Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

5 Svchost Processes Running


  • Please log in to reply
10 replies to this topic

#1 Elendil

Elendil

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:06:32 PM

Posted 24 May 2006 - 05:08 PM

Is it normal for me to have 5 Svchost processes running?!?!?! This morning when my computer was done starting up and loading everything, I opened up the Task Manager and discovered that I had 5 Svchost processes running:
All of them are registered as svchost.exe; one from Local Service, two from System, and two from Network Service. I wish there was a way to show the screenshot of the five svchost processes because I've never noticed that before and figured it's kind of odd.
Stanford '14
B.S. Candidate | Computer Science

BC AdBot (Login to Remove)

 


#2 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:04:32 PM

Posted 24 May 2006 - 05:29 PM

Perfectly normal to have several instances of svchost running.
I have 6 running now.

A description of Svchost.exe

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.


MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#3 Elendil

Elendil
  • Topic Starter

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:06:32 PM

Posted 24 May 2006 - 06:15 PM

Good! That's a relief to me! :thumbsup:
Stanford '14
B.S. Candidate | Computer Science

#4 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:04:32 PM

Posted 24 May 2006 - 07:53 PM

I meant to add, that some svchost can be bad (malware), but having several entries isn't unusual.

Edited by tg1911, 24 May 2006 - 07:53 PM.

MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#5 Elendil

Elendil
  • Topic Starter

  • Members
  • 660 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The US
  • Local time:06:32 PM

Posted 24 May 2006 - 08:17 PM

Recently, I discovered that A-Squared offers quite an innovative HiJackThis type tool. Surprisingly, it has its own library which defines what's good and what's bad. After swiftly checking my computer, it determined that all five of my svchost processes are valid; however, if my ctfmon.exe is running under my admin account's name rather thatn under System, is that a problem?
Stanford '14
B.S. Candidate | Computer Science

#6 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:04:32 PM

Posted 24 May 2006 - 08:39 PM

What's the exact path?
See if this answers your question:
Frequently asked questions about Ctfmon.exe
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#7 imperious

imperious

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:32 PM

Posted 14 June 2006 - 05:45 PM

Norton has been popping saying i have a virus scvhost... how do i tell which one has the virus? and how do i get rid of it?
IMPERIOUS

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:32 PM

Posted 14 June 2006 - 06:06 PM

scvhost.exe is a malware and not the same as svchost.exe which is a legitimate file with a similar name.

If your running Win XP/2000, download and scan with Ewido Anti-Malware v3.5 in "SAFE MODE".
Ewido Install and Scan Instructions.

Then while still in safe mode, use Windows search feature and see if scvhost.exe is still present. If so, right click on it and choose delete. Check the spelling here and remember it is scvhost.exe that you need to delete NOT svchost.exe.

Reboot in normal mode and perform these online Virus scans:
[Watch the Address bar in IE. You may receive alerts that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then Click Install ActiveX component.]
Trend Micro Housecall Scan
Panda ActiveScan [ActiveScan Panda does not remove adware/spyware but will autoclean for viruses & worms.]
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 Scarlett

Scarlett

    Bleeping Diva


  • Members
  • 7,479 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:As always I'm beside myself ;)
  • Local time:05:32 PM

Posted 14 June 2006 - 06:10 PM

Bleeping Computer -> Startup Programs Database -> Search Results for scvhost
http://www.bleepingcomputer.com/startups/

Just in case you weren't aware of the BC startup database.

Edited by Scarlett, 14 June 2006 - 06:11 PM.

Posted Image

#10 imperious

imperious

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:04:32 PM

Posted 14 June 2006 - 07:21 PM

i downloaded ewido and every time i start it up it freezes
because of a noon-responsive securitysuite.exe
IMPERIOUS

#11 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,399 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:32 PM

Posted 15 June 2006 - 07:48 AM

Ok then, please read and follow all instructions in the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log".
When you have done that, post a log in the HijackThis Logs and Analysis Forum, not here, for assistance by the HJT Team Experts.

Start a new topic, give it a relevant title and post the log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. Please include the top portion of the HijackThis log that lists version information. An expert will analyze your log and reply with instructions advising you what to fix

It may take a while to get a response because the HJT Team members are very busy. Please be patient as they are volunteers who will help you out as soon as possible. Once you have made your post, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have no replies as this makes it easier for them to identify those who have not been helped. If you post another response, a team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

If after 5 days you still have received no response, then post a link to your HJT log here.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users