How to reduce the number of SVCHOST.EXE process

You can copy the following code into an empty Notepad and then Save As ". Bat" batch file format, and then run the batch. You can turn off unused system services, and you will find a lot less SVCHOST.EXE. 
@ echo off 
REM off "for Internet Connection Sharing and Windows Firewall provides third-party protocol plug-in support" 
sc config alg start = disabled 
REM turn off "Windows Automatic Updates function" 
sc config wuauserv start = disabled 
REM off "ClipBook Viewer" 
sc config clipsrv start = disabled 
REM off "Messenger" 
sc config Messenger start = disabled 
REM off "through the NetMeeting Remote Access to this computer" 
sc config mnmsrvc start = disabled 
REM off "Print Spooler" 
sc config Spooler start = disabled 
REM turn off "remote to modify the registry" 
sc config RemoteRegistry start = disabled 
REM off "monitoring system security settings and configuration" 
sc config wscsvc start = disabled 
REM turn off "System Restore" 
sc config srservice start = disabled 
REM off "Scheduled Tasks" 
sc config Schedule start = disabled 
REM off "TCP / IP NetBIOS Helper" 
sc config lmhosts start = disabled 
REM turn off "Telnet Service" 
sc config tlntsvr start = disabled 
REM turn off "Firewall Services" 
sc config sharedaccess start = disabled 
REM turn off "Computer Browser" 
sc config Browser start = disabled 
REM off "false alarm" 
sc config Alerter start = disabled 
REM turn off "Error Report" 
sc config ERSvc start = disabled 
REM off "local and remote computer, the file contents and properties of the index," 
sc config cisvc start = disabled 
REM off "Management Volume Shadow Copy Service Volume Shadow Copy Software filming" 
sc config SwPrv start = disabled 
REM off "support for computers on the network pass-through account logon authentication events" 
sc config NetLogon start = disabled 
REM off "for the use of transport protocol, rather than named pipes Remote Procedure Call (RPC) programs provide a safe mechanism" 
sc config NtLmSsp start = disabled 
REM off "collect data on local or remote computers based on preconfigured schedule parameters, performance data, and then this data is written log or triggers an alert," 
sc config SysmonLog start = disabled 
REM off "through on-line computer to re-access to any music player serial number" 
sc config WmdmPmSN start = disabled 
REM off "management connected to the computer's uninterruptible power supply (UPS)" 
sc config UPS start = disabled.

by citycool. (http://computervi.com) 

 

vista: 12 svchost.exe

Users used Windows 2000/XP/Server2003 there are clear systems have 2 to 4 svchost process. However, under the svchost process in Vista up to 12. The svchost.exe is the same file path C: \ Windows \ System32 \ svchost.exe

 

So what kind of svchost process for the virus? In Vista antivirus partner(by http://www.computervi.com) in the "Security" tab for the UN on behalf of unknown safety. We also can observe the svchost process in the command line does not form a service group to start, while the corresponding Dll module path "safe" label for the UN, basically we can determine the virus.

article by citycool ,http://www.onlineypp.com

svchost exe location

Users used Windows 2000/XP/Server2003 there are clear systems have 2 to 4 svchost process. However, under the svchost process in Vista up to 12. The svchost.exe is the same file path C: \ Windows \ System32 \ svchost.exe

 

8 svchost.exe running. Multiple Instances Running

svchost.exe is a system service process. 
Because there are many services, so there will be many such process.

 

the virus process is offen posing as: svch0st.exe, schvost.exe, scvhost.exe. With the growing number of Windows system services, in order to save system resources, Microsoft has made many services share the way, by the svchost.exe process to start. The system service is a dynamic-link library (DLL) form of realization, they point to the executable program svchost, call the appropriate service from the svchost dynamic-link library to start the service. We can open the "Control Panel" → "Administrative Tools" → service, double-click them "ClipBook" service in its property panel can be found in the corresponding executable file path "C: \ WINDOWS \ system32 \ clipsrv.exe . " And then double-click the "Alerter" service, you can find the executable file path "C: \ WINDOWS \ system32 \ svchost.exe-k LocalService", and "Server" service's executable file path "C: \ WINDOWS \ system32 \ svchost.exe-k netsvcs ". It is through this call, you can save a lot of system resources, so the system appears in multiple svchost.exe, is only the system services only. In the Windows2000 system, there is generally two svchost.exe process, one is RPCSS (RemoteProcedureCall) service process, while the other is shared by many services, one svchost.exe; while in WindowsXP, then in general there are more than 4 svchost . exe service process. If the svchost.exe process than the number six, we must be careful, there may be a fake virus detection method is very simple, using some process management tools such as Windows optimized master's process management functions, see svchost.exe in executable file path, if the "C: \ WINDOWS \ system32" directory outside, it can be determined that the virus has.

 

 

7 svchost exe running .Svchost.exe in Windows XP

svchost.exe is a system service process. 
Because there are many services, so there will be many such process.

But,....

if we have svchost.exe is an uppercase letter, then you attention! 

That should be a Trojan! ! !

 

the process who have the virus, posing as: svch0st.exe, schvost.exe, scvhost.exe. With the growing number of Windows system services, in order to save system resources, Microsoft has made many services share the way, by the svchost.exe process to start. The system service is a dynamic-link library (DLL) form of realization, they point to the executable program svchost, call the appropriate service from the svchost dynamic-link library to start the service. We can open the "Control Panel" → "Administrative Tools" → service, double-click them "ClipBook" service in its property panel can be found in the corresponding executable file path "C: \ WINDOWS \ system32 \ clipsrv.exe . " And then double-click the "Alerter" service, you can find the executable file path "C: \ WINDOWS \ system32 \ svchost.exe-k LocalService", and "Server" service's executable file path "C: \ WINDOWS \ system32 \ svchost.exe-k netsvcs ". It is through this call, you can save a lot of system resources, so the system appears in multiple svchost.exe, is only the system services only. In the Windows2000 system, there is generally two svchost.exe process, one is RPCSS (RemoteProcedureCall) service process, while the other is shared by many services, one svchost.exe; while in WindowsXP, then in general there are more than 4 svchost . exe service process. If the svchost.exe process than the number six, we must be careful, there may be a fake virus detection method is very simple, using some process management tools such as Windows optimized master's process management functions, see svchost.exe in executable file path, if the "C: \ WINDOWS \ system32" directory outside, it can be determined that the virus has.

 

vista have svchost.exe,svchost,startup process

Users used Windows 2000/XP/Server2003 there are clear systems have 2 to 4 svchost process. However, under the svchost process in Vista up to 12. The svchost.exe is the same file path C: \ Windows \ System32 \ svchost.exe, they are what is difference? Vista zone today to tell you. We open the Vista Task Manager can see the user name for each svchost process is different, either SYSTEM while the others are NETWORK SERVICE 
     
     We can Vista Task Manager a new "command line" feature to see each process line peb start cmdline know really what is the corresponding group of. If we allow Vista Task Manager shows that "command line" can refer to the Vista Task Manager zone Vista's new features you know a text. They are imgsvc NetworkServiceNetworkRestricted LocalServiceNoNetwork NetworkService LocalService netsvcs LocalSystemNetworkRestricted LocalServiceNetworkRestricted services rpcss WerSvcGroup DcomLaunch Unit 


     C: \ Windows \ System32 \ svchost.exe-k imgsvc 
     C: \ Windows \ System32 \ svchost.exe-k NetworkServiceNetworkRestricted 
     C: \ Windows \ System32 \ svchost.exe-k LocalServiceNoNetwork 
     C: \ Windows \ System32 \ svchost.exe-k NetworkService
     C: \ Windows \ System32 \ svchost.exe-k LocalService 
     C: \ Windows \ System32 \ svchost.exe-k netsvcs 
     C: \ Windows \ System32 \ svchost.exe-k LocalSystemNetworkRestricted 
     C: \ Windows \ System32 \ svchost.exe-k LocalServiceNetworkRestricted 
     C: \ Windows \ System32 \ svchost.exe-k services 
     C: \ Windows \ System32 \ svchost.exe-k rpcss 
     C: \ Windows \ System32 \ svchost.exe-k WerSvcGroup 
     C: \ Windows \ System32 \ svchost.exe-k DcomLaunch 

How to tell whether the true svchost process svchost process and add-ons in the dll the existence of abnormal service. (Svchost process is used to load the Windows NT service group). Let us take a normal Vista process to analyze. 

First, we write with their own small piece of software (http://computervi.com product) to detect. From the "process management" list, we can see "select a command-line" as svchost.exe-k SDRSVC Services Division, where all For safety's svchost process, through Vista antivirus partner's "security" tab can be seen. 

So what kind of svchost process for the virus? In Vista antivirus partner in the "Security" tab for the UN -unknown safety representatives. We also can observe the svchost process in the command line does not form a service group to start, while the corresponding Dll module path "safe" label for the UN.  we can determine that it is a virus.

System services which call SVCHOST process

Application Management 
Application Management component is responsible for the installation msi file format, but in fact banned the service is okay. 
svchost.exe 
Automatic Updates 
Windows Automatic Updates service. 
svchost.exe 
Background Intelligent Transfer Service 
Achieve http1.1 transfer of information between servers, Microsoft has stated its support for HTTP when the windows update. 
svchost.exe 
COM + Event System 
Some COM + software needs, check the c: / program files / ComPlus Applications directory, if there is no document which can shut down the service. 
svchost.exe 
Computer Browser 
Used to browse the LAN computer services, but does not affect the browser closed! 
svchost.exe 
Cryptographic Services 
When Windows Update used to identify windows file fingerprint, you can update the time to open. 
svchost.exe 
DHCP Client 
The user needs to use a static IP on the use of Modem users useless. 
svchost.exe 
Distributed Link Tracking Client 
Update connection information for LAN, (for example, there are files on the computer A, computer B made a connection, if the file is moved, the service will update the information. Occupied by four megabytes of memory.) 
svchost.exe 
DNS Client 
DNS interpreter, interpreted as IP address of the domain name 
svchost.exe 
Error Reporting Service 
Error reporting to convert windows in the error report to Microsoft. 
svchost.exe 
Fast User Switching Compatibility 
Multi-user fast switching services, you like it? 
svchost.exe 
Help and Support 
Windows help. Novice, or to rely on him to pointing to. 
svchost.exe 
Human Interface Device Access 
Support "ergonomics" in computer accessories, such as the keyboard, and so increase the volume button. 
svchost.exe 
Internet Connection Firewall / Internet Connection Sharing 
XP's firewall / network for multiple computers to share a dial-up network access Internet services. 
svchost.exe 
Logical Disk Manager 
Disk management services. The system will notify you when required to open. 
svchost.exe 
Network Location Awareness (NLA) 
If the network share, or ICS / ICF may be required. (Server side). 
svchost.exe 
Portable Media Serial Number 
Windows Media Player and Microsoft to protect digital media rights. 
svchost.exe 
Remote Access Auto Connection Manager 
Broadband persons / network share needed services! 
svchost.exe 
Remote Procedure Call (RPC) 
System, core services! If Windows2000 prohibiting the service, the system will not start. 
svchost.exe 
Remote Registry Service 
Remote registry to run / modify. 
svchost.exe