4 instances of SVCHOST running

I have 4 instances of this same service running on my computer. I always have this number when I check my Task Manager. Is this normal, or is something wrong?

 

5



svchost.exe- not to be confused with scvhost.exe, a baddie.

 

4, here, on Pro.

Johanna

 

Ah, OK. Thanks!

 

If you want more detail on what is in each instance of svchost.exe then from A Description of Svchost.exe in Windows XP

 

Mine can be anywhere from 2 to 4.

On bootup, its 2, then if I go on line or invoke a service, the instances will increase.

What I did was go thru the services over a long period of time - 2 years, and turn the startup type on some of them to manual. That invokes the service on a as needed basis. Used the Black Viper site and my own experimentation to do that.

Regards - Charles

 

I have XP Home and tasklist is not a recognized command. How do I accomplish this otherwise?

 

Sorry Dave - the article didn't make it clear that this was an XP-pro thing unless you went to the very bottom to see what systems the article pertained to. I'm thinking that for some reason XP-home doesn't have any way to do the deed.

As an experiment, I'd be happy to send a copy to you for a try on your xp-home system. I think the .exe is a stand-alone and I've zipped a copy to 35Kb so if you want it, send me email to newt.vail@pmusa.com if it's in the next 3 hours or so or to nvail@ctc.net after that. Just put the file into system32 and see how if it works.

 

Hi Newt,

Yes, I did see that it only applied to Pro, but only after trying it. Hence the post asking how to do it in Home. E-mail has been sent.

 

Dave: Let us know if that .exe file works, if so, I'd like to have a copy for my XP Home machine.

Thanks,

Martin

 

Sure will Martin.

 

Check your email. Sent about a minute ago as a zip file.

 

While 3, 4, or even 5 instances of svchost.exe is normal in XP's running processes, and it's known that scvhost.exe is a baddie, I came accross some additional information I'd like to share.

The worm creates another instance of svchost.exe in running processes! When it runs, CPU usage pegs.. 99%- 100%.. and stays there.

 

Thanks Newt. Tasklist /svc worked fine. Results of more info;
C:\Documents and Settings\Dave>Tasklist /FI "PID eq processID "
ERROR: The search filter cannot be recognized.

 

Interesting article. I'd never noticed a windows\system32\wins folder before but by golly, I do have one. Seems to be empty though.

Wonder what it's there for. Maybe created by a patch to confuse this particular worm?

And now I wonder if the filters live somewhere outside the tasklist exe. Anyway - good to know at least the basic app runs on the home version.

 

RE: wins folder
Not sure but if I find out I'll let you know. Think I'll check for it on a clean install of XP Pre SP1.

 

I figured that someone might actually want to know why the svchost.exe process runs, and why more than once, rather than just knowing that it's normal. So here is a description and explanation that I felt was pretty good.

 

Note to Newt:

Wiped a drive and installed pre-SP1 XP on it today. There is an empty wins folder. I've come to believe it's purpose is to have that virus written into it. Think I'm gonna delete it.