none
How to stop svchost.exe to connect to internet?

    Question

  • I used a software known as TCPview. I used it to monitor what are the services that are connected to the internet. In this I found out that svchost.exe is always downloading something. It is not the automatic windows update since I changed the windows update to manual. So please help me since my internet speed is very slow & in that svchost.exe is always downloading something....
    Tuesday, October 18, 2011 10:34 AM

Answers

  • An excellent tool to see what services are being run in which svchost process is "Svchost viewer":

    http://www.codeplex.com/svchostviewer

    If you can identify the Process ID of the svchost that is doing the downloading, then Svchost viewer will allow you to match that PID to the svchost.exe. Still, there will likely be more than one (sometimes many) services listed therein, but if you decide you have to start shutting-down services, that is a narrower list to start with.

    • Marked as answer by Robinson Zhang Tuesday, November 08, 2011 9:44 AM
    Thursday, October 20, 2011 6:51 PM

All replies

  • Hi,

     

    svchost.exe is a generic host process name for services that run from dynamic-link libraries

     

    Microsoft moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability. But you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

     

    If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

     

    Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.

     

    Regarding your issue, I suggest that you could scan the virus via MSE first:

     

    1.       Download Microsoft Security Essentials from  http://www.microsoft.com/security/pc-security/mse.aspx.

    2.       Install it.

    3.       Update the signature to the latest and preform a full system scan

     

    Also you may check the network connection in Resource Monitor.

     

    1.       Click Start button, type Resource Monitor in the Search bar. Press Enter.

    2.       Select Network tag, then check the Network Activity box, check the address which the connected with svchost.exe

    3.       Take a screenshot for the result the post it here.

     

    Hope that helps


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. ”
    Thursday, October 20, 2011 9:42 AM
  • An excellent tool to see what services are being run in which svchost process is "Svchost viewer":

    http://www.codeplex.com/svchostviewer

    If you can identify the Process ID of the svchost that is doing the downloading, then Svchost viewer will allow you to match that PID to the svchost.exe. Still, there will likely be more than one (sometimes many) services listed therein, but if you decide you have to start shutting-down services, that is a narrower list to start with.

    • Marked as answer by Robinson Zhang Tuesday, November 08, 2011 9:44 AM
    Thursday, October 20, 2011 6:51 PM