svchost.exe

[clavus]

What is svchost.exe and why does my PC feel the need to run it? Should I worry if it appears to be running multiple times simultaneously on my PC?

I run Win XP Pro

Grassy-ass!

[bgivnin]

According to this site:

http://www.liutilities.com/products/...brary/svchost/

svchost is described as:

Process File: svchost or svchost.exe
Process Name: Service Host Process
Description: Application that works as a host process for services that run from dynamic link libraries.
Company: Microsoft Corp.
System Process: Yes
Security Risk ( Virus/Trojan/Worm/Adware/Spyware ): No
Common Errors: N/A


Basically, it's running when you're running a program that runs a .dll, which is why there's several there.

[_the_wombat]

svchost.exe = good
scvhost.exe = bad

svchost run processes from dlls and it is normal to have one or several running.
scvhost on the other hand is a trojan.

[bgivnin]

Originally posted by _the_wombat
svchost.exe = good
scvhost.exe = bad

svchost run processes from dlls and it is normal to have one or several running.
scvhost on the other hand is a trojan.

I did not know that! Thanks for that info.

[RelaX]

From Some site called Ask Leo!

What is svchost, and why is there more than one copy running?

Fire up Task Manager in Windows XP, hit the processes tab and you'll see, among other processes, something called "svchost.exe". Again and again. In fact I have 5 copies running on my machine as I type this.

Svchost, as the name implies, stands for "Service Host". Many of components of the Windows operating system are implemented as what are called "services" - a fancy name for programs that run in the background, and aren't necessarily associated with whomever is logged into the machine. You can quickly see which services are running by typing "NET START" in a command window, or by looking in Control Panel, Administrative Tools, Services.

A fair number of those services are implemented in DLLs, rather than in stand-alone executables. But a DLL is only a library of functions that can be called by running programs - it can't be run on its own. Enter svchost. It's a standalone program whose job is to execute services that are implemented in DLLs.

You can see which copy of svchost is running what service by typing "tasklist /svc" in a Windows XP command window. On my machine one copy of svchost is responsible for 30 separate services, another is hosting 4, and the remaining 3 have one apiece. Why this odd distribution? The only vague clue comes from Microsoft's documentation which says "this allows for better control and debugging." OK. Whatever.

Speaking of Microsoft, they have knowledge base articles on the subject. Svchost in Windows 2000 is described here, and in Windows XP here. Both descriptions include the specific registry keys that control what services are run and how they are grouped in different instances of svchost.