What is really running under Svchost.exe? 2

[TroyMcClure]

In XP Pro, I see the svchost.exe in task manager. I know that this is generally a benign process--I know it's a Windows thing, etc. etc....

But...isn't it true that spyware can use this or be run through this? I ask because I have a machine that runs very slowly and at bootup--with nothing in the registry key Run, or Run Services (except for the plain vanilla stuff that I know is safe), and nothing in Start folder, etc, etc., I see Svchost.exe in task manager with over 20 meg!!!

Again, I have nothing that I know of running other than the plain vanilla stuff, and in other machines I may see one or two intances of svchost, but only with a few hunred K each.

I've used ProcessExplorer, which does show what .dlls each process may be using, but all I could see were ones in the Windows\system32 directory, so it's hard to tell if it's a 'bad' process or a benign one.

Is there a way to find out what's really being hosted by this .exe, or how it was started? Thanks,
T

 

[amen1973]

Microsoft's description of the svchost

http://support.microsoft.com/default.aspx?scid=kb;EN-US;314056

from cmd typ tasklist /svc to find out what is being hosted by svchost

 

[crisc]

Hmm, tasklist must be a command native to XP only. I tried this on a W2K box, doesn't exist.

 

[bfralia]

SVCHOST has been used by several virus's. It's in another folder but since all you see on the task manager is just the svchost process it's not all that obvious it's not the real thing.

Also, using the tasklist command supplied by amen1973 (Thanks BTW - I hadn't run across that one yet) I see that one of my svchost processes is running a large number of things that could account for a lot of memory usage.

 

[TroyMcClure]

Amen,
Thanks, that is an exellent link.
T

 

[amen1973]

I believe the command is tlist and pulist(adds info about the owner of the process) are the win2k equivalent. If it is not found in cmd you might have to install it from the windows 2k server resource kit.

In winxp you can call up the tasklist with its command. TSKILL is a command that you can kill a process. tskill pid ( process id number) will kill a task using its PID.

http://support.microsoft.com/?kbid=320052

works in both XP and Win2k and I believe NT as well

 

[itexprt]

TroyMcClure

a virus can run svchost.exe to create an exploitation such as an Delay of Services Attack or Distributed Denial Of Service Attack in your registry.

 

[iamnotageek]

Best way to know what is running under svchost.exe is to run ProcessExplorer (excellent freebie from Sysinternals.com). When it first comes up, it will show processes in the upper pane. Go to View - Lower Pane View and set it to show dlls.

Highlight each instance of svchost (or any other process) in the top pane to show the dlls it is using. The lower pane will show the name, description, vendor and version. Be suspicious of any dll that omits any of this info.