Results 1 to 5 of 5

Thread: Svchost

  1. #1
    Junior Member
    Join Date
    Sep 2003


    What is svc host, should it be running on my computers and should it be taking up so much memory here is a screenshot

  2. #2
    Senior Member
    Join Date
    Feb 2003
    Memphis, TN
    svchost is an application that works as a host process for services that run from dynamic-link libraries.

    Basically, its somethign to ensure that windows runs correctly. Nothing to worry about.

    for future inquiries, Google will usally give you the correct asnwers to.

  3. #3
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    United Kingdom: Bridlington
    Cheyenne1212 is perfectly correct

    You might have "heard something" about the Welchia/Nachi worm that is associated with svchost.exe? This is a fake that it creates in the ..../wins/ directory. NOT to be confused with the legitimate version in your system32 directory. If this is a worry, just update and run your AV, and apply the latest OS patches.

    Your "services" tend to be grouped, with each group having a seperate instance of svchost running it.

    If you feel that the amount of memory being used is excessive it could be that you have allowed stuff to register itself as a service and start automatically on boot-up, that you don't really need?

    I should not worry about it unless you are getting out of memory errors though, as I have always taken the view that 256Meg of RAM that never gets used might as well be in your desk drawer

    Hope that this helps.

  4. #4
    Senior Member
    Join Date
    Aug 2002
    hERE is a link to w32.Bugbear.b@mm worm removal tool .The one that nihil was talking about
    It creates a folder in C:\windows\system32\wins\svchost.exe and other *.exe


    If you have an AV download all the updates and also WIndows Update

  5. #5
    Senior Member Maestr0's Avatar
    Join Date
    May 2003
    Although usually benign svchost actually is somewhat of a 'wrapper' really for something executing as a service and it is possible for malware to run under this context. If you would like to examine just exactly what IS running inside of svchost there is a program with the Windows Resource Kit called "tlist.exe" (For Win2k) which shows all the currently running threads and can be used to peek inside svchost.

    Sample "tlist -s" output:

    312 LSASS.EXE Svcs: Netlogon,PolicyAgent,SamSs
    496 svchost.exe Svcs: RpcSs
    572 CDANTSRV.EXE Svcs: C-DillaSrv
    628 DefWatch.exe Svcs: DefWatch
    120 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
    716 Rtvscan.exe Svcs: Norton AntiVirus Server
    796 PGPsdkServ.exe Svcs: PGPsdkServ
    856 mstask.exe Svcs: Schedule
    772 WinMgmt.exe Svcs: WinMgmt
    952 svchost.exe Svcs: wuauserv
    724 svchost.exe Svcs: BITS
    104 explorer.exe Title: Program Manager
    Here is a link to some of the common services and their process names http://www.ss64.com/ntsyntax/services.html


    I believe Windows XP comes with a version called tasklist which can be used with the /SVC switch, but I'm not sure if its on Home and Pro.

    \"If computers are to become smart enough to design their own successors, initiating a process that will lead to God-like omniscience after a number of ever swifter passages from one generation of computers to the next, someone is going to have to write the software that gets the process going, and humans have given absolutely no evidence of being able to write such software.\" -Jaron Lanier

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts