Why does svchost access the internet?
This manifests a couple of ways: your firewall warns you that svchost.exe is
attempting to the internet, or it attempts to dial your internet provider.
It’s probably simple.
Become a Patron of Ask Leo! and go ad-free!
You probably have automatic time updates turned on. That runs as a svchost
hosted process (What is
SVCHOST?), and periodically attempts to connect to an internet service to
set you clock for you. You can turn that off by right clicking the clock in
your task bar, selecting Adjust Date/Time, and clicking on the Internet Time
29 comments on “Why does svchost access the internet?”
Thanks, Leo. That was helpful information. I’ll certainly be on the lookout for the sCV.exe file in future.
Thanks,Leo for jogging my memory on switching off the clock auto update WRT svchost. It worked!
is it possible to change contents of registry by some program (without users notice). if this happens, i tell/warn u that chances are that it could send critical info to hackers.
If someone can help me by explaining weather registry contents(services part) can altered/added/changed and how this can be ahcieved then i would be very thankful to those whoever helps me.
I think that you will find that it attempts to access the net far more frequently than you realise (averaging out about once per minute).
I am using XP Pro – SP2.
I have written an email program and it is not allowed to connect to the POP server unless I let svchost.exe send whatever it wants to send!
svchost IS definately required to connect to the internet in once instance. that is for updates from the Windows update website, if it is disabled when trying to connect then the site will not work.
It’s very likely that windows’ automatic updater is at work here. What is very strage is that on my machine, it sent out far more data than it downloaded. From now on, only manual updates for me.
I’m having problems with my office network in that my client computer continually dials out to the internet and the only way to stop it is restrict access to that unit.
I installed a firewall and that indicated to me that svchost.exe is the culprit and as above, I’ve switched off Windows XP auto-update and the date/time synchro, but the little bugger is still trying to connect to the internet.
Given that svchost is merely the ‘taxi service’ to the internet, how do I check to see who the passenger is? ie: which program is using the svchost to get to the internet?
You should be able to use sysinternals process explorer ( http://ask-leo.com/d-procexp ) to see the command lines and parameters used for each instance of svchost. With procexp running, right click on the svchost you want to look at and hit properties.
Thank god for clearing it up! It happened to me last week & not knowing what the problem & to do. Just unbelievable! It consumes & create incoming traffic activity on my internet connection. Stupid of me leaving the problem behind!
Great info –
I think you may have some of the best info and best callers on the web.
So then it is ok for SVChost to access the internet? I currently have it blocked by my firewall (ZA).
I accidently deleted the svchost.exe for my interent (I ended the process in Task Manager because it was hanging up). How do I go about reloading it since my internet does not work any more?
Thanks for any help that you can give me.
I have several svchost processes running, local, and system. I have ended these processes in task manager they just come back. When I ended the system svchost my system automatically starts to shut down says nt authority system will shut down and starts at 59 seconds. when I bought a new laptop before I had access to the internet I checked task manager and svchost was a running process upon 1st boot. How do I find out who is using this system, can someone provide link to obtain detailed info about this process? Also why doesn’t any of the anti-spy etc software even acknowledge this process if it is indeed spying?
Because svchost is not spyware – it’s a critical system component, and there are SUPPOSED to be multiple copies running. Check out this article: http://ask-leo.com/what_is_svchost_and_why_is_there_more_than_one_copy_running.html
I have the same problem. When i turn my modem it appears lots of black windows and in the top there is name of the program: scvhost.exe. You say that i must click the clock in my task bar, select the function “Adjust Date/Time” and to click on the “Internet Time tab”. I use the windows 2000 and i don’t find the “Internet Time tab”. Can you please tell where is it? Thank you very much.
i also have timed sync turned off. automatic updates turned off, automatic updates uses this process, and have also tiem sync in services.msc and in the registry disbled, however it still tries to access the internet on XP SP2, i have no malware, viruses, etc.. I’ve scanned ….
only time i need to allow svchost access to the internet is when i do a manual auto update thru the MS website, i only do that to see what i need to download from the download section, once that is done i deny it again. Also when i allow it access or turn the firewall off to allow all, and since auto updates is turned off and stuff, and i have processguard, it downloaded something and wanted to install a pack or something from the updates distribition folder and minad you i am spyware clean, it did this twice, I only allowed all once because i was too lazy to go back into the firwall rules and re-allow MS player access to the internet to get info. on the CDs i am ripping or just ripped to mp3..
So MS spyware is = true
Beware of this and DO NOT allow it access to the internet, unless you do autoupdates which you should not, or allow it access only when looking to see what updates one needes to download manually.. and also to re-check to make sure one has the right ones…
AGAIN THIS IS MICROSOFT SPYWARE DON’t DELETE IS AS IT WILL MESS UP YOUR SYSTEM. just don’t allow internet access unsupervised..
google pack’s updater, updates using svchost.exe. so if u have the google pack installed, probably thats what is happening.
First, I have turned off my Automatic Updates, and I have trun off Automatic update for my clock, but, it still access my internet connection, and it have used 20MB per hour!!!
Please guide me, Thanks…
Hi every one I trun off the time update but it’s still sending packets
Mine tries to connect 50000 times a day and I have time service and automatic updates off.My services have NOTHING that should need to connect to the internet I have static ip mac filtered through a NAT router.
So it is definitely MS spying because the IP’s are MS ip’s.
BLOCK IT!!And Explorer.exe.
They are spying on you.
But if i blocked it…i can’t access to the internet…i can log in on yahoo messenger or browsing from my firefox..
I’ve turn off time update…but it keep trying to access the internet…
if i allowed it…the send and receive bytes is increasing…although i don’t use anything…help me ~~’
i mean i can’t log in…
When I view my firewall I see svchost.exe using the internet even when all my applications are closed. I have turned off automatic updates. Is this because of a virus or something? Any idea please help.. Thanks
Its because svchost.exe is a windows process and when we visits many websites in a small span of time
the cached data & temp internet files saved in our PC request svchost.exe to avail them out bound internet connection.
simplest way to get rid of such happening is that always remove temp files & clear cache items.
check your antivirus firewall their you can stop all out bound TCP connection which will make your internet connection stable until you access it.
People please do not allow svchost.exe to allow access to internet I WARNED YOU.
What you are seeing is a rootkit masked as a svchost to access to the internet. Trust me if you check task manager there will be tones of svchost .exe there but there is one hidden svchost .exe that is running hidden which is why firewalls are reporting the service trying to access the internet .
Most of the time it will contact some Russian servers and relentlessly retries to connect them if you engage internet lock.
You are full of BS, MS is NOT spying on you. Why would they even care about you anyway? Windows also tries to update root certificates as well. You can disable that by removing update root certificates from the Add/Remove Windows components. If your computer was part of a domain at work, and you brought it home, it will try to find the domain periodically as well.
Please stop spewing garbage.
i’ve been tracking SVCHOST.exe each time he tried to access internet.I’ve notice what their IP are.
Of course,there is microsoft,but there are also strange things at strange moment.
When i install a program for example,SCVHOST connect to an ip with no Relation-ship with the installed program.This programs may want to access internet but why SVCHOST ???
Another thing is that most ip concern concern internet access provider CONCURRENT to mine.
I have nothing to do with them.why SVCHOST try something with them…
Finally,i decided to block it temporarly
Recently my firewall popped up saying that svchost.exe is invading, i know almost nothing about computers so i blocked it thinking it is something bad. But this warning would keep popping up every few mins so i decided to allow seeing what will happen.
nothing happened untill i closed the laptop and opened it again the next day.
when ever i would try to open internet or firefox it would just close by it self automatically.
i tried to change the firewall but there are many svchost, i tried blocking them all and allowing them all but nothing would happen
Don’t ask me why but utorrent udp connections can show up as svchost in your firewall log. Though I am sure that many applications can can be the cause.
I’ve simply disabled windows time sync. And svchost didn’t try to connect to the internet anymore. Proving this “request” was for the clock in my case.