svchost.exe cmd window appears spontaneously

Posted on 2006-06-15
Last Modified: 2013-11-18
My XP machine (fully up to date with patches and service packs etc) has suddenly started - for no reason that I can see - popping up on the monitor a command prompt window headed c:\windows\system 32\ svchost.exe. The window is waiting for command line input and its current directory is C:\windows \system 32, but otherwise it doesn't seem to do anything. This behaviour doesn't happen often - maybe once a day - but it kind of worries me that there is something nasty loose in the machine - can anyone enlighten me as what might be happening.
Question by:SteveHodge
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +1
LVL 59

Expert Comment

ID: 16911670
Follow the advice in this MSKB article to find out more about the processes that are running under svchost.exe:
A description of Svchost.exe in Windows XP Pro

First, do this:

1. Click Start on the Windows taskbar, and then click Run.
2. In the Open box, type CMD, and then press ENTER.
3. Type Tasklist /SVC, and then press ENTER.

Then communicate back the list of processes running under svhost.exe.
LVL 59

Expert Comment

ID: 16911686
Just to be safe, I would do a full virus/trojan/spyware scan:  Some free online virus scanners: 

Also try these free programs to rid your system of spyware, trojans, and other malware:
Spybot - Search & Destroy
LavaSoft Ad-aware  

I use BOTH of the above programs on my 3 Windows systems; what one program misses, the other catches.  Also make sure to download the most up-to-date data before you run the programs.

Expert Comment

ID: 16911696
Also, check again that you have all updates....What other software have you installed?  Any .NET stuff?  Programming stuff?

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

LVL 14

Expert Comment

ID: 16917889
see here for info on svchost

you quoted "c:\windows\system 32\ svchost.exe" - there should not be a space between "system 32", search for all svchost.exe files on your pc, if found anywhere besides system32 or i386 or an $ntservicepack folder - then it is suspect

Author Comment

ID: 16921390
Thanks experts

FriarTuk - thanks I checked all the svchost.exe files, none of them look wrong
System 32 was a mistype by me
Lee Tutor - ran spybot, adaware and McAfee. Got one trojan, and the usual crop of traclker cookies but nothing else nasty
When I run tasklist (with what ever switch, except the help one) I get "Error: Class not registered". What can i do about this???
AndreDeKolta - I sure I am up todate - everything is on auto-update, and the machine runs almost all the time

LVL 14

Expert Comment

ID: 16925993
boot into safe mode & do full virus & spyw scans, scanning all folders & files, including compressed
reboot & check
then boot safe mode command prompt & run "sfc /scannow"
reboot & check
boot from xp cd into recovery console & run Repair option

Author Comment

ID: 16967395

"boot into safe mode & do full virus & spyw scans, scanning all folders & files, including compressed
reboot & check"

Did this - all clean, no change to problem, tasklist /sfc still says 'Error -class not registered'

"then boot safe mode command prompt & run "sfc /scannow"
reboot & check"

sfc would not run in safe mode. Ran it in normal mode, all clean. Tasklist still the same

Also ran rootkit revealer - nothing odd execpt some mysterious registry strings containing nulls, deleted them
No change, task list still the same. Otherwise OK

"boot from xp cd into recovery console & run Repair option"

Did this. completed OK, but windows explorer wouldn't run properly anymore (TKU Microsoft). Long, long delays before it did anything at all. But tasklist /svc still did not work when run from task manager - same error message

Restored system from backup, running OK now, but task list still doesn't work.

Complete re-install looks the only option; quite a pain, don't want to do it unless I am sure tasklist will tell me something useful about the original problem and/or the re-install will clear the original problem. (The tasklist issue must be something in the installation because I have a back-up install of XP on this same machine and on that one tasklist runs fine)

What do you think?
LVL 14

Accepted Solution

FriarTuk earned 200 total points
ID: 16974312
hate to say it, but i agree - if you have an image or bkup that you can restore that works i'd use it

then update everything, including installing new apps, then make a new image/bkup

Author Comment

ID: 17030192
Did the re-install - aargh!!. There was something nasty loose in the machine, exploiting outlook express. I caught it polling my (in-house linux based) mailserver once a second with addresses taken from outlook exprss, which I only use for some very specialised purposes, so no real harm done.

It has stopped now, the svchost pop up hasn't reoccured, and tasklist now works. Only reformatted the C drive. I hope it is not lurking in one of the other drives, but time I guess will tell


Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
I starting with php 12 143
Getting attribute Values using xslt 4 67
Windows print sharing 1 89
Event ID 1054 Userenv 2 93
What is Node.js? Node.js is a server side scripting language much like PHP or ASP but is used to implement the complete package of HTTP webserver and application framework. The difference is that Node.js’s execution engine is asynchronous and event…
Introduction Since I wrote the original article about Handling Date and Time in PHP and MySQL several years ago, it seemed like now was a good time to update it for object-oriented PHP.  This article does that, replacing as much as possible the pr…
This tutorial will teach you the core code needed to finalize the addition of a watermark to your image. The viewer will use a small PHP class to learn and create a watermark.
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question