svchost.exe - is this normal?.......

[y-it-earp]

is it normal for windows xp to be running 4 of these?


svchost.exe LOCAL SERVICE
svchost.exe NETWORK SERVER
svchost.exe SYSTEM
svchost.exe SYSTEM


also vsmon.exe, spoolsv.exe (i have no network share or printer so no idea why that runs)

i get paronoid about things running i dont know!

 

[Cdr]

svchost - svchost.exe - Process Information
Process File: svchost or svchost.exe
Process Name: Service Host Process
Description: The Service Host Process is generic host process for services that are run from dynamic-link libraries (DLLs)
Common Errors: N/A
System Process: Yes

Process File: vsmon or vsmon.exe
Process Name: True Vector Internet Monitor
Description: The True Vector Internet Monitor is a component of the ZoneAlarm Personal FireWall which monitors internet traffic and generates alerts
Common Errors: N/A
System Process: No

Process File: spoolsv or spoolsv.exe
Process Name: Printer Spooler Service
Description: The Windows Printer Spooler stores printer jobs and forwards them to the printer when it is ready
Common Errors: N/A
System Process: Yes

Hope this helps

 

[evilmonkeh]

when ever you find a funny exe running, do a google for it and you normally get some info

 

[(Shovel)]

Well, I can tell you now: My copy of svchost is running five times, so I wouldn't worry about it. I can but assume that this is just the way it works.

 

[Tom]

I've got 4 of the buggers going.

 

[FatBusinessman]

As Cdr's post points out, svchost.exe is the Windows process in which DLL-based services run. The reason it can spawn multiple instances runs something like this:

Windows decides that it doesn't want all its services running in one process, because the amount of memory required for it would be huge.
Similarly, it can't have each service as its own process, as this would involve a huge amount of task switching and time lost through switching from one process to another (known as context switching).

So there are a number (usually 4 or 5) of instances of svchost.exe, each with its own allocation of services. This gives a nice compromise between manageable-size processes and a manageable number of them. I believe there's a way to find out which instance is running which services, but it's not really important.

The short answer being: Yes, it's perfectly normal.

 

[y-it-earp]

thanks for info, i had dllhost running one time and norton picked it up as being infected since then im suspicious of all goings on!

 

[Memphis2K]

if you want to tweak your XP services take a lil look at

http://www.blackviper.com

and check out the Windows XP Services guide, it's an extremely useful piece of info.