svchost.exe hogs resources

  • Thread starter Thread starter MartynB
  • Start date Start date
M

MartynB

I hope the following may help if you notice sluggish performance.

I'm running XP Pro SP2 on a home network.

I found that whilst browsing the internet, the CPU usage would sometimes
stick at 100% for what seems like ages. This was traced to one of the
svchost processes taking more than it's fair share of resources. After
exhaustive investigation I found the service responsible - it was the DNS
Cache Service. I also noted the following error numerous times in the System
Event Log:-

Error Source: Service Control manager
Error Event ID: 7011
Error Description: "Timeout (30000 milliseconds) waiting for a transaction
response from the Dnscache service."

Flushing the DNS Cache using ipconfig /flushdns didn't really help. However
when I used ipconfig /displaydns, I noticed that the dns cache had a list of
entries of websites pointing to the local host address 127.0.0.1. That gave
me the clue. I opened the hosts file (size: 332Kb) and found a long list of
spyware blocking entries that had been inserted by Spybot - Search &
Destroy.

After I had deleted these entries, the DNS Cache Service behaviour returned
to normal.

I used to run Spybot - Search & Destroy which I found quite useful, but have
since installed Microsoft AntiSpyware - which seems to work fine and doesn't
need to use the hosts file to block spyware. Looking at the FAQ on the
Spybot web site gave me this link:- "Why does my network react very slowly
after inserting the Hosts File?" http://www.spybot.info/en/faq/12.html .

I recommend that anyone who has a large hosts file should review the need
for the method of blocking spyware sites by pointing them to the local host
address.

Martyn
 
Excellent point.

Another reason to keep Hosts lean and mean is that malware use it as well.
A number of popular virus/trojans use the hosts file to try to block access
to popular antivirus vendors update sites--with some success.

If the hosts file is already full of bad sites, how are you going to spot an
added sprinkling of antivirus vendor sites?

Better to keep it to a minimum.
 
I recommend that anyone who has a large hosts file should review
the need for the method of blocking spyware sites by pointing them
to the local host address.
Click to expand...

Well, that's not new, the same thing happens on win2k, while HOSTS
file blocking may be ok in some cases, in general a big hosts file will
slowdown the system; in this case, if you still want to block ad-sites
malware sites and the like you may as well give a spin to the programs
you'll find here http://www.pyrenean.com/ which achieve exactly the
same result but w/o creating such a "slowdown" issue

Regards

--

* ObiWan

Microsoft MVP: Windows Server - Networking
http://www.microsoft.com/communities/MVP/MVP.mspx
http://italy.mvps.org

DNS "fail-safe" for Windows clients.
http://www.ntcanuck.com

Newsgroups and forums
news://news.ntcanuck.com
http://forums.ntcanuck.com

408+ XP/2000 tweaks and tips
http://www.ntcanuck.com/tq/Tip_Quarry.htm
 
this is interesting because I have noticed the same thing
and I have seen the svchost process. Obviously, you are
more computer savvy than I, so could you put the solution
in layman's terms? Like what is a DNS Cache Service and
how do I find it??

IL
-----Original Message-----
I hope the following may help if you notice sluggish performance.

I'm running XP Pro SP2 on a home network.

I found that whilst browsing the internet, the CPU usage would sometimes
stick at 100% for what seems like ages. This was traced to one of the
svchost processes taking more than it's fair share of resources. After
exhaustive investigation I found the service responsible - it was the DNS
Cache Service. I also noted the following error numerous times in the System
Event Log:-

Error Source: Service Control manager
Error Event ID: 7011
Error Description: "Timeout (30000 milliseconds) waiting for a transaction
response from the Dnscache service."

Flushing the DNS Cache using ipconfig /flushdns didn't really help. However
when I used ipconfig /displaydns, I noticed that the dns cache had a list of
entries of websites pointing to the local host address 127.0.0.1. That gave
me the clue. I opened the hosts file (size: 332Kb) and found a long list of
spyware blocking entries that had been inserted by Spybot - Search &
Destroy.

After I had deleted these entries, the DNS Cache Service behaviour returned
to normal.

I used to run Spybot - Search & Destroy which I found quite useful, but have
since installed Microsoft AntiSpyware - which seems to work fine and doesn't
need to use the hosts file to block spyware. Looking at the FAQ on the
Spybot web site gave me this link:- "Why does my network react very slowly
after inserting the Hosts File?"
Click to expand...
http://www.spybot.info/en/faq/12.html .
 
Did Irish Lass ever find an answer? I am wondering the same thing. What IS
a DNS Cache Service and how DO I find it? I'm a novice and need more
laymen's terms as well.
 
You can stop and start the dns cache service by going to a command prompt
and typing:

net stop dnscache
and hitting enter

to restart it,

net start dnscache
and hit enter.

The issue is only relevant if you have a very large hosts file. You can
examine the hosts file using the tools, advanced, tools, system explorers in
Microsoft Antispyware.

Please don't be alarmed if you find a great many entrys there of the form
127.0.0.1 badsite

This is normal for many systems, although it may also be undesirable for a
number of reasons.


--
 
Thanks Bill! I'll look into this.
- Kali

Bill Sanderson said:
You can stop and start the dns cache service by going to a command prompt
and typing:

net stop dnscache
and hitting enter

to restart it,

net start dnscache
and hit enter.

The issue is only relevant if you have a very large hosts file. You can
examine the hosts file using the tools, advanced, tools, system explorers in
Microsoft Antispyware.

Please don't be alarmed if you find a great many entrys there of the form
127.0.0.1 badsite

This is normal for many systems, although it may also be undesirable for a
number of reasons.
Click to expand...
 
Back
Top