Wagner

Over 1 million SVCHOST.EXE pLEASE HELP

Recommended Posts

Thank you so much just what i was looking for

 

so i am week in math :)

 

I have 16gb of ram  so how much should i Put 

 

thank you 

Share this post


Link to post
Share on other sites

@Wagner  What version of Windows are you running?    You said you have a million instances of svchost...    How many do you actually have?    Fifty (which looks like a lot but is not) on a 16 GB RAM system is NOT a problem, if you have W10.  It's meant to be like that.

If you really do have hundreds or thousands of instances of svchost then there must be something else wrong on your system, and finding out what that is and fixing it would be a better idea than changing a registry entry.    Note also that there's an error in that webpage's description of what registry field to change, and how.

Share this post


Link to post
Share on other sites

OK, so you have Windows 10.    That means that seeing many instances of svchost.exe in task manager is normal, provided it's 50 or so, not thousands. 

Your first screenshot showed only 43 of them... so that's not a problem, unless there's many more screenfuls all saying svchost.exe.   Are there?    (Also since the screenshot shows processes with other names inbetween your svchost.exe instances, it might be easier to count them if you sort the display by the Name column first, then scroll down to find the svchost.exe examples and count the number of those.)

Share this post


Link to post
Share on other sites

From the info that Stapp provided and your screenshots, it looks like this is just the normal svchost.exe functionality when you have 4GB of RAM or more. If you'd like to make certain that there's nothing fishy going on, then you can post scan logs from FRST for me to take a look at. You can find instructions for downloading and running FRST at the following link:
https://helpdesk.emsisoft.com/en-us/article/274-running-a-scan-with-frst

Share this post


Link to post
Share on other sites
12 hours ago, GT500 said:

From the info that Stapp provided and your screenshots, it looks like this is just the normal svchost.exe functionality when you have 4GB of RAM or more. If you'd like to make certain that there's nothing fishy going on, then you can post scan logs from FRST for me to take a look at. You can find instructions for downloading and running FRST at the following link:
https://helpdesk.emsisoft.com/en-us/article/274-running-a-scan-with-frst

Ok Installed it and ran it this is what i got 

Thank you for your help

Links removed to PM

 

 

 

 

 

 

 

 

 

Share this post


Link to post
Share on other sites

@Wagner   You might want to be a little careful about posting public links to such files - anybody can download them.  It's better in general to zip files up then send them attached to a 'PM' (ie personal message) directly to the Emsisoft staff member - in this case GT500, or put the files soemwhere public as you have done, but send the URLs privately only to the Emsisoft person.  You can do that by hovering your mouse over his avatar and clicking on 'Message'.    

  • Thanks 1

Share this post


Link to post
Share on other sites
7 hours ago, JeremyNicoll said:

@Wagner   You might want to be a little careful about posting public links to such files - anybody can download them.  It's better in general to zip files up then send them attached to a 'PM' (ie personal message) directly to the Emsisoft staff member - in this case GT500, or put the files soemwhere public as you have done, but send the URLs privately only to the Emsisoft person.  You can do that by hovering your mouse over his avatar and clicking on 'Message'.    

Thanks did not know that

Share this post


Link to post
Share on other sites

Attachments to posts in this section of the forums are only supposed to be downloadable by staff, so it should be safe to attach logs to posts in any of the English support sub-forums (and the beta sub-forums). Private Messages work too of course. ;)

As for the logs you sent, everything looks OK to me. I don't see any signs of an infection.

  • Thanks 1

Share this post


Link to post
Share on other sites

Attachments... only downloadable by staff... is (of course) right, but this poster was previously posting URLs to a pastebin-like site, so anyone could follow the URL.  

  • Thanks 1

Share this post


Link to post
Share on other sites
23 minutes ago, JeremyNicoll said:

Attachments... only downloadable by staff... is (of course) right, but this poster was previously posting URLs to a pastebin-like site, so anyone could follow the URL.  

Thank you

Im trying to figure out how to delete them 

do you know how?

it seems i cant find the delete Button :)

Share this post


Link to post
Share on other sites

Delete them... here?   Click on "Edit" that's under your post, then change the text of that post.  To lose a URL just select the text and press Delete or backspace, like any other words you want to remove... as far as I know.

  • Like 1

Share this post


Link to post
Share on other sites
14 minutes ago, JeremyNicoll said:

Delete them... here?   Click on "Edit" that's under your post, then change the text of that post.  To lose a URL just select the text and press Delete or backspace, like any other words you want to remove... as far as I know.

I can see them

I think i already did this 

 

do u have a link please

Because i dont see them  i removed them and sent them as a privet message to GT500

Share this post


Link to post
Share on other sites

The file links that you previously had in this thread are gone.   If you still see them that might be a browser-cache issue?   I'm confused when you say:

   "I can see them ..... Because I don't see them"          Surely both statements can not be true?

  • Like 1

Share this post


Link to post
Share on other sites

You can only delete files from Pastebin if you have an account and were logged in when you created the pastes. If you were not logged in to an account, then they will only be deleted if you selected the option to delete them after a certain period of time when you created the pastes.

It looks like all three pastes have already been removed, so I assume you already figured out how to do it. ;)

FYI: @Wagner you can find the links to your pastes by going to the top of the forums, clicking on the icon near the upper-right that looks like an envelope, and selecting the conversation where you sent them to me from the list. There's also a link at the bottom of the list to go to your inbox, where you can see all private conversations that you have created or are taking part in.

  • Thanks 1

Share this post


Link to post
Share on other sites

That link still explains the registry change badly... with the arithmetic being in decimal and showing some of the sample values in hexadecimal.  I'm sure that will confuse people.

But what I really don't understand, @Wagneris why it matters to you?   You said you've got 16 GB of RAM, so there's no need to try to save a few KB here or there.  When Windows runs multiple svchost tasks in lots of separate processes you get a more stable, more secure OS.  It's a change to the OS internal design that was vastly overdue.  Why on earth would you want to return to the previous unstable insecure design?

Share this post


Link to post
Share on other sites
40 minutes ago, JeremyNicoll said:

That link still explains the registry change badly... with the arithmetic being in decimal and showing some of the sample values in hexadecimal.  I'm sure that will confuse people.

But what I really don't understand, @Wagneris why it matters to you?   You said you've got 16 GB of RAM, so there's no need to try to save a few KB here or there.  When Windows runs multiple svchost tasks in lots of separate processes you get a more stable, more secure OS.  It's a change to the OS internal design that was vastly overdue.  Why on earth would you want to return to the previous unstable insecure design?

Just Looking at how many i had was kinda Shocking for me 

it looked like so many things running on there own with no reason 

 

but know it looks better from 150  to 86 ☺️

Share this post


Link to post
Share on other sites

The thing is that in earlier versions of Windows pretty much the same set of tasks were running, but each svchost.exe process had maybe six or so of them in it, so you might only have thought you had - maybe - 8 instances of svchost running.  So, each of those svchosts couldn't keep memory etc used by its tasks apart.  If any one of those tasks aborted it was likely to break some or all of the other in the same process.  If any one of them was compromised, then whatever the others in the same process were doing was also likely to be compromised.  Separating each task into its own process is a much better idea... though clearly Windows will have a little more overhead in setting each one up and allowing them all to communicate with each other (through properly-controlled pathways).   All these things that used to run and still do run are not there for "no reason".  They're things like: the Windows Firewall, the DNS service, the Event Log, Encryption.... and so on... and you should be happy that in Win 10 Microsoft made all of them more reliable.

Share this post


Link to post
Share on other sites
9 hours ago, Wagner said:

Just Looking at how many i had was kinda Shocking for me 

it looked like so many things running on there own with no reason

There's actually a good reason for it. They're all separate services, and will run more efficiently if they are allowed to each execute as a separate process. When Windows combines more than one into a single process, it reduces the memory usage, but also slightly reduces performance.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.