# Define svcehost.exe processes?



## SayWhat? (Jun 7, 2009)

All I can find, are generic answers out there that really don't say anything.

Is there a way to know what svchost.exe is really doing? I have several showing up in the Task Manager. One runs when I start the PC or bring it out of Hibernate that ties up the CPU slowing everything else down. All I see is ' svchost.exe NETWORK SERVICE '. The others are either SYSTEM or LOCAL SERVICE.

Does any Malware spoof itself as svchost.exe?

Why would one process bog the system down so much?

This is on a laptop running XPHome, SP2 using a wireless LAN connection.


----------



## CJTE (Sep 18, 2007)

Control Panel > Administrative Tools > Services

All of those services that are 'started', are launched within the svchost process.
Different services are running under different accounts (SYSTEM, LOCAL, NETWORK).

It is possible for the svchost to be infected (but it's more likely that your system is infected with something else and running a bad service), Malwarebytes Anti-Malware and Avira AntiVir should be able to help you check that.

Try ending the process on one of those svchost's...
Pick the right one and it'll shut your system down in 30 seconds


----------



## Mustang Dave (Oct 13, 2006)

Process Monitor might show what program is related to the specific svchost.exe instance. My bet is it is whichever antivirus program you are running that is scanning and/or downloading and installing updates after the computer returns from hibernation.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx


----------



## Marlin Guy (Apr 8, 2009)

You can also use Process Explorer to list each service running under the generic host process server. 
Once enumerated in Process Explorer, right-click each instance and choose Properties from the context menu to see more about what the service does.

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx


----------



## SayWhat? (Jun 7, 2009)

I forgot all about ProcExp. Not familiar with Process Monitor. I'll try those tonight. I don't really suspect Malware since nothing has ever come up in any scans, but I'll try that later too.

It acts like it's doing some sort of scan on start/wake-up. I can kill the process and the CPU comes back to normal or I can let it run out and it will finish eventually, maybe 30 minutes or so.


----------



## Marlin Guy (Apr 8, 2009)

Which antivirus are you running?


----------



## SayWhat? (Jun 7, 2009)

AVG is the primary, but I also have AvanQuest System Suite installed, but turned off. I'm curious if there is an artifact of that running even though the main program is shut down.


----------



## dpeters11 (May 30, 2007)

It is normal to have multiples of those. What you have to watch out for are ones that are misspelled, etc. I've seen up to 6 at least on a perfectly normal system.


----------



## Tom Robertson (Nov 15, 2005)

The more network services you have, the more svchost.exe instances will be running.


----------



## houskamp (Sep 14, 2006)

dpeters11 said:


> It is normal to have multiples of those. What you have to watch out for are ones that are misspelled, etc. I've seen up to 6 at least on a perfectly normal system.


 I got 13 right now :lol:


----------



## SayWhat? (Jun 7, 2009)

I have both ProcMon and ProcExp now. All I have to do is figure out what they're telling me.


----------



## Marlin Guy (Apr 8, 2009)

WinPatrol also does a good job of listing each service running under svchost.exe.


----------

