Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Multiple Svchost.exe A Problem?


  • Please log in to reply
5 replies to this topic

#1 Zakky Solstice

Zakky Solstice

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:48 PM

Posted 24 December 2007 - 04:07 PM

In My Windows Task Manager, I have svchost.exe running about 5 times. Is this a problem and something i should be worried about, or a common windows occurance? The most memory that it is taking is 20K. My computer doesn't run bogged or anything as i have kept it well maintained and clean, but i am curious about what svchost does. I understand it is a Windows process that calls .dll's, so does that mean that if i have 4 or 5 svchost running, it is just calling on 4 or 5 dll's? It seems to me that it should only be open once and still be able to call as much as it needs. Any help or explanation would be greatly appreciated. Thanks!

BC AdBot (Login to Remove)

 


m

#2 Zakky Solstice

Zakky Solstice
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:48 PM

Posted 24 December 2007 - 04:54 PM

Sorry for the double post, but i found some info (not all i was looking for) from the MS support site. Probably should have looked at that before posting, but I can't help it...being a newbie to this site, i am overwhelmed at the vast knowledge base that is here, i can't stay away....Its just awesome! Anyway, more info about understanding svchost.exe would be welcomed.

Merry Christmas Everyone!

#3 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:12:48 AM

Posted 24 December 2007 - 09:06 PM

Not a problem, svchost.exe is a bit confusing when you first encounter it. It's not just for running DLL's - but for running other process underneath it's credentials. Each instance should have different processes running underneath it - so there's apt to be 5 or 6 on your system at one time.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#4 Dirt13

Dirt13

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:12:48 AM

Posted 29 December 2007 - 05:12 AM

I had the same question.

Some of the things that I have read have discussed the same file name being used maliciously. Is there a way to validate the multiple instances I have running?

#5 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,570 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:48 PM

Posted 29 December 2007 - 05:25 AM

You can use Process Explorer.

When running Process Explorer if you hover the mouse over a process it will give you the path of the file. Legitimate instances of svchost.exe should be running from the \WINDOWS\System32 directory.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:12:48 AM

Posted 29 December 2007 - 07:57 AM

scvhost.exe is malware
svchost.exe may/may not be malware
svchost.exe located in C:\Windows\System32 (or the associated Windows backup locations) may/may not be malware
svchost.exe located outside of C:\Windows\System32 is malware (unless it's located in the assorted Windows backup locations)

Some of the backup locations on my PC are:
C:\Windows\$NTServicePackUninstall$
C:\Windows\ServicePackFiles\i386
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users