Karl`s PC Help Forums

Svchost.exe
Dreamweaver - 5-10-2008 at 18:16

I have this on my PC, some places say delete immediately, but others say it's a normal part of windows XP professional.
Do I delete or not?


Theravad - 5-10-2008 at 19:02

Quote:
Originally posted by Dreamweaver
I have this on my PC, some places say delete immediately, but others say it's a normal part of windows XP professional.
Do I delete or not?


http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

It is essential for Windows unfortunately some virus/trogens use the same name to launch their stuff.

T


Theravad - 5-10-2008 at 19:04

can you open a command windows and type:

tasklist /svc

this will list all your services and show what is actually running under svchost.exe

T


Dreamweaver - 5-10-2008 at 19:09

Yes but when I do, it seems open a dos window then immediately closes again...


Theravad - 5-10-2008 at 19:21

Quote:
Originally posted by Dreamweaver
Yes but when I do, it seems open a dos window then immediately closes again...


run a command window first and then type it into that window.

Start->Run... CMD


Dreamweaver - 5-10-2008 at 19:27

Does this help?


ystem Idle Process 0 N/A
System 4 N/A
smss.exe 608 N/A
csrss.exe 656 N/A
winlogon.exe 680 N/A
services.exe 724 Eventlog, PlugPlay
lsass.exe 736 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 904 DcomLaunch, TermService
svchost.exe 972 RpcSs
svchost.exe 1068 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
HidServ, lanmanserver, lanmanworkstation,
Netman, Nla, RasMan, Schedule, seclogon,
SENS, SharedAccess, ShellHWDetection,
TapiSrv, Themes, TrkWks, W32Time, winmgmt,
wscsvc, wuauserv, WZCSVC
svchost.exe 1192 Dnscache
svchost.exe 1264 LmHosts, RemoteRegistry, SSDPSRV, WebClient
ccSetMgr.exe 1396 ccSetMgr
ccEvtMgr.exe 1440 ccEvtMgr
spoolsv.exe 1580 Spooler
explorer.exe 472 N/A
TBPANEL.exe 576 N/A
RTHDCPL.EXE 372 N/A
ccApp.exe 636 N/A
VPTray.exe 644 N/A
jusched.exe 660 N/A
CFD.exe 800 N/A
apdproxy.exe 856 N/A
LaunchApplication.exe 128 N/A
realsched.exe 1088 N/A
rundll32.exe 1096 N/A
AppleMobileDeviceService. 1208 Apple Mobile Device
mDNSResponder.exe 1220 Bonjour Service
DefWatch.exe 1280 DefWatch
MDM.EXE 1644 MDM
nvsvc32.exe 1712 NVSvc
iTunesHelper.exe 1888 N/A
ctfmon.exe 1908 N/A
msnmsgr.exe 1920 N/A
fumoei.exe 1952 N/A
HOMERunner.exe 1968 N/A
E_FATICLE.EXE 1976 N/A
svchost.exe 632 stisvc
Rtvscan.exe 568 Symantec AntiVirus
EasyShare.exe 2176 N/A
ServiceLayer.exe 2636 ServiceLayer
alg.exe 2752 ALG
iPodService.exe 3064 iPod Service
usnsvc.exe 3848 usnjsvc
HCBG2.EXE 3012 N/A
iexplore.exe 1864 N/A
RBroker.exe 3300 N/A
WLLoginProxy.exe 1848 N/A
cmd.exe 2492 N/A
tasklist.exe 2496 N/A
wmiprvse.exe 2088 N/A


Daz - 6-10-2008 at 00:53

At first glance, there doesn't appear to be to anything jumping out there Dot, but Pancake may spot something, or ask for a HJT log/ComboFix log if he's got any doubts...

/My 2p worth...! ;)


Dreamweaver - 6-10-2008 at 06:32

Quote:
Originally posted by Daz
At first glance, there doesn't appear to be to anything jumping out there Dot, but Pancake may spot something, or ask for a HJT log/ComboFix log if he's got any doubts...

/My 2p worth...! ;)

Oh dear.... not the dreaded HJT log lol :);)


LSemmens - 6-10-2008 at 14:41

As has already been ibserved svchost is a standard windoze file, IIRC it must reside in the system32 directory, any where else and it is most likely a nasty. Do the HJT thing, if only for your peace of mind.