Ask Experts Questions for FREE Help !
    QQapple's Avatar
    QQapple Posts: 36, Reputation: 3
    Junior Member

    Sep 30, 2003, 05:33 AM
    What's a 'svchost.exe'??

    The fact that 'svchost' rhymes with 'ghost!' worries me(I'm worried that it's a virus )especially when there are usually four of them running at any particular time :o

    This is what I see when I press alt+ctrl+del (I'm using XP):

    Windows Task Manager:
    Image name | User Name | CPU | Memery Usage
    Svchost.exe | System | 00 | 3,340 K
    Svchost.exe | System | 00 | 22,268 K
    Svchost.exe | Network Service | 00 | 2,180 K
    Svchost.exe | Local Service | 00 | 3,688 K

    Is it safe to have svchost running in the background?
    Can it be a virus or a spyware??
    speedball1's Avatar
    speedball1 Posts: 29,301, Reputation: 1939
    Eternal Plumber

    Sep 30, 2003, 08:58 AM
    Apple, Here's a explanation that may clear things up for you.

    Description of Svchost.exe in Windows XP

    This article describes Svchost.exe and its functions. Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs).

    The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can run, depending on how and where Svchost.exe is started. This allows for better control and easier debugging.

    Svchost.exe groups are identified in the following registry key:
    HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\Cu rrentVersion\Svchost

    Each value under this key represents a separate Svchost group and is displayed as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\Service

    To view the list of services that are running in Svchost:
    Click Start on the Windows taskbar, and then click Run.
    In the Open box, type CMD, and then press ENTER.
    Type Tasklist /SVC, and then press ENTER.
    Tasklist displays a list of active processes. The /SVC switch shows the list of active services in each process. For further information about a process, type the following command, and then press ENTER:
    Tasklist /FI "PID eq processID" (with the quotation marks)

    The following example of Tasklist output shows two instances of Svchost.exe that are running. Image Name PID Services
    ================================================== ======================
    System Process 0 N/A
    System 8 N/A
    Smss.exe 132 N/A
    Csrss.exe 160 N/A
    Winlogon.exe 180 N/A
    Services.exe 208 AppMgmt,Browser,Dhcp,Dmserver,Dnscache,
    Lsass.exe 220 Netlogon,PolicyAgent,SamSs
    Svchost.exe 404 RpcSs
    Spoolsv.exe 452 Spooler
    Cisvc.exe 544 Cisvc
    Svchost.exe 556 EventSystem,Netman,NtmsSvc,RasMan,
    Regsvc.exe 580 RemoteRegistry
    Mstask.exe 596 Schedule
    Snmp.exe 660 SNMP
    Winmgmt.exe 728 WinMgmt
    Explorer.exe 812 N/A
    Cmd.exe 1300 N/A
    Tasklist.exe 1144 N/A
    This is an application and not virus or spyware.
    Good luck, Tom
    QQapple's Avatar
    QQapple Posts: 36, Reputation: 3
    Junior Member

    Oct 6, 2003, 06:52 AM
    Re: svchost.exe
    Wohhhh?. thats..?

    Anyway.. I tried what you suggested... but when I got to typing in :
    Tasklist /FI "PID eq processID"
    I get a:
    ERROR: the search filter cannot be recognised.

    Oh... well... this stuff is too much for me anyway...

    If you say it is not a spyware or virus... I guess there's no need for worry...

    Thanks for your very detailed help
    (wow you must be a pro!)

Not your question? Ask your question View similar questions


Question Tools Search this Question
Search this Question:

Advanced Search

Add your answer here.

Check out some similar questions!

How do I tell what programs are launching svchost [ 2 Answers ]

First let me say I like to keep my system tight. I never load garbage programs on it and I always do routine maintenance. From the first day I built my system it has taken aproximatly 15 to 20 seconds to launch windows and be able to run apps without the hourglass popping up. Now within the last... Trojan? [ 5 Answers ]

I know about svchost.exe and its functions, but when I noticed it running from my own profile instead of SYSTEM and NETWORK, I kind of panic. I then started up a search titled, "svchost.exe" to find any viruses or trojans that would disguise themselves as an svchost.exe file,...

Svchost.exe?  And startup but not in startup file? [ 1 Answers ]

Dear All, Can you tell me what svchost.exe is? I'm always getting a box saying it has generated errors and will be closed. Also, a lot of things start up without being in the startup file. Where does the computer get the command to start those things up? The registry or somewhere else? ...

View more questions Search