svchost.exe process?

Hi! I've recently updated to SP2 and also updated my firewall (ZoneAlarm), but now I have 6 svchost.exe processes running at the same time! Could this possibly mean that somebody is connected to my computer? My internet comes through a cable that's plugged in my step-dads router and I could swear that one time I could hear the same sounds that I had in my headset coming from his room with a slight delay. Am I paranoid?

I have 6 running too. I believe this is normal but I don't know why there needs to be so many are running.

I have AVG, WinPatrol, AdAware, and Spybot on duty so I don't think it's anything to do with virii.

6 here too.

Im happy to confirm that I have 6 too.

svchost.exe handles processes executed from dlls and different groups of windows services have different requirements in terms of system access and security, which is why separate instances of svchost.exe are needed.

Basically its important for your computer to run stable and secure.

I have 3 btw.

Thanks Stuart. It's a shame the device manager does not give more details as to what all those mysterious running processes are.

However, I recommend WinPatrol for such stuff. It'll give more information on the process such as description, company, and hard drive location.

Here's an example report for scvhost.exe:

Generic Host Process for Win32 Services 
svchost.exe                 Generic Host Process for Win32 Services
Version: 5.1.2600.2180         © Microsoft Corporation. All rights reserved.
Path: C:\WINDOWS\system32\svchost.exe

I knew that, but before I had SP2 installed I had like 3 or 2... I think it was 2... And look how much memory it eats up! 8-0
Well, now I can sleep well at night...

omg " © Microsoft Corporation." !!!

shut it down! shut it down! shut it down! shut it down!

they're a known hacker group

LJ, don't panic, they have not been terribly active in an age! ;O)

http://en.wikipedia.org/wiki/Svchost.exe

Little bit more in depth description there.

Heh, now I feel strange, because I have -7- running ;] 1 of them a Local and two of them a Network Service (one of which is probably ICS), the others all 'System'.

I only have 5 running, should I feel left out? :(

3 of mine are SYSTEM, 2 are NETWORK SERVICE and one is LOCAL... Hmmm... Maybe I'm not so paranoid after all!

2 copies running here. Use this guide to trim unneeded services.

http://www.dead-eye.net/WinXP%20Services.htm

i have 7! 0MfG! HaX0rs!

7 here as well, seemed to have gained another when I got my new router installed, as to which my PC felt it needed to create a "Gateway connection" to access the net via it which it doesn't need.
(and I cant find a way to make it not need...)

That's because you don't have SP2 - and don't install it as long as you can!

Google loves you.

http://www.google.com/search?q=svchost.exe

I have 15.

5 riders here..

Eh? SP2 is okay! Much better than sp1 I tell you and way more secure.

I use the built in firewall and AVG and i never have any problems with security.

6 here.

The two main things that started happening with SP2 for me were: Some applications not accepting a file as command line unless the application is also launched through the same directory (eg dragged into .exe, or dragged into a shortcut), and, horrible the time, but like the ps1 i became used to it: It takes probably around 20 times as long to start up - It used to be almost instant. Then theres the welcome screen to give the options for all the users: me, the only user, which just wont go away.

Yep. Same here! I was so freakin happy that my new computer started almost instantly and what now? Crap, it takes at least 10 times longer! Also some applications don't work with SP2 anymore!!! 8-0 (Well, at the same time there are some applications that require SP2). And because I have a bunch of new processes running (forget about scvhost - there are some others) my ram is gone before my eyes! 8-0

2 aab:
You can turn off the user log-on window somewhere in control panel -> users. Or something like that. It will not make the loading any faster though...

yeah my loading is now pig slow and used to be fast. Thing is I have hardly anthying launched and have shut down quite a few services, sigh.

My computer is the same as before. But then, my computer is pretty wierd anyway.

Yep. I've shut down every process I could and even some that I didn't want to shut down (like the one that shows the language that you have selected) and I've also have most of the graphical bells'n'whistles turned off (but not the shadow from mouse pointer - I can't live without it!), but the loading is stil slow...

Absolutely, leave your self vulnerable to every security breach under the sun...

SP2 has an aweful security centre that you've got to disable, and the inability to apply the XP software firewall to only some connections is annoying, but it is at least a more secure environment and when you're running Windows your prime target for every hacker on the planet.

Average hacking attempts per hour to a [every] machine connected to the internet, 5. Average during peak periods, 15. Mostly scripts and random IP scanning, looking for people without firewalls and critical software updates.

Figure it out. :)

Unless you have a static IP address on the actual PC - not the router - its extremely unlikely that anyone can hack into your system without your PC initialising the connection. The common way is via a downloaded trojan or similar program which initiates the connection to the outside world and opens the door for the hacker.
You don't need to worry about hackers getting in - just about your system opening the door for them.
In most home broadband scenarios the router will have a dynamic IP and your PC will have the standard private subnet address of 192.168.x.x which cannot be mapped to the outside world. The router uses NAT (Network Address Translation) so that an OUTGOING request can find its way back to the private address - this does not work for an INCOMING request. So random IP scanning is harmless unless your PC has a static public IP address.

I'm not worried about the router - my step-dad is a programmer and he had a hacker attack about two years ago. So after that he is overly protective about the network. Needles to say, I can't open ports at will - router will block most of them. My firewall is also on maximum security settings. But my consern is can he connect to my computer without me knowing? :-/

I agree that in cases where you have a good firewall (in your example a router which are increasingly common) security is less of an issue. Provided you've changed the default password and/or checked the remote management settings that is.

Most routers now will not allow configuration from the WAN unless remote management options are enabled, but this isn't always the case - especially on an older router. If it's more than a few years old you may also have left the default Telnet admin options switched on which was a common form of hacking a few years ago and there are still people automatically sweeping the IP range of the net looking for telnet connections.

Routers are increasingly configured by default with a home user in mind - but dont trust on this. We're all technical people here so be sure to use your knowledge and check the remote admin options / change the password.

A DHCP or static IP address on the router is neither here nor there though.

Dont forget also that this is an international forum, and when you think that even parts of Britain and America still dont have broadband (my brothers house has no internet at all), it's not hard to see that when giving advise on security it's dangerous to be dismissive based upon an ideal operating environment.

Remember also that a router can be hacked by some of the clever ones (thankfully there are few). If the US military can be hacked and have all their data downloaded, if Microsoft can be hacked and have the Windows source code downloaded, then i'm pretty sure the rest of us dont really stand a chance...

You guys wondering about all those instances of svchost.exe running --

If you open a dos prompt (aka command window) and type this in it:

Tasklist /SVC

you can see what they are there for.

Hmmm...

This is actually a .NET thing. If you go into the Users Accounts, delete the ASPNET user and you're laughing. Or, if you don't want to mess with .NET, from the command line : control userpasswords2 : to bring up the old pre-User Accounts config box. Invaluable.

Anatoly,
I guess it doesn't come with the Home edition of XP.

http://ask-leo.com/what_is_tasklistexe_and_why_dont_i_have_it.html