Just what is svchost.exe?!?

Metalmurphy · April 16th, 2004

Well im just asking since alot of virus are now based on this file svchost.exe and i want to know what exactly is the file for? Specially becouse i have 5 process of svchost.ex running and my firewall sometimes asks if the file should access the net or not! :/ So any of u guys know what it is?

ShadowDancer · April 16th, 2004

I got four of them running.

Here's something from the Microsoft website

http://support.microsoft.com/default...b;en-us;250320

Drake Dagow · April 16th, 2004

I used AdAware and it fixed my problem...

Metalmurphy · April 16th, 2004

What problem? So svchost.exe is a problem?

RF · April 16th, 2004

there are many viruses that mimic svchost.exe. Sometimes they will be svch0st.exe, svhost.exe etc. Multiple instances are normal, as long as they are not viruses

I fixed a computer that had one of them, and a simple run of Trend-Micro's housecall fixed that up.

**FLaRe85** · April 17th, 2004

svchost.exe is exactly what it sounds like, "Service Host." Certain Windows services are contained in dynamic link libraries and thus need this "container app" to run. You can check up on the services which are configured to start on your computer in Administrative Tools > Services. Match the ones that are currently running with the number of svchost.exe's currently running and you'll know whether you have a virus or not. Those that use svchost.exe will point directly to it. COM+ for example uses 'C:\WINDOWS\System32\svchost.exe -k netsvcs'

Narrrf · April 17th, 2004

So how do you get rid of the viruses that are associated with it? Will a simple norton or mcaffee virus scan work, or will you have to reformat the computer?

Metalmurphy · April 17th, 2004

Hum so since some services are related to Networking its normal that the firewall asks permition! But the thing is... i've blocked the access everytime it asked and still everything worked fine! So that svchost.exe must be a fake one right?

l3illyl3ob · April 17th, 2004

Quote:

Originally Posted by Narrrf

So how do you get rid of the viruses that are associated with it? Will a simple norton or mcaffee virus scan work, or will you have to reformat the computer?

just a simple scan. They aren't actually "associated" with it, they're just trojans and the such that are named something very close to it. If you ever see an svchost.exe or similarly named file that is ran under your username (not system or network/loca service), most likely it's a virus, and you should scan.

mhaqsb1 · April 17th, 2004

This kind of problem arose for me some days ago when I was using Windows 2000 and as soon as I connected to the internet, an error came up saying

"svchost.exe has caused an error and will be shutdown".

After that, my browser (any browser, even the windows explorer) started acting up. I couldn't copy, move or do anything...I was so much annoyed. So I ran a Norton scan and found two trojans in my system32 directory.

Its XP for me now..

Metalmurphy · April 17th, 2004

Well that was probably the blaster worm and XP has that as well if u dont update it

l3illyl3ob · April 17th, 2004

XP runs on the exact same core as 2k, and thus shares many same vulnerabilities. You're just as likely to get a trojan in XP than in 2k

mhaqsb1 · April 19th, 2004

I knew that. So I have my comp updated.

Radix865 · April 19th, 2004

I had rhis thing on and I couldn't remove it when it was running... I mean I had two in the name svchost.exe then some other two in some svchost and something, so I stopped the one I knew was wrong and removed it from my PC, okay all went well until I tried to go back on-line (have a 56kb modem) there was the name of operator an after it had a .OLD and there was whole new operator to select... i removed those two and made a new one, haven't gone any strange pages after that...

**FLaRe85** · April 19th, 2004

There's nothing wrong with having multiple instances of svchost.exe's running. It's perfectly normal.

Radix865 · April 20th, 2004

Yeah, but when I searched the files with svchost.exe there was two programs with that name, and the other one had a little suspicious looking picture...

Mad · April 21st, 2004

And what is SPOOLSV.exe?? is it related to the printer??

**FLaRe85** · April 21st, 2004

Quote:

Originally Posted by Mad

And what is SPOOLSV.exe?? is it related to the printer??

Yes, it's the print spooler service.

April 16th, 2004	#1 (permalink)
Metalmurphy Ataru Moroboshi Fan =) Join Date: Jun 2001 Location: Portugal, Oporto Posts: 5,759	Just what is svchost.exe?!? Well im just asking since alot of virus are now based on this file svchost.exe and i want to know what exactly is the file for? Specially becouse i have 5 process of svchost.ex running and my firewall sometimes asks if the file should access the net or not! :/ So any of u guys know what it is? __________________ -------------------------------- Computer Specs ---------------------------------- Intel Pentium IV Prescott 3.0 HT → 4x 512MB DDR-DIMM → ASUS GF 6800 GT Sound Blaster X-Fi → 2x Maxtor 80 GB (RAID 0) Hitachi 19'' Monitor → Cambridge Soundworks Desktop Theater --------------------------------------------------------------------------------------------

April 16th, 2004	#4 (permalink)
Metalmurphy Ataru Moroboshi Fan =) Join Date: Jun 2001 Location: Portugal, Oporto Posts: 5,759	What problem? So svchost.exe is a problem? __________________ -------------------------------- Computer Specs ---------------------------------- Intel Pentium IV Prescott 3.0 HT → 4x 512MB DDR-DIMM → ASUS GF 6800 GT Sound Blaster X-Fi → 2x Maxtor 80 GB (RAID 0) Hitachi 19'' Monitor → Cambridge Soundworks Desktop Theater --------------------------------------------------------------------------------------------

April 16th, 2004	#5 (permalink)
RF Canadian Spaceman Join Date: May 2002 Location: Canada Posts: 8,580	there are many viruses that mimic svchost.exe. Sometimes they will be svch0st.exe, svhost.exe etc. Multiple instances are normal, as long as they are not viruses I fixed a computer that had one of them, and a simple run of Trend-Micro's housecall fixed that up. __________________

April 17th, 2004	#6 (permalink)
FLaRe85 I Need a Weapon Join Date: Oct 2001 Location: Omaha, NE Posts: 4,303	svchost.exe is exactly what it sounds like, "Service Host." Certain Windows services are contained in dynamic link libraries and thus need this "container app" to run. You can check up on the services which are configured to start on your computer in Administrative Tools > Services. Match the ones that are currently running with the number of svchost.exe's currently running and you'll know whether you have a virus or not. Those that use svchost.exe will point directly to it. COM+ for example uses 'C:\WINDOWS\System32\svchost.exe -k netsvcs' __________________ .: Flaretech.Net :: Flaretech.Biz Web Hosting :: H3 Stats :: My Blog :. .: Macbook Pro 17" :: 2.33 GHz Intel Core 2 Duo :: 2 GB 667 MHz DDR2 :: ATI Radeon X1600 :. .: AMD Athlon X2 4400+ @ 2.42 GHz :: OCZ 2 GB Platinum DDR400 :: eVGA NVIDIA GeForce 7800 GT :. .: Home Server :: 2.41 GHz AMD Opteron 180 :: 4 GB DDR400 :: Windows Server 2008 Standard RC0 :.

April 17th, 2004	#8 (permalink)
Metalmurphy Ataru Moroboshi Fan =) Join Date: Jun 2001 Location: Portugal, Oporto Posts: 5,759	Hum so since some services are related to Networking its normal that the firewall asks permition! But the thing is... i've blocked the access everytime it asked and still everything worked fine! So that svchost.exe must be a fake one right? __________________ -------------------------------- Computer Specs ---------------------------------- Intel Pentium IV Prescott 3.0 HT → 4x 512MB DDR-DIMM → ASUS GF 6800 GT Sound Blaster X-Fi → 2x Maxtor 80 GB (RAID 0) Hitachi 19'' Monitor → Cambridge Soundworks Desktop Theater --------------------------------------------------------------------------------------------

April 16th, 2004	#2 (permalink)
ShadowDancer Heh... Join Date: Jun 2001 Location: Texas Posts: 1,899	I got four of them running. Here's something from the Microsoft website http://support.microsoft.com/default...b;en-us;250320

April 16th, 2004	#3 (permalink)
Drake Dagow THE CLASSIC NEWB Join Date: May 2002 Location: KY Posts: 359	I used AdAware and it fixed my problem...

April 17th, 2004	#7 (permalink)
Narrrf No, not nothing Join Date: Sep 2003 Location: SoCal Posts: 237	So how do you get rid of the viruses that are associated with it? Will a simple norton or mcaffee virus scan work, or will you have to reformat the computer?

April 17th, 2004	#10 (permalink)
mhaqsb1 Banned Join Date: Sep 2002 Location: Pakistan Posts: 132	This kind of problem arose for me some days ago when I was using Windows 2000 and as soon as I connected to the internet, an error came up saying "svchost.exe has caused an error and will be shutdown". After that, my browser (any browser, even the windows explorer) started acting up. I couldn't copy, move or do anything...I was so much annoyed. So I ran a Norton scan and found two trojans in my system32 directory. Its XP for me now..

April 17th, 2004	#11 (permalink)
Metalmurphy Ataru Moroboshi Fan =) Join Date: Jun 2001 Location: Portugal, Oporto Posts: 5,759	Well that was probably the blaster worm and XP has that as well if u dont update it __________________ -------------------------------- Computer Specs ---------------------------------- Intel Pentium IV Prescott 3.0 HT → 4x 512MB DDR-DIMM → ASUS GF 6800 GT Sound Blaster X-Fi → 2x Maxtor 80 GB (RAID 0) Hitachi 19'' Monitor → Cambridge Soundworks Desktop Theater --------------------------------------------------------------------------------------------

April 17th, 2004	#12 (permalink)
l3illyl3ob Link to the Underworld Join Date: Aug 2003 Location: Detroit Posts: 1,147	XP runs on the exact same core as 2k, and thus shares many same vulnerabilities. You're just as likely to get a trojan in XP than in 2k

April 19th, 2004	#13 (permalink)
mhaqsb1 Banned Join Date: Sep 2002 Location: Pakistan Posts: 132	I knew that. So I have my comp updated.

April 19th, 2004	#14 (permalink)
Radix865 Filled with anger! Join Date: Nov 2003 Location: Finland, just below arctic circle. Posts: 1,742	I had rhis thing on and I couldn't remove it when it was running... I mean I had two in the name svchost.exe then some other two in some svchost and something, so I stopped the one I knew was wrong and removed it from my PC, okay all went well until I tried to go back on-line (have a 56kb modem) there was the name of operator an after it had a .OLD and there was whole new operator to select... i removed those two and made a new one, haven't gone any strange pages after that...

April 19th, 2004	#15 (permalink)
FLaRe85 I Need a Weapon Join Date: Oct 2001 Location: Omaha, NE Posts: 4,303	There's nothing wrong with having multiple instances of svchost.exe's running. It's perfectly normal. __________________ .: Flaretech.Net :: Flaretech.Biz Web Hosting :: H3 Stats :: My Blog :. .: Macbook Pro 17" :: 2.33 GHz Intel Core 2 Duo :: 2 GB 667 MHz DDR2 :: ATI Radeon X1600 :. .: AMD Athlon X2 4400+ @ 2.42 GHz :: OCZ 2 GB Platinum DDR400 :: eVGA NVIDIA GeForce 7800 GT :. .: Home Server :: 2.41 GHz AMD Opteron 180 :: 4 GB DDR400 :: Windows Server 2008 Standard RC0 :.

April 20th, 2004	#16 (permalink)
Radix865 Filled with anger! Join Date: Nov 2003 Location: Finland, just below arctic circle. Posts: 1,742	Yeah, but when I searched the files with svchost.exe there was two programs with that name, and the other one had a little suspicious looking picture...

April 21st, 2004	#17 (permalink)
Mad AKA snkmad Join Date: Apr 2001 Location: Brazil, Fortaleza-Ceará Posts: 2,911	And what is SPOOLSV.exe?? is it related to the printer?? __________________ [WinXP SP3] [Gigabyte GA-M61PM-S2] [Athlon64 X2 3800+ @2.00Ghz] [XFX Geforce 8600GT XxX 256MB DDR3] [17" SyncMaster 753v] [Samsung SATA II HD080HJ 80GB] [Samsung SATA II HD250HJ 250GB] [Kingston 2x1GB DDR2 6400@800MHz CL6] [Samsung CDDVDW SH-S203B] [NVIDIA nForce Networking] [Realtek ALC883 @ nVIDIA MCP61]

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode