Anytime you come across a suspicious file or one that you do not recognize, search the name using Google or the following databases:
Most of the processes in Task Manager will be legitimate as shown in these links.Svchost.exe
is a generic host
process name for a group of services that are run from dynamic-link libraries (DLLs). At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. It is not unusual for multiple instances of Svchost.exe running at the same time
in Task Manager
in order to optimize the running of the various services. The process ID's (PID's) must be checked in real time to determine what services each instance of svchost.exe is controlling at that particular time.
There are several ways to investigate and see what services a Svchost.exe process is controlling, see:Note: Process Explorer shows two panes by default: the upper pane is always a process list and the bottom pane either shows the list of DLLs loaded into the process selected in the upper pane, or the list of operating system resource handles (files, Registry keys, synchronization objects) the process has open. In the menu at the top select View > Lower Pane View to change between DLLs and Handles.
Determining whether a file is malware or a legitimate process sometimes depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file. However, it then places itself in a different location on your computer. Another techinique is for the process to alter the registry and add itself as a Startup program
so that it can run automatically each time the computer is booted. A file's properties may give a clue to identifying it. Right-click
on the file, Properties
and examine the General and Version tabs.
To investigate all running processes and gather additional information to identify and resolve problems, you can also download and use:
These tools will show the process CPU usage, a description and its path location
. If you right-click on the file in question and select properties, you will see more details about the file.