Comments on: How To Identify What Programs Started svchost.exe in Windows

By: Frank

Frank — Tue, 26 May 2009 21:30:32 +0000

Sometimes the red light is on constantly on my PC.
Sometimes when I leave the comp' the red light is on constanly.
If I move the mouse or press a key the red light slows and then flashes slowly.
Recently I managed to open task manager and could see that svchost.exe and wuauclt were busy in processes.
The OS is supposed to be W XP Home, sometimes it is W XP Professional, it depends what I happen to look at regarding info' it has on it.
I was able to put the tasklist etc into command prompt and it gave a list of the svchost.exe.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\home>tasklist /svc /FI "IMAGENAME eq svchost.exe"

Image Name PID Services
========================= ====== =============================================
svchost.exe 700 DcomLaunch, TermService
svchost.exe 780 RpcSs
svchost.exe 848 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1116 Dnscache
svchost.exe 1268 LmHosts, SSDPSRV
svchost.exe 1844 WebClient
svchost.exe 2328 stisvc

I was able to select-copy-paste the result as you see it above from the command prompt.
Qs: Why are the numbers different?
Does anyone recognise any malware in amongst the list?

By: Arshan

Arshan — Wed, 25 Mar 2009 16:12:10 +0000

If you are comfortable working with the Registry, you can get a good understanding of the description & functions of Svchost.exe at http://support.microsoft.com/kb/314056

By: Watching The Net

Watching The Net — Fri, 20 Mar 2009 16:48:45 +0000

@Justin O I did a little digging and found that tasklist is not included with Windows XP Home editions. Instead, use Process Explorer (mentioned in the article). Or if you have access to a computer running Windows XP Professional, you can copy tasklist.exe to your computer (just copy it to \Windows\System32 folder).

By: Justin O.

Justin O. — Fri, 20 Mar 2009 13:59:56 +0000

I'm running WinXP SP2 Home. When I enter "tasklist….." in a command window, it says " 'tasklist' is not recognized as an internal or external command, operable program or batch file."

By: mariposa

mariposa — Mon, 23 Feb 2009 15:48:16 +0000

i have process explorer. and i know i have a yucky trojan/malware problem i have been trying to get rid of unsuccessfully so far. and i have concluded through various malwarebytes anti malware scans and sd fixes etc etc that the file or shellpaths of the 2 rundll32 processes listed are in fact this trojan. ive always been unsure about the svchost.exe processes… but when i looked at the 'properties' of the process, i noticed it named the "parent" of this rundll32 (run a dll as an app) process, which was svchost.exe and in parentheses (916)
and there is a svchost process (916) in my list. i want to kill the process but i want to make sure its not an important process that also handles things my computer cannot function without, despite its infection.
can you tell me if its ok or not to just kill that svc host process its parented by?
im super tired, i hope all that made sense

also, what happens when you "suspend" a process>?

THANKS!!

By: Watching The Net

Watching The Net — Thu, 25 Sep 2008 23:39:55 +0000

@greg Absolutely. With virus and malware programs they usually try to hide themselves by naming themselves after processes or critical system files. Additionaly they are placed in different locations on your computer. Because they do this, you will be less likely to delete it. One wayto find them is to use a tool such as Process Explorer. Check out the article How To Identify Unknown Processes In Windows for more information.

By: greg

greg — Thu, 25 Sep 2008 00:34:55 +0000

Is it possible for a malware program to use svchost.exe?

By: greg

greg — Thu, 25 Sep 2008 00:33:26 +0000

thank you for the command line commands.

By: Watching The Net

Watching The Net — Tue, 02 Sep 2008 00:30:55 +0000

@Gus from California

Make sure you open a command prompt first, then run the command. If you use Start \ Run it will do exactly what you described (runs, then closes quickly).

By: Gus from California

Gus from California — Mon, 01 Sep 2008 21:56:04 +0000

Something is calling SVChost which in turn tries to access the internet. This could be a trojan or something else undesirable, so I want to know what program is calling the SVChost. May be earthlink, who only does my Email these days, but they do weird things to verify if you are "On". Real Player trys to run a constant message board, that I hope I got shut off.

I tried the command line approach above, and it runs. In a flash. Then closes. No time to read what it says. Why doesn't that pane persist?

Is there a better, or alternative way to figure out who is constantly trying to access the internet on my computer? It is asking for server privilege, which I have nearly eliminated by the ZoneAlarm "ask" option, so not much happens, other than it is driving me nuts answering the "ask" panel. I would just flat blacklist, except that there are many valuable uses.

By: Verlin

Verlin — Tue, 13 May 2008 17:53:28 +0000

Thanks! Ran it here as quoted and worked well.

By: Doyle

Doyle — Fri, 09 May 2008 09:45:36 +0000

I ran this also I use windows XP SP2, and says not recognized. I copy and pasted and am savvy as well.

By: Akinwale ebenezer

Akinwale ebenezer — Thu, 14 Feb 2008 15:49:23 +0000

hello,
Please i have been having the svchost/exe error on my system and it is giving me so much cause for worry, please can u send me the the detail infomation on how i can solve the problem. Thank you as i anticipation your reply. Bye.

By: Denis

Denis — Thu, 17 Jan 2008 04:52:36 +0000

I think you have failed your mission, you have Vista LOL, sorry, thats low

By: Michael

Michael — Tue, 09 Oct 2007 01:57:12 +0000

Thanks for the info mate, I have a quite a few svchost.exe instances running, but now I know it's alright.