Posted 19 February 2007 - 09:07 AM
svchost.exe is a generic host process name for a group of services that are run from dynamic-link libraries (DLLs). This is a valid system process that belongs to the Windows Operating System which handles processes executed from DLLs. It runs from the registry key, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost where details of the services running under each instance of svchost.exe can be found. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. It is not unusual for multiple instances of Svchost.exe running at the same time in Task manager in order to optimise the running of the various services. Determining whether svchost.exe is malware or a legitimate Windows process depends on the location (path) it is running from. The legit svchost.exe file is located in the C:\Windows\System32 folder.
services.exe is the Services Control Manager process which interacts with and manages the operation of starting and stopping system services that are run as processes, as opposed to those run in svchost.exe. It also deals with the automatic starting of services during the computers boot-up and the stopping of services during shut-down. Determining whether services.exe is malware or a legitimate Windows process depends on the location (path) it is running from. The legit services.exe file is located in the C:\Windows\System32 folder.
.Windows Insider MVP 2017-2018Microsoft MVP Reconnect 2016Microsoft MVP Consumer Security 2007-2015 Member of UNITE, Unified Network of Instructors and Trusted EliminatorsIf I have been helpful & you'd like to consider a donation, click