Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Svchost.exe X 6 On Processes

  • Please log in to reply
1 reply to this topic

#1 ichthys


  • Members
  • 4 posts
  • Local time:04:20 AM

Posted 02 July 2006 - 10:07 PM

On my processes list, I have 6 different files named "svchost.exe" but I have no idea which is legit and which is not.

svchost.exe LOCAL SERVICE 1,248K
svchost.exe NETWORK SERVICE 1,108K
svchost.exe SYSTEM 21,816K
svchost.exe NETWORK SERVICE 1,528K
svchost.exe SYSTEM 1,616K
svchost.exe SYSTEM 1,664K

That's what I've got on my list.

I have a total of 32 processes running. I don't think this is normal.

Thanks for any help, folks.

BC AdBot (Login to Remove)


#2 quietman7


    Bleepin' Janitor

  • Global Moderator
  • 51,754 posts
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:20 AM

Posted 02 July 2006 - 11:20 PM

Svchost.exe is a generic host process name for services that are run from dynamic-link libraries called DLLs. This is a valid system process that belongs to the Windows Operating System which handles processes executed from DLLs. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. The legit Svchost.exe file is located in the %SystemRoot%\System32 folder.

If its running as a startup/shows in msconfig, this can be bad. See here and here.

Also make sure of the spelling. If its scvhost.exe this a trojan. See here and here.

Microsoft has replaced tlist.exe with tasklist.exe in XP. Tlist.exe lets you list all the processes running on your machine and the associated task name and memory usage. Tasklist.exe replicates all the functionality of the original utility and displays a list of active processes. The /SVC switch shows the list of active services in each process.

To view the list of services that are running in Svchost:
1. Click Start > then click Run.
2. In the Open box, type CMD
3. Then press ENTER.
4. Type: Tasklist /SVC
5. Then press ENTER.

For information about tasklist.exe, type the following at the XP command prompt: tasklist /?
For more information about a process, type the following command, and then press ENTER:
Tasklist /FI "PID eq processID" (with the quotes)

You can also download and use Process Explorer by Sysinternals to investigate all processes and gather additional information to identify and resolve problems.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users