"svshost.exe"

-----Original Message-----
Hello, and thanks in advance -

Sometimes, when I have to "help" a program stop, Task
Manager shows me that
many instances of "svchost.exe" are running - sometimes
seven or eight. Is
this normal? If not, what is to be done about it?

Thanks...


Steve E.


.

Yes this is normal, if you mean svchost.exe and not
svshost.exe as in the subject header of your post.
svchost.exe is an xp system process.


Service Host - Generic Host Process for Win32 Services.
The full path to this file should be shown in The
Ultimate Troubleshooter as C:\WinNT\System32
\Svchost.exe or C:\Windows\System32\Svchost.exe.
Windows 2000/XP/2003 only. SVCHOST is a generic process
which acts as a host for processes that run from DLLs
rather than EXEs. At startup SVCHOST checks the Services
portion of the Registry to construct a list of DLL-based
services that it needs to load, and then loads them.
There can be many instances of SVCHOST running, as there
will be one instance of SVCHOST for every DLL-based
service or grouping of services (the grouping of services
is determined by the programmers who wrote the services
in question). Under Windows XP Professional and Windows
2003 you can find out what DLL-based services SVCHOST is
running by typing Tasklist /SVC at a Command/MS‑DOS
Prompt (this command is not available in Windows XP
Home), while under Windows 2000 you need to use the
TLIST -s command from a Command Prompt (MS-DOS Prompt)
(depending on how Windows 2000 was installed you may need
to download TLIST from the Microsoft website or install
it from one of the miscellaneous folders on the Windows
2000 CD).

Recommendation :
An integral part of the operating system, leave alone -
multiple instances of SVCHOST is a normal occurrence. If
you experience SVCHOST errors, the problem is most likely
not with SVCHOST but with the DLLs it is hosting.
However, if you experience a lot of SVCHOST errors, and
particularly, if the full path to SVCHOST.EXE is not
any of the above, then you most likely have a virus (see
below).

Svchost (2)
SVCHOST.EXE

(???)
Many viruses masquerade themselves as SVCHOST to escape
detection. Some have names that are similar, such as
SCCHOST, others actually drop a program file called
SVCHOST in the Windows folder or a Windows sub‑folder.

Recommendation :
The first recommendation is a simple one : always have a
good antivirus product which is regularly updated
(automatically preferably) and always renew your updates
subscription when it expires. To detect if you have a
virus that calls itself SVCHOST, first see if its full
path shows up in The Ultimate Troubleshooter as either
C:\WinNT\System32\Svchost.exe or C:\Windows\System32
\Svchost.exe - if it does not, then it is almost certain
you have a virus. Secondly, if you have Windows 95/98/ME
rather than Win2000/XP/2003, then it is also almost
certain you have a virus