svhost??????

[chesters1]

what is windows/system32/svhost (or words to that effect) why does my firewall report its getting ready to access the internet on startup and why does it connect when i do :confused:

what is this svhost and does it really need to go online ,and if it doesnt is it disabled within services

[Steve Randles]

[ 07. August 2004, 12:10 AM: Message edited by: Steve Randles ]

[Steve Randles]

[ 07. August 2004, 12:10 AM: Message edited by: Steve Randles ]

[Elton]

Well said, Steve

[Newt]

If you really have svhost or scvhost trying to run you have a virus. If you have svchost or svchost.exe trying to call out, that's normal.

 

Svchost.exe is a "wrapper" service in that it will play host to one or more other services. Done in Win2K and later versions to save resources.

 

svchost (usually at least two or three instances running when your PC is up) does need to run. As to if another service running within it needs to or not - that will depend on which one wants out and if you want to let it.

 

It's a little tricky to figure out just what is really trying to get out though. If you run XP-pro you can find out easily enough. If you run XP-home you lack the utility that Pro can use to give you the info but luckily the utility will run (at least parts of it will) on Home but you'll have to download it.

 

http://www.mvps.org/sramesh2k/utils/tasklist.exe

 

Once you have tasklist.exe placed in your system32 folder (no install needed) then open a "dos" window by clicking on start then on run and typing in cmd then clicking OK. When the widow opens you'll put in

code:

---

tasklist.exe /svc > c:tasklist.txt

---

at the prompt (or copying mine and pasting it in), pressing ENTER then opening c:tasklist.txt in notepad and seeing what you have. From my PC now and just showing the svchost.exe information: (and I'd expect at least w32time to be calling out)

code:

---

svchost.exe                  944 RpcSs                                        
svchost.exe                 1060 AudioSrv, BITS, CryptSvc, Dhcp, ERSvc,       
                                 EventSystem, helpsvc, Irmon, lanmanserver,   
                                 lanmanworkstation, Messenger, Netman, Nla,   
                                 RasMan, Schedule, seclogon, SENS,            
                                 ShellHWDetection, srservice, TapiSrv,        
                                 TermService, TrkWks, uploadmgr, w32time,     
                                 winmgmt                                      
svchost.exe                 1252 Dnscache                                     
svchost.exe                 1284 Alerter, LmHosts, RemoteRegistry, SSDPSRV

---

 

[ 07. August 2004, 02:51 AM: Message edited by: Newt ]

[chesters1]

yes looked properly this time and it is indeed ..svchost.exe and what a busy litle thing it is:

 

Image Name PID Services

========================= ====== =============================================

System Idle Process 0 N/A

System 4 N/A

smss.exe 400 N/A

csrss.exe 464 N/A

winlogon.exe 488 N/A

services.exe 536 Eventlog, PlugPlay

lsass.exe 548 PolicyAgent, ProtectedStorage, SamSs

svchost.exe 712 RpcSs

svchost.exe 760 AudioSrv, Browser, CryptSvc, Dhcp, ERSvc,

EventSystem, FastUserSwitchingCompatibility,

helpsvc, HidServ, lanmanserver,

lanmanworkstation, Netman, Nla, RasMan,

Schedule, seclogon, SENS, ShellHWDetection,

srservice, TapiSrv, TermService, Themes,

TrkWks, uploadmgr, W32Time, winmgmt,

WmdmPmSp, wuauserv, WZCSVC

svchost.exe 844 Dnscache

svchost.exe 888 LmHosts, SSDPSRV, WebClient

spoolsv.exe 1012 Spooler

explorer.exe 1156 N/A

Ctsvccda.exe 1216 Creative Service for CDROM Access

NISUM.EXE 1252 NISUM

nvsvc32.exe 1276 NVSvc

snmp.exe 1368 SNMP

SYMPROXYSVC.EXE 1396 SymProxySvc

ups.exe 1448 UPS

MsPMSPSv.exe 1496 WMDM PMSP Service

NISSERV.EXE 1548 NISSERV

type32.exe 336 N/A

CTHELPER.EXE 108 N/A

NAVAPW32.EXE 420 N/A

IAMAPP.EXE 436 N/A

realsched.exe 456 N/A

RcMan.exe 880 N/A

REMIND32.EXE 1364 N/A

ATRACK.EXE 1820 N/A

OSDMenu.exe 1756 N/A

EAX.exe 1960 N/A

VRC.exe 1740 N/A

RCenter.exe 1724 N/A

Mediadet.exe 2016 N/A

DialBTYahoo.exe 2136 N/A

Netscp.exe 2308 N/A

cmd.exe 2756 N/A

tasklist.exe 2772 N/A

wmiprvse.exe 2804 N/A

[chesters1]

just seems to be a list of stuff running in the background :confused:

[Newt]

That's what it is supposed to be. What did you expect to see from a utility named 'tasklist' and putting in a switch to specify 'services'?

 

The reason you'd run tasklist /svc is to see exactly what is included in the various svchost.exe processes.

 

Generally from a home PC or SOHO network, unless you want to get the time updates from the internet you can block svchost.exe from calling out.

 

Generally the things in svchost.exe that want to call out are normal and permitting them is harmless.

 

And you are quite welcome. I was happy to be able to provide you the answers to all your original questions.

 

[ 08. August 2004, 03:04 PM: Message edited by: Newt ]

[chesters1]

thanks Newt ,dont like aliens calling home so i will stop mr host in his tracks ,where does it "call" to :confused:

[chesters1]

mr host on playing with my firewall no longer phones home