Generic Host

Well, after two threads i have finnally determined my problem. Generic Process for win 32 services is raping my bandwidth for some reason. When i turn it off with my firewall everything is fine. What is the generic process, what does it do, why is it raping my bandwidth. Please enlighten me.

 

Could be a virus or malware (Use Ad-Ware/Spybot/Antivirus).
Could be "Automatic Update" trying to download WinXP SP2 for ya.

 

How did you determine that? Generic Host Process for Win32 Services is ABSOLUTELY NECESSARY for an Internet connection. If you kill it, you'll get nothing but errors when you try to use the Internet.

REBOOT. Then try your browsers with Gen Host Proc for W32 Svces *disabled*.

What I can't figure is why you think it's taking your bandwidth, when actually what it's doing is making your bandwidth POSSIBLE.

 

I'm using the sygate firewall. I have turned off widows update. When I block it with my firewall my internet works fine. Infact, as I type this right now, it is blocked. I'm getting no errors at all. Whats happening?

 

I guess you have checked your machine for Ad-/Spy-/Mal-Ware and updated your AntiVirus.

You could try to investigate what services there is running within the svchost.exe-process using CurrPorts.

 

Generic Host Process is not absolutely necessary for your internet connection. Whether or not it is necessary depends on how your connection is set-up. I currently have a cable connection through a linksys router and am set-up with DHCP back to the router. When I first connected this way i had the same question as Kob as everytime i did anythying online Generic Host Process would access the internet. I did a little digging and it had to do with domain resolution with the domain name server. I killed the Windows XP service DNS client and i was no longer pestered by the Generic Host Process.
Keep in mind that your particular internet connection may require the DNS client to operate properly. Unless you can find anything concrete stop the service and try to access the internet, if it works you don't need it, if it doesn't re-enable and get back to surfing. As all it is doing is performing the DNS look-up for your internet browser,

 

Heres what i've figured out so far. I can block the generic host item and my internet works great. But my firewall (again i'm using the awesome sygate firewall) tells me i'm getting my ports scaned. I did a tracert and it turns out that my ports were getting scanned by my ISP. Could my ISP be trying to do something with my computer through the generic host? Also, when I turned generic host back on the port scanning by my ISP stopped and the generic host had simmered down and wasn't raping my bandwidth. Could it be that it was constantly trying to talk with the DNS thing?

 

Yup.....
Once I got far i didn't find out exactly what was going on but what follows is my best guess as to the logic behind it. Someome may correct me as I may not be exactly correct, or totally wrong, but my general understanding of the whole thing is that your DNS client is trying to connect to your ISP so that whenever you type in www.whatever.com it (your isp) can translate it to the proper ip address. I beleive the Generic Host Process is how the ISP communicates back to your DNS cache telling it www.whatever.com is ip address 1.1.2.3. When you turn off the DNS client the ISP just translates the address and sends you on without communicating the proper address back to your DNS cache.

 

Ok, I get that. But I still don't understand why even when i'm not using an internet browser, or using my internet connection for anything the generic host process is still running. Its still raping my bandwidth when i'm not doing anything. And when i go to do something it slows everything down. What is my ISP doing? What is it that my computer is constantly trying to communicate to them? By the way, my ISP is AT&T.

 

I'm not sure about that. I thought it was only happening while you were surfing. Not all the time. I'm gonna have to go with snakefoot and that it sounds malicious to me. Can you clarify a couple of things? Broadband or dial-up? Directly connected to the modem or through a router (broadband)? What antivirus? Do you use any spyware cleaning programs spybot, adware, etc?

 

I'm using dial-up 56k. I don't have a router but I do use the sygate firewall and spybot search and destroy. I recently did a complete virus scan with my completly up to date Norton anti-virus.

 

Is this XP Home or Pro?

If you go to task manager, have you yet determined which svchost.exe process is causing it?

 

Its XP Home. No I'm not quite sure how I would determine which svhost it would be. But while we're on the topic, could u also tell my what an svhost is. My computer feels the need to run 5 different svhosts at one time.

 

Go to a command window
In the command window type tasklist /svc
This will list all running process and the services behind them. This will tell you what windows services are running inside each of the "svchosts"

This knowledge base article from MS might help
http://support.microsoft.com/default.aspx?scid=kb;en-us;314056

 

tasklist is a Pro only command.

 

I double checked it before i posted and it worked for me on XP home, SP1

 

Well, I've been working with it for the past 3 years across several dozen Home machines, and it does not.

So, we will have to agree, to disagree.

 

Double checked again.

"not an internal or external command"

http://www.networkclue.com/os/Windows/commands/index.php

Of course, this all clears up when the poster tries it.

 

Snakefoot had the name of a third party application that could do the same. Hopefully he will see this thread and post what it is.

 

I do agree to disagree, as i said i ran it before i posted it for Kob to try.
<img><img>

 

KOB,

Get process explorer from
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Right click each svchost.exe and go to the services tab. It will tell you which services are using it.

tasklist is not in XP Home, and will not function, unless you can acquire tasklist.exe from someone with a Pro machine.

 

As I told you I have 5 SVChosts running. I labled each one and the services it is running

SVC 1
Remote procedure call

SVC2
Audiosrv
BITS
Browser
Crypt SVC
Dhcp
ERSvc
EventSystem
FastUserSwitchingCompatibility
helpsvc
lanmanserver
lanmanworkstation
messenger
netman
Nla
RasMan
Schedual
seclogon
SENS
SharedAccess
ShellHWDetection
srservice
tapiSrv
TermService
Themes
TrkWks
uploadmgr
W32Time
winmgmt
wuauserv
WZCSVC

SVC3
Dnscache

SVC4
LmHosts
SSDPSRV
WebClient

SVC5
stisvc

This is what process exploerer told me verbatum. Thanks for all your help guys, I know this problem is becoming a b****.

 

Adrynalyne, you are the main reason I started hanging around this board and these support forums. You helped me with a problem that i couldn't get straightened out on my own. I respect very much your knowledge, because on matters microsoft and many other computer related subjects i have no doubt it far outstrips mine. However, I don't appreciate being called a liar. I posted those screens shots off my machine. I am running xp home, i have not snagged it off of a pro machine (i do not have access to pro). I double checked the knowledge article that i posted and will not argue that it says it applies to XP professional, but that does not change the fact that it ran on my machine.
I will stop posting and let you finish helping Kob.
Good luck Kob on finding a solution.

 

I should've just setteled this. The tasklist command didn't work for me. But please, I still need help. The problem still persists.

 

Ok, here is what I would like you to try:


Kill the process for the svchost that runs:

LmHosts
SSDPSRV
WebClient

If that takes care of the problem, then I would say disable SSDP Discovery Service via services.msc.

IF it doesn't, pelase go through this guide and tweak your system a bit:

http://snakefoot.fateback.com/tweak/winnt/services.html

Go through the reccomended section.

 

Mech,

I would have sent this via PM, but you have them turned off.

Nobody called you a liar. I simply said it will not work unless certain requirements are met, and as you can see, KOB confirmed that.

Please don't take it personally. People forget what tweaking they have done to their system, and what they have modified. But the fact remains that a clean install of Windows XP Home simply does not contain tasklist.exe to run said command. If your machine does, thats awesome However, as you can see, its not the norm, and not how MS set it up. You might be surprised, do a dir on your XP Home CD and locate tasklist.ex_. Its not there on an unmodified retail copy, and most likely, any oem copy. This is likely due to some modification you performed at some point on your machine.

So, site back, grab a cup of coffee and help me help out this gentleman so that he can get on with life, and look past the takslist issue, as its not working on his machine to be useful

 

Sorry it took so long for me to get back to you guys. I've been extreamly busy. But killing that process seemed to work. I'm no longer having any problems with my generic host. Thanks for all your help guys.

 

You are quite welcome