svchost进程问题 [英] svchost process problem

问题描述

我已经完全将XP Home升级到了SP3. svchost会不断增加专用字节的使用量，以4-8KB为增量，但是永远不会停止.几个小时后，VM使用情况显示超过600MB左右.最终它高达1.5GB，这时会发生NT关闭(NT授权关闭:尝试启动Seaport时DCOM进程启动器意外终止).目前，我已经禁用了DCOM，但是我不确定后果如何，其他所有功能似乎都可以正常运行，但是VM一直在继续.
使用Process Explorer，我可以看到其中有一个单个进程会持续消耗VM.有问题的svchost进程显示大约75-85个线程处于活动状态.如果我从PE挂起它，则VM内存爬电立即停止.进程树下列出的DLL似乎是MS正版文件(我已尝试验证了其中的许多文件).
由于我不是SW/IT专业人员，所以我不知道如何正确解释PE显示.我想在这里显示一个DLL清单，但是，即使有可能，我也不知道如何从PE收集它.以下是此svchost中运行的服务:

audiosrv.dll
browser.dll
cryptsvc.dll
dhspcsvc.dll
dmserver.dll
.es.dll
pchsvc.dll
srvsvc.dll
wkssvc.dll
netman.dll
mswsock.dll
rasmans.dll
achedsvc.dll
seclogon.dll
sens.dll
ipnathlp.dll
shsvcs.dll
srsvc.dll
tapisrv.dll
trkwks.dll
w32time.dll
WMIsvc.dll
wscsvc.dll
wuauserv.dll
wzcsvc.dll

请您指教这到底意味着什么?...我什至不知道DCOM与所有这一切之间的关系，以及为什么这种承诺收费的攀升正导致DCOM崩溃.换句话说:这里是什么问题?...病毒扫描显示为阴性(Clamwin扫描)，但是Spybot S& D 1.6.2显示了三个反复出现的问题，即使重新启动扫描也无法消除.如果需要，我可以提供这些问题的详细信息.

Lucian

I have upgraded completely my XP Home to SP3. A svchost keeps on creeping up the private bytes usage, in increments of 4-8KB, but never stops. After a few hours, the VM usage shows more than 600MB or so. Eventually it goes as high as 1.5GB, at which point a NT shutdown occurs (NT authority shutdown: DCOM process launcher terminated unexpectedly while trying to launch Seaport). For now, I have disabled the DCOM, but I am not sure of consequences, everything else seems to be working fine, but the VM creeoage keeps on going on.
Using the Process Explorer, I can see that there is a single process which keeps on eating VM slowly. The svchost process in question shows about 75-85 threads are active. If i suspend it from PE, the VM memory creepage stops immediately. The DLLs listed under the process tree are seemingly MS legit ones (I have tried to verify a number of them).
Since I am not a SW/IT professional, I would not know how to interpret the PE displays correctly. I wanted to show here a DLL listing, but I do not know how to collect it from PE, if at all possible. Here are the services running inside this svchost:

audiosrv.dll
browser.dll
cryptsvc.dll
dhspcsvc.dll
dmserver.dll
es.dll
pchsvc.dll
srvsvc.dll
wkssvc.dll
netman.dll
mswsock.dll
rasmans.dll
achedsvc.dll
seclogon.dll
sens.dll
ipnathlp.dll
shsvcs.dll
srsvc.dll
tapisrv.dll
trkwks.dll
w32time.dll
WMIsvc.dll
wscsvc.dll
wuauserv.dll
wzcsvc.dll

Can you please advise what all this really means?... I am not even sure how the DCOM is related to all this and why this creepage of commited charge is driving towards the DCOM crash. In other words: what is problem I have here?... Virus scans show negative (Clamwin scan), but the Spybot S&D 1.6.2 shows three recurrent problems which it says it cannot eliminate even after a re-boot scan. I can offer the details of those issues, if needed. Please help me!

Lucian

推荐答案

自从我尝试对SVCHost进行故障排除以来已经有一段时间了.

的一般过程是使用sc.exe命令一次将一个服务分离到一个SVCHost中.

C:\ Users \ brucea> sc config/?
DESCRIPTION :
修改注册表和服务数据库中的服务条目.
用法:
sc< server> config [服务名称]< option1> < option2> ...

It been a while since I tried to troubleshoot an SVCHost.

The general process it so split out service one at a time  into there own SVCHost by using the sc.exe command

C:\Users\brucea>sc config /?
DESCRIPTION:
        Modifies a service entry in the registry and Service Database.
USAGE:
        sc <server> config [service name] <option1> <option2>...

选项:
注意:选项名称包括等号.
等号和值之间必须有空格.
type =< own | share | interact | kernel | filesys | rec | adapt>
start =< boot | system | auto |需求|已禁用|延迟自动>
error =<正常|严重|严重|忽略>
binPath =< BinaryPathName>
group =< LoadOrderGroup>
tag =< yes | no>
Depend =< Dependencies(以/(正斜杠分隔))>
obj =< AccountName | ObjectName>
DisplayName =<显示名称>
密码=<密码>

因此例如:

Sc config wuauserv type = own

您还可以运行以下命令来获取SVCHost中的内容的列表

任务列表/svc

干杯
Bruce Adamczak

OPTIONS:
NOTE: The option name includes the equal sign.
      A space is required between the equal sign and the value.
 type= <own|share|interact|kernel|filesys|rec|adapt>
 start= <boot|system|auto|demand|disabled|delayed-auto>
 error= <normal|severe|critical|ignore>
 binPath= <BinaryPathName>
 group= <LoadOrderGroup>
 tag= <yes|no>
 depend= <Dependencies(separated by / (forward slash))>
 obj= <AccountName|ObjectName>
 DisplayName= <display name>
 password= <password>

So for exmaple you can do:

Sc config wuauserv type= own

You can also run th following command to get list of what is in the SVCHost

Tasklist /svc

Cheers
Bruce Adamczak

这篇关于svchost进程问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！