Should I have to of these processes running under svchost.exe? One runs on
PID 2728 and the other on 3016. Am curious as I do not remember seeing this
behavior before. Had read/heard that sometimes malcious code can do
something like this as well. And yes, all scans and whatnot are up to date.
This may be nothing, but thought I would check here. Thanks for the input!

Mark G. wrote:

> Should I have to of these processes running under svchost.exe? One runs on
> PID 2728 and the other on 3016. Am curious as I do not remember seeing this
> behavior before. Had read/heard that sometimes malcious code can do
> something like this as well. And yes, all scans and whatnot are up to date.
> This may be nothing, but thought I would check here. Thanks for the input!

So are you asking about programs that are hosted under the svchost.exe
process? Use SysInternals' Process Explorer to see what programs got
rolled under a particular svchost.exe instance.

Or are you only asking why there are multiple svchost.exe processes? If
so, read:

http://support.microsoft.com/kb/314056
http://www.computerhope.com/issues/ch000517.htm

Mark G. wrote:
> Should I have to of these processes running under svchost.exe? One runs on
> PID 2728 and the other on 3016. Am curious as I do not remember seeing this
> behavior before. Had read/heard that sometimes malcious code can do
> something like this as well. And yes, all scans and whatnot are up to date.
> This may be nothing, but thought I would check here. Thanks for the input!
>
>

It is OK to have more than one svchost. There is stuff running
inside each one.

In WinXP, open a command window (MSDOS window) and type

tasklist /svc

That will list the processes. For each SVCHOST it will list
what is running in it.

They'll look a bit more unique, when viewed that way.

Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
SMSS.EXE 800 N/A
CSRSS.EXE 884 N/A
WINLOGON.EXE 908 N/A
SERVICES.EXE 952 Eventlog, PlugPlay
LSASS.EXE 964 PolicyAgent, ProtectedStorage, SamSs
SVCHOST.EXE 1124 DcomLaunch, TermService
SVCHOST.EXE 1228 RpcSs
SVCHOST.EXE 1352 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
Irmon, LanmanServer, lanmanworkstation,
Netman, Nla, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
SVCHOST.EXE 1468 Dnscache
SVCHOST.EXE 1604 Alerter, LmHosts, RemoteRegistry, SSDPSRV
SPOOLSV.EXE 1840 Spooler
EXPLORER.EXE 204 N/A
SVCHOST.EXE 552 WebClient
SVCHOST.EXE 668 stisvc
....

HTH,
Paul

Mark


What is the Command line of each Process? Right click on the Process,
select Properties and click on the Image tab to get this information.

Download Process Explorer.
For further information about Process Explorer see here:
http://www.microsoft.com/technet/sys...sExplorer.mspx


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

Mark G. wrote:
> Should I have to of these processes running under svchost.exe? One
> runs on PID 2728 and the other on 3016. Am curious as I do not
> remember seeing this behavior before. Had read/heard that sometimes
> malcious code can do something like this as well. And yes, all scans
> and whatnot are up to date. This may be nothing, but thought I would
> check here. Thanks for the input!