Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svchost.exe


  • Please log in to reply
4 replies to this topic

#1 Tanmuz

Tanmuz

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 06 September 2008 - 01:13 AM

Hi all, I was in the Task Manager window the other day and noticed these svchost.exe file running.

Could someone please explain to me what they are and why there is 7 running?

Regards
:thumbsup:
Tanmuz (Cattas)

BC AdBot (Login to Remove)

 


#2 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:03:30 PM

Posted 06 September 2008 - 06:15 AM

svchost.exe is a process that serves as a holder for launching other programs as a process. Typically it's used for running DLL files as a program.

Multiple programs can run under one instance of svchost.exe You can see these by using this free program: http://www.microsoft.com/technet/sysintern...ssExplorer.mspx Once open, just hover your mouse over a svchost.exe process and it'll tell you what programs are running underneath it.

A program can call on svchost.exe and open a new instance - this depends on how the programmer designed the program to run. On my XP SP3 VM I've only got 4 running - but haven't installed much of anything on it, so that's not unusual. 7 seems to be the highest number that I've seen.

Also, malware can use svchost.exe - especially on a system that doesn't have Service Pack 2 or 3 installed. Malware can also camouflage itself by using variations on the name (ie: scvhost.exe), or by locating it in a different location (ie: C;\Windows\svchost.exe) - the normal location for it is in C:\Windows\System32\svchost.exe

Here's Microsoft's explanation of it: http://support.microsoft.com/kb/314056
A brief explanation is also here: http://en.wikipedia.org/wiki/Svchost

Edited by usasma, 06 September 2008 - 06:15 AM.
Adjusted keyboard operator's headspace and timing

My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 34,843 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:12:30 PM

Posted 06 September 2008 - 11:59 AM

There is also a very nice tutorial to help you identify what is running in each instance of svchost. Take a look at: How to determine what services are running under a SVCHOST.EXE process

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#4 Tanmuz

Tanmuz
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:05:30 AM

Posted 06 September 2008 - 06:13 PM

Thankyou both for the feedback.
I will have a look at the documentation.

:thumbsup:
Tanmuz (Cattas)

#5 sreez

sreez

  • Members
  • 634 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Dubai(UAE)
  • Local time:11:30 PM

Posted 06 September 2008 - 06:21 PM

There is also a very nice tutorial to help you identify what is running in each instance of svchost. Take a look at: How to determine what services are running under a SVCHOST.EXE process



I had look at tutorial, lot of useful information. I guess by using PStools we can explore more.

Cheers.

LIFE is so simple, if you know the reason of your existence at certain place. Treat every step as first one and trust god, friends, relatives and everyone.

 

Its a simple magic trick given to me by one friend also and I am at this stage  :love4u:





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users