Svchost

[ztaxlebm]

What is svc host, should it be running on my computers and should it be taking up so much memory here is a screenshot

[cheyenne1212]

svchost is an application that works as a host process for services that run from dynamic-link libraries.

Basically, its somethign to ensure that windows runs correctly. Nothing to worry about.

for future inquiries, Google will usally give you the correct asnwers to.

[nihil]

Cheyenne1212 is perfectly correct

You might have "heard something" about the Welchia/Nachi worm that is associated with svchost.exe? This is a fake that it creates in the ..../wins/ directory. NOT to be confused with the legitimate version in your system32 directory. If this is a worry, just update and run your AV, and apply the latest OS patches.

Your "services" tend to be grouped, with each group having a seperate instance of svchost running it.

If you feel that the amount of memory being used is excessive it could be that you have allowed stuff to register itself as a service and start automatically on boot-up, that you don't really need?

I should not worry about it unless you are getting out of memory errors though, as I have always taken the view that 256Meg of RAM that never gets used might as well be in your desk drawer

Hope that this helps.

[GrApHiCTrOn]

hERE is a link to w32.Bugbear.b@mm worm removal tool .The one that nihil was talking about
It creates a folder in C:\windows\system32\wins\svchost.exe and other *.exe

http://securityresponse.symantec.com...oval.tool.html

If you have an AV download all the updates and also WIndows Update

[Maestr0]

Although usually benign svchost actually is somewhat of a 'wrapper' really for something executing as a service and it is possible for malware to run under this context. If you would like to examine just exactly what IS running inside of svchost there is a program with the Windows Resource Kit called "tlist.exe" (For Win2k) which shows all the currently running threads and can be used to peek inside svchost.

Sample "tlist -s" output:


312 LSASS.EXE Svcs: Netlogon,PolicyAgent,SamSs
496 svchost.exe Svcs: RpcSs
572 CDANTSRV.EXE Svcs: C-DillaSrv
628 DefWatch.exe Svcs: DefWatch
120 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
716 Rtvscan.exe Svcs: Norton AntiVirus Server
796 PGPsdkServ.exe Svcs: PGPsdkServ
856 mstask.exe Svcs: Schedule
772 WinMgmt.exe Svcs: WinMgmt
952 svchost.exe Svcs: wuauserv
724 svchost.exe Svcs: BITS
104 explorer.exe Title: Program Manager

Here is a link to some of the common services and their process names http://www.ss64.com/ntsyntax/services.html



-Maestr0

I believe Windows XP comes with a version called tasklist which can be used with the /SVC switch, but I'm not sure if its on Home and Pro.