How to Fix Svchost

By David Gitonga

Svchost.exe is a generic host process name that is located in the %SystemRoot%\\system32 folder for services running from dynamic link libraries (DLLs). At startup, it checks the registry’s services to construct the list of services it will load. Multiple instances of this process can run at the same time. From a programming perspective, svchost allows for reusability and this allows Windows to keep running even when one of the many services required by Windows fails to respond.

Identifying the Process

Step 1

The Svchost.exe groups are located in the registry key:


Each of the separate instances appearing as active process under this key contain ServiceDLL values under the key:


Step 2

Svchost may be taking too much CPU time and this could be caused by a bug related to the Windows Update Service for automatically downloading Microsoft updates to your machine. Stop and disable the Windows Automatic Update service by clicking on \"My Computer,\" \"Manage,\" \"Services and Applications,\" \"Services,\" \"Automatic Updates\" and changing its startup type to \"Disabled.\"

Step 3

Due to a virus, the Svchost.exe file may occasionally crash your computer. Replace the file by browsing on the Windows Installation CD to the i386 folder.

Step 4

Locate the compressed SVCHOST.EXE file and expand it using the command:


Step 5

Boot into Linux or from the rescue Windows CD and copy the file to the folder C: WINDOWS\\System32.

Step 6

Patch Windows using FIX KB958644 from the Microsoft website (see Resources).

Using Windows Recovery Console

Step 1

Insert the Windows CD to repair all corrupted system files.

Step 2

Boot the system from the CD.

Step 3

Select the \"Repair\" option and follow the wizard to completion.

Memory Leaks in Svchost.exe

Step 1

Memory leaks are caused by inefficient memory use by the Remote Procedure Call Server Service (RPCSS), resulting in memory leaks in Svchost.exe.

Step 2

Obtain the Microsoft COM+ Rollup HotFix 14 from Microsoft (see Resources).

Step 3

Changed registry keys are caused by viruses, spyware, adware and trojans, and these can affect svchost, which is an integral application for these forms of malware. Download and scan the registry using a registry cleaner software to repair and clean invalid registry entries.

Tips & Warnings

  • Disabling the Updates feature will require that you visit the Windows Update website periodically to keep your computer secure.
    Apply the Microsoft COM+ Rollup HotFix 14 only to computers experiencing memory leak in the RPCSS or Svchost.exe.