svchost.exe

[isle_of_infamy]

ok stupid question time. When I run my IB Process Manager it lists svchost.exe as running 3 different times in the same directory. C:\WINNT\System32\svchost.exe

Is this normal ? and if it isn't does anyone know the cause and or resolution to making just show up once in the proc manager ???

I am using windows 2000 pro and have latest windows security updates

[Double//Cut]

lol, yeah mate its normal... In task manager you'l see it also runs under different user control...

Go to Control Panel -> Admin Tools -> Services

then look at each service (disable if you dont need it) and you'll see many services execute SVCHost with different parameters...

It is normal, HOWEVER, rootkits etc do use that file name, so make sure you dont let a C:\Program Fies\Inet\svchost.exe run instead of C:\windows\system32\svchost

[meeeeeee]

from http://www.computerhope.com/issues/ch000517.htm

Why do I have multiple svchost.exe files listed in Windows Task Managers processes?

Multiple svchost.exe files are loaded when a program needs to be grouped from other Windows services. This is a normal operation of Windows and it is common to see three or four svchost.exe in the Task Manager processes.

Google is your friend! That was the first search result.

[Iron-Kurton]

In google, this is the second thing that came up under "svchost.exe" search:

(From Microsoft)

Svchost.exe groups are identified in the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
Each value under this key represents a separate Svchost group and is displayed as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service_names extracted from the following registry key, whose Parameters key contains a ServiceDLL value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

Link:
http://support.microsoft.com/kb/250320/EN-US/
http://www.google.com

[isle_of_infamy]

thanks they are all C:\windows\system32\svchost as far as I can see.

now as far as going into specific services I can see that some are manual and some are disabled and some are automatic. how would I know which ones I need to be running and which ones should be disabled etc etc ??

ok iron curtain I am reading what you're saying, but I comprehend only 85% of it lol
are you saying I need to go into the registry and alter values or merely pointing out why this occurs ??

[Iron-Kurton]

For example, you can www.google.com every service that you're doubtful about, learn about it, then decide if you don't need it. If you're still having problems deciding which ones to turn off and on, post the specific services you're having doubts about.

[isle_of_infamy]

Perhap I could do one better and post a screen shot gif for you to see ?? also thanks for that webpage it was very helpful in letting me understand further about svchost.

I uploaded an animation of services and my proc manager here:
http://infamous4ever.0catch.com/Animation.gif

[sec_ware]

Hi

If you want to know a bit more about svchost.exe and how it is
related to services and listening ports on your box, you find that
information here on AO. A search for "svchost.exe" on this site
gives you several hits, among them:

second hit: a tutorial[1]. If you follow that one, you would end up with
a running box without any listening TCP/UDP port. It also explains the
svchost.exe in more words than the microsoft article. It refers to
another thread[2], where svchost.exe is explained in detail (sixth hit or so).

Just another way to secure your box a little bit more.

Cheers

P.s. I feel a bit idiotic to "advertise" articles of mine

[1] http://www.antionline.com/showthread...hlight=svchost
[2] http://www.antionline.com/showthread...hlight=svchost

[isle_of_infamy]

sec_ware not idiotic at all. I am always up for some good reading material... thanks

[isle_of_infamy]

Something of interest. I disabled Telnet in my service because I never use it, and then I deleted TlntSvr.exe and tlntsvrp.dll but those 2 files keep coming back, and I believe telnet is dependent on Remote Procedure Call (RPC) however even after disabling RPC the 2 files still reappear. any suggestions ?