Product Version: 6.1.7601.17514
Symbol File Name: c:\symcache\rpcrt4.pdb\7D748DA6D7454C9EA38C8CEF1C9E75F22\rpcrt4.pdb Special Build: &
rpcrt4!AllocWrapper+2b has 944,468 allocations!
I'm running 2008 R2 64bit with anywhere up to 80/100 simultaneous RDP connections at any one time.
Can anyone help or advise as I cannot find any hotfixes for this issue.
Thanks
Ryan

Hi Ryan,
Please narrow it down to the specific service that is having the issue. That way you will know where to focus on.
For the specific svchost.exe that is showing the large memory usage, use task manager/process explorer/etc. to determine which service(s) are running within it. If there are multiple services running within it, I recommend you isolate them and then
restart your server. For example, say you determined that the following services are running in the "problem" svchost.exe: AudioEndpointBuilder, Netman, TrkWks, UmRdpService, Uxsms. You would open an admin command prompt and enter the following
commands:
sc config AudioEndpointBuilder type= own
sc config Netman type= own
sc config TrkWks type= own
sc config UmRdpService type= own
sc config Uxsms type= own
After entering the above commands you would restart your server for the changes to take effect. Over time you would monitor memory usage of the suspect services, and eventually it will become apparent which one is using too much memory.
Thanks.
-TP

Satellite P100-238 freezes after an svchost.exe program error message:

PC: Satellite P100-238 from December 2006.
approx. a minute after startup i get an error message:
Danish:
svchost.exe - programfejl
Instruktionen ved "0x745f278o" refererede hukommelse ved "0x00000000". Hukommelsen kunne ikke "read".
Klik p OK for at afslutte program.
Klik p Annuller for at udfe fejlfinding i programmet.
English translation:
svchost.exe - program error
Instruction on "0x745f278o" refered memory on "0x00000000". Memory could not "read".
Click OK for ending program
Click Cansel to do error search in the program.
After the above error message the PC freezes totally and I can only turn it off by the on/off button.
What has happened with my PC?
What should i do?
How do I get access to my data to make a backup?

Hi
I goggled a little bit in the net for some help and I was surprised that many Windows users have had the same problem
So I thought there must be generally something wrong with the windows operating system.
I have investigated a little bit in the MS knowledge base and found this:
http://support.microsoft.com/kb/916089/en-us
According to the MS info this problem may occur when you have Microsoft Office installed and the Windows Update Agent tries to scan for Windows Installer updates.

CSA 4.5.1.639 - svchost.exe and UDP 1900 UPNP

I have created a high priority deny for the following rule but I would for this rule to stop popping up on all the workstations, simply because the flag is always waving for all the users.
4/18/2006 8:26:13 AM: The process 'C:\WINDOWS\system32\svchost.exe' (as user NT AUTHORITY\SYSTEM) attempted to communicate with x.x.x.x on UDP port 1900. The attempted access was to initiate a connection as a client (operation = CONNECT). The operation was denied.
What other changes neeed to be made so that users do not see this process at all?

You can silence the flag unless you have another network access control rule set to log for incoming connections:
If you have one rule set to deny incoming connections and log them, users will see the flag waving for all of them. You must create another rule that is set to deny (not high priority deny) acting as a server for a specific port, set to not log and set to take precedence over other deny rules.
I know this works because we do it here for the UPNP/SSDP services. The rule is set to deny svchost.exe from accepting connections on port 1900, not to log and to take precedence over other deny rules.
The only time this doesn't work is when machines are in test mode and then the only place you see messages is on the MC.
If this didn't work we would have hundreds of these flags waving every day.
Tom S

Svchost.exe -k netsvcs constantly downloading

I was asked to move this here from Microsoft Answers.
I am working on an XP Home SP3 computer that constantly downloads using system32\svchost.exe -k netsvcs. It will download as long as the computer is connected. Before I realized the problem, it downloaded 1.4GB. I am using Netbalancer to watch the process.
Things I've tried:
>Turn off windows auto updates. The computer was up to date last week.
>Scan with Malwarebytes, Security Essentials, MFRT, AVG, TDDSkiller in windows and safe mode when possible. Avg found 6 corrupted google toolbar.exe in Temp files. Others found nothing.
>Turn off system restore and rescan with AVG while the computer was connected.
>The computer has always had Norton antivirus installed. It found and removed 1 virus in setup_lib_srf[1].exe which contained "Downloader" in 2009.
>Disabled Backgound Intelligent Transfer service but netsvcs still downloads and the BITS service goes back to Automatic after a reboot.
>Ran svchost.exe fix from Microsoft which is for high cpu use but thought it might help.
> The remote ip address netsvcs is contacting belongs to Akamai Technologies when windows auto update is turned off. With auto updates on the other ip addresses belong to Microsoft.
I ran Hijackthis if you want the log.
Any help is greatly appreciated.
Tom
<button class="msaActionText">July 8, 2011</button>
<button class="msaActionText">Reply with quote</button>
<button class="msaActionText msgAbuseBtn">Report abuse</button>
Child exploitation or abuse
Harassment or threats
Inappropriate/Adult content
Nudity
Profanity
Software piracy
SPAM/Advertising
Virus/Spyware/Malware danger
Other Term of Use or Code of Conduct violation
<input type="button" value="Reply" />
<input type="button" value="Edit" />
1
Person had
this question <input type="button" value="Me Too" />
trg53

Thanks for the reply and help. I haven't looked for specific dll's yet but process explorer found "Mutant" files in every instance of svchost including this: Mutant    \BaseNamedObjects\SHIMLIB_LOG_MUTEX.... along with a few or several other
mutants. I hope it's ok to post the saved file from one of the svchost instances because it has obvious concerns.
I need to know if: 1.Deleting the Temp files and Temporary Internet files along with .dat files and cookies listed in the file could clean the system. 2.Is the system to compromised to try to save. It will be interesting to try though.
Thanks, Tom
Here is the file:
Process    PID    CPU    Description    Company Name
System Idle Process    0    98.48
Interrupts    n/a        Hardware Interrupts
DPCs    n/a        Deferred Procedure Calls
System    4
smss.exe    744        Windows NT Session Manager    Microsoft Corporation
   csrss.exe    840        Client Server Runtime Process    Microsoft Corporation
   winlogon.exe    864        Windows NT Logon Application    Microsoft Corporation
    services.exe    912        Services and Controller app    Microsoft Corporation
     ati2evxx.exe    1080        ATI External Event Utility EXE Module    ATI Technologies Inc.
     svchost.exe    1104        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1244        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1288        Generic Host Process for Win32 Services    Microsoft Corporation
      wscntfy.exe    2716        Windows Security Center Notification App    Microsoft Corporation
      wuauclt.exe    2776        Windows Update    Microsoft Corporation
     svchost.exe    1396        Generic Host Process for Win32 Services    Microsoft Corporation
     svchost.exe    1464        Generic Host Process for Win32 Services    Microsoft Corporation
     spoolsv.exe    1584        Spooler SubSystem App    Microsoft Corporation
     svchost.exe    1660        Generic Host Process for Win32 Services    Microsoft Corporation
     ccsvchst.exe    1868        Symantec Service Framework    Symantec Corporation
      ccsvchst.exe    1128        Symantec Service Framework    Symantec Corporation
     SeriousBit.NetBalancer.Service.exe    1968        SeriousBit.NetBalancer.Service    Microsoft
     svchost.exe    308        Generic Host Process for Win32 Services    Microsoft Corporation
     alg.exe    2468        Application Layer Gateway Service    Microsoft Corporation
    lsass.exe    924        LSA Shell (Export Version)    Microsoft Corporation
explorer.exe    1932        Windows Explorer    Microsoft Corporation
GoogleDesktop.exe    652        Google Desktop    Google
E_FATI9HA.EXE    692        EPSON Status Monitor 3    SEIKO EPSON CORPORATION
NkMonitor.exe    844        Nikon Transfer Monitor    Nikon Corporation
GoogleToolbarNotifier.exe    1036        GoogleToolbarNotifier    Google Inc.
ctfmon.exe    980        CTF Loader    Microsoft Corporation
DLG.exe    1204        Digital Line Detection    BVRP Software
procexp.exe    3040    1.52    Sysinternals Process Explorer    Sysinternals - www.sysinternals.com
Process: svchost.exe Pid: 1660
Type    Name
Desktop    \Default
Directory    \KnownDlls
Directory    \Windows
Directory    \BaseNamedObjects
File    C:\WINDOWS\system32
File    \Device\KsecDD
File    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
File    \Device\NamedPipe\net\NtControlPipe9
File    \Device\WMIDataDevice
File    \Device\WMIDataDevice
File    C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202
File    \Device\WebDavRedirector
File    \Device\WebDavRedirector
File    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
File    C:\Documents and Settings\LocalService\Cookies\index.dat
File    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
File    \Device\WebDavRedirector
File    \Device\WebDavRedirector
File    \Device\NamedPipe\DAV RPC SERVICE
File    \Device\NamedPipe\DAV RPC SERVICE
Key    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32
Key    HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key    HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
Key    HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
Key    HKLM\SOFTWARE\Policies
Key    HKU\S-1-5-19\Software\Policies
Key    HKU\S-1-5-19\Software
Key    HKLM\SOFTWARE
KeyedEvent    \KernelObjects\CritSecOutOfMemoryEvent
Mutant    \BaseNamedObjects\SHIMLIB_LOG_MUTEX
Mutant    \BaseNamedObjects\_!MSFTHISTORY!_
Mutant    \BaseNamedObjects\c:!documents and settings!localservice!local settings!temporary internet files!content.ie5!
Mutant    \BaseNamedObjects\c:!documents and settings!localservice!cookies!
Mutant    \BaseNamedObjects\c:!documents and settings!localservice!local settings!history!history.ie5!
Mutant    \BaseNamedObjects\WininetStartupMutex
Mutant    \BaseNamedObjects\WininetProxyRegistryMutex
Process    svchost.exe(1660)
Section    \BaseNamedObjects\C:_Documents and Settings_LocalService_Local Settings_Temporary Internet Files_Content.IE5_index.dat_81920
Section    \BaseNamedObjects\C:_Documents and Settings_LocalService_Cookies_index.dat_16384
Section    \BaseNamedObjects\C:_Documents and Settings_LocalService_Local Settings_History_History.IE5_index.dat_16384
Semaphore    \BaseNamedObjects\shell.{A48F1A32-A340-11D1-BC6B-00A0C90312E1}
Semaphore    \BaseNamedObjects\shell.{210A4BA0-3AEA-1069-A2D9-08002B30309D}
Thread    svchost.exe(1660): 1720
Thread    svchost.exe(1660): 1664
Thread    svchost.exe(1660): 1716
Thread    svchost.exe(1660): 3052
Thread    svchost.exe(1660): 1724
Token    NT AUTHORITY\LOCAL SERVICE:3e5
WindowStation    \Windows\WindowStations\Service-0x0-3e5$
WindowStation    \Windows\WindowStations\Service-0x0-3e5$

SVCHost.exe takes 100% cpu on random occasions

Ok so I have had a rather interesting problem and I don't know for sure if it is related to the sound blaster card in my computer or not.
I have a Sound Blaster Audigy 2ZS. Once in a while, usually later at night an svchost.exe process starts taking up 00% of my cpu. If I kill it and run any programs after killing it that use sound, I get no sound until I restart my PC. Programs that are running while that process takes 00% of my cpu keep their sound even after I kill the process until I close and reopen those programs. These programs consist of things like World of Warcraft, Windows Media Player, VLC Media Player and the like.
I was wondering if anyone has had a similar problem or knows what it might be, and possibly a solution.
Thanks
::edit:: renamed svchost.dll to correct name of svchost.exe. Was confused my bad!Message Edited by jziah86 on 05-4-200702:43 PM

Aware that svchost is not a driver. Aware that it manages the functions of any program that opens and is running on your system. Aware that Creative driver is loaded and problem with an instance of svc.host begins to display and that 00% of system resources are in use. Aware that when that instance of svc.host is ended that the problem is resolved and that the sound card will no longer function. Visitng other forums lead me to the investigate the Creative issue further. It is clear that there is a relationship between the loading of the Audigy sound card driver and the malfunction in the management of memory and system resources at a root level. The claim being made at present is that there is a conflict between the driver and something in a recent XP update from our friends and family at Microsoft. Since this is on one of my home systems, this weekend I will try to rollback to an older driver to see if it makes any difference. I will then try a different sound card to see if the problem persists. If so, I'll simply dump my Audigy card(s) and move onto something else. Hate to do it, but I don't have the time to fix their problem. Any other suggestions - especially from the Creative people who have advised that my card is beyond warranty and I can pay them to try to find a solution. Well, I'll pay for another sound card first! Don't expect them to fix my problems, but to fix their own. Like many buyers I do a lot of research BEFORE I purchase new components. Reviews and user comments mean a lot.

Svchost.exe is accessing jp2iexp.dll hunderds of times per second

Similar Messages

Maybe you are looking for