Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Svchost Question (help needed)


  • Please log in to reply
3 replies to this topic

#1 bluesjunior

bluesjunior

  • Members
  • 761 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:06 AM

Posted 10 April 2010 - 05:12 AM

My OS is Win XP Home SP3 and all up to date. I have several svchost entries on my Task Manager which is normal but one of them seems to use a bit more resources than the others. I have the PID number and it is being used by the system. I did a google search on how to find out what resources were using that PID number but all help offered is to use Tasklist which is not a part of XP Home and when I download the file and add it to the system 32 folder it doesn't work for some reason. Is there another way to see what the PID number is pointing to?.
On my task manager screen it says:

Image Name ----------PID--------------User Name-----------------CPU---------------------CPU Time--------------------------Mem Usage-----------------------Peak Mem Usage-----------------. .
svchost.exe-----------1208--------------System----------------------00-----------------------0:00:39-----------------------------26,948K------------------------------34,344k----------------------. .

I would like to find out what the PID number 1208 is used for?.
Motherboard: Gigabyte GA-MA770T-UD3, CPU: AMD Athlon II X3 450 Processor, Memory: OCZ 4GB (2x2GB) DDR3 1333MHz,Graphics: PowerColor HD 5750 1GB GDDR5,
PSU: Corsair 430W CX PSU 4x SATA 1x PCI-E, Hard Drive:Samsung SpinPoint F3 500GB Hard Drive SATAII 7200rpm 16MB Cache.

BC AdBot (Login to Remove)

 


#2 Romeo29

Romeo29

    Learning To Bleep


  • Members
  • 3,194 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:127.0.0.1
  • Local time:06:06 AM

Posted 10 April 2010 - 06:44 AM

PID or Process ID number is randomly selected when a process is created by Windows. So the PID would be different each time a program runs on a system. It is not important.

svchost.exe is used by Windows to run Windows services. It is also used by some malware programs. You can tell a Microsoft svchost.exe by seeing that its path (C:\Windows\System32\svchost.exe) and that it is being run by the System.

You can download System Internals Process Explorer from http://technet.microsoft.com/en-us/sysinte...s/bb896653.aspx
Run it as administrator. From menu select View > Select Columns and choose Command Line and User. This way you can see CPU usage, command line, full path of svchost.exe etc in Process Explorer.

A legitimate svchost.exe would have User beginning with NT_AUTHORITY. For example, NT_AUTHORITY/SYSTEM etc. Also it should be located in C:\Windows\System32\svchost.exe (depends on your Windows folder).

You can also verify a program by its digital signature in Process Explorer. Select View > Select ColumnsChoose, choose Verified Owner.
Then from menu, select Options > Verify Image Signatures. If a image signature cannot be verified it may indicate an illegitimate, fake or malware process.

Edited by Romeo29, 10 April 2010 - 06:52 AM.


#3 bluesjunior

bluesjunior
  • Topic Starter

  • Members
  • 761 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:06 AM

Posted 10 April 2010 - 08:53 AM

Thank you Romeo29, that was very helpfull. The svchost in question checked out okay but states in full (svchost.exe -k netsvcs) so I shall now google that and see why that particular entry should have a higher cpu usage than the others.
Motherboard: Gigabyte GA-MA770T-UD3, CPU: AMD Athlon II X3 450 Processor, Memory: OCZ 4GB (2x2GB) DDR3 1333MHz,Graphics: PowerColor HD 5750 1GB GDDR5,
PSU: Corsair 430W CX PSU 4x SATA 1x PCI-E, Hard Drive:Samsung SpinPoint F3 500GB Hard Drive SATAII 7200rpm 16MB Cache.

#4 cryptodan

cryptodan

    Bleepin Madman


  • Members
  • 21,868 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Catonsville, Md
  • Local time:11:06 AM

Posted 10 April 2010 - 02:16 PM

Thank you Romeo29, that was very helpfull. The svchost in question checked out okay but states in full (svchost.exe -k netsvcs) so I shall now google that and see why that particular entry should have a higher cpu usage than the others.



svchost -k netsvcs relates to a command line argument. -k I think is the start option and netsvcs I think is networking.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users