Why not just run all the services under a SINGLE svchost.exe instead of cluttering up Task Manager with multiple instances (which progressively increased with each new service pack)? Sheesh...Microslop inefficiency strikes again.

Duane Arnold wrote:

> Fred Ma <(E-Mail Removed)> wrote in
> news:(E-Mail Removed):
>
> > I just went through the procedure of
> > http://vil.nai.com/vil/content/v_100559.htm
> > to get rid of Nachi worm. I did the service
> > removal, file removal, stinger, SP2 upgrade,
> > the MS03-026 patch, etc. etc. (gasp!).
> > I didn't get much work done on my thesis tonight.
> >
> > I still have *3* instances of svchost.exe in my
> > task manager. Is this normal??
>
> http://support.microsoft.com/default...b;EN-US;250320

Fred,

Ignore the troll... There are plenty here who actually KNOW what they're
talking about....

Three instances of svchost.exe is absolutely normal, nothing to worry about
there... You still having a problem ?

JB

--



*** All outgoing mail scanned by Ontrack System Suite Anti-virus ***



"Eep²" <(E-Mail Removed)> wrote in message news:(E-Mail Removed)...
> Why not just run all the services under a SINGLE svchost.exe instead of
cluttering up Task Manager with multiple instances (which progressively
increased with each new service pack)? Sheesh...Microslop inefficiency
strikes again.
>
> Duane Arnold wrote:
>
> > Fred Ma <(E-Mail Removed)> wrote in
> > news:(E-Mail Removed):
> >
> > > I just went through the procedure of
> > > http://vil.nai.com/vil/content/v_100559.htm
> > > to get rid of Nachi worm. I did the service
> > > removal, file removal, stinger, SP2 upgrade,
> > > the MS03-026 patch, etc. etc. (gasp!).
> > > I didn't get much work done on my thesis tonight.
> > >
> > > I still have *3* instances of svchost.exe in my
> > > task manager. Is this normal??
> >
> > http://support.microsoft.com/default...b;EN-US;250320
>

Eep² <(E-Mail Removed)> wrote in news:(E-Mail Removed):

> Why not just run all the services under a SINGLE svchost.exe instead
> of cluttering up Task Manager with multiple instances (which
> progressively increased with each new service pack)?
> Sheesh...Microslop inefficiency strikes again.
>
> Duane Arnold wrote:
>
>> Fred Ma <(E-Mail Removed)> wrote in
>> news:(E-Mail Removed):
>>
>> > I just went through the procedure of
>> > http://vil.nai.com/vil/content/v_100559.htm
>> > to get rid of Nachi worm. I did the service
>> > removal, file removal, stinger, SP2 upgrade,
>> > the MS03-026 patch, etc. etc. (gasp!).
>> > I didn't get much work done on my thesis tonight.
>> >
>> > I still have *3* instances of svchost.exe in my
>> > task manager. Is this normal??
>>
>> http://support.microsoft.com/default...b;EN-US;250320
>
>

As some of the other posters have indicated, three are the norm, but I
have really never noticed three of them active at one time at start-up.
But there can be more than 3 active. That's because not only does the O/S
use SVChost.exe but other non O/S program dll's like third party
application program may request the services of SVChost.exe to perform a
task and the other svchost.exe may be busy performing other duties. So if
that is the case, the O/S is going to start another svchost.exe to honor
the request.

Why is there not just one svchost.exe doing everything? Well not all
services on a NT based O/S need be loaded at one time and if one
svchost.exe was honoring all the requested tasks, I would think that
would slow the O/S down, because something would have to wait until
SVChost was free to honor the request. Using multiple occurrences of
svchost.exe along with the multi tasking, dual processors/cpu(s) usage
that can be accomplished with the NT based O/S makes for better
performance. This is also due to the fact that the workstation and sever
versions of a NT based O/S such as NT 4, Win 2K, XP, and 2K3 do not have
that much of a difference in the core components and the functionality of
the two versions. Think about it, you have 100 users or so using one
server, so the O/S needs to honor the requests and not be bottle necked,
because there is only one svchost.exe performing the tasks for
everything. So, your workstaion version has a lot of the fuctionality of
the server version.

HTH

Duane

Eep² wrote:

> It wasn't normal for Win2K without any service packs. Only ONE (1) svchost.exe ran. SP2 added another, and SP3 still another. Dunno about SP4 since I haven't bothered with it but I wouldn't be surprised if it added yet another instance.

3 svchost.exe runs under SP4.

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: http://www.microsoft.com/technet/scriptcenter

The number of instances of svchost.exe you have running depends on how many
services you have enabled that run under this executable, and how the
specific services are grouped together by functionality. I suspect MS has
further separated the grouping of services over time for stability and
security reasons. You don't want problems in a single service crashing
unrelated services, and you don't want vulnerabilities in one service
exposing the interfaces of other unrelated services.
If you look in the services control panel you will probably find more than a
dozen services which run under svchost.exe. If you look at the command line
for each of these services you will see that they are run using various
groupings: netsvcs, rpcss, wugroup,tapisrv, BITSgroup,iptelsvcs, etc. So for
example all that use the netsvcs command line option will be running under
the same instance of svchost. Many home users these days will have services
running using atleast the rpcss and netsvcs groupings so they will have
atleast two instances running. If you use windows autoupdate that adds a
third, and the BITS service which runs intermittently will add a fourth
while it is active. And so on.....So the number of instances may vary
somewhat from machine to machine, will vary on the same machine at times if
it uses manually activated services that run with a different group setting,
and is not a good indication "by itself" of whether something that uses this
executable maliciously has been installed on the machine.

> It wasn't normal for Win2K without any service packs. Only ONE (1)
svchost.exe ran. SP2 added another, and SP3 still another. Dunno about SP4
since I haven't bothered with it but I wouldn't be surprised if it added yet
another instance.
>
>
> > Was just commenting on the fact that 3 instances svchost.exe running at
> > once, is perfectly normal.... I'd have to say every PC I've seen running
> > 2000pro had 3 also.
> >

Eep² wrote:

>It wasn't normal for Win2K without any service packs. Only ONE (1) svchost.exe ran. SP2 added another, and SP3 still another. Dunno about SP4 since I haven't bothered with it but I wouldn't be surprised if it added yet another instance.
>
>
I don't have any service packs and I have two running right now.

jason

>Johnny B wrote:
>
>
>
>>Was just commenting on the fact that 3 instances svchost.exe running at
>>once, is perfectly normal.... I'd have to say every PC I've seen running
>>2000pro had 3 also.
>>
>>That's how 2000 is designed, when you run more than one instance, each with
>>an individual task assigned to it, it's much more stable than only one
>>instance, catering to multiple tasks at once... Sort of how rundll32.exe
>>does with Win 9x versions work, and exactly why they're lots less stable
>>than NT based architecture systems.
>>
>>Think of it like this,
>>
>>You go to Wal-Mart... there's 20 people waiting in one register line, the
>>cashier has a nic-fit and needs a smoke ;O) what happens ? the line
>>*crashes* and all 20 people are out of luck...
>>
>>Conversely, if there's 20 cashiers and only one person in each line, if one
>>cashier drops dead, the whole store doesn't come to a screeching halt, and
>>the one customer in that line, can just go into another line, once the
>>cashier is done with the current customer....
>>
>>Ok, I have weird analogies but hopefully you get the picture ;O)
>>
>>Either way, it's normal
>>
>>"fred ma" <(E-Mail Removed)> wrote in message
>>news:(E-Mail Removed)...
>>
>>
>>>"Johnny B" <(E-Mail Removed)> wrote in message
>>>
>>>
>>news:<_Ky1b.158010$_(E-Mail Removed)>...
>>
>>
>>>>Fred,
>>>>
>>>>Ignore the troll... There are plenty here who actually KNOW what they're
>>>>talking about....
>>>>
>>>>Three instances of svchost.exe is absolutely normal, nothing to worry about
>>>>there... You still having a problem ?
>>>>
>>>>
>>>Sorry for the late reply, Johnny, but appreciate
>>>the context you provided. That's OK, it's hard
>>>for me to have paid much attention to the advice
>>>that you're referring to because I didn't quite
>>>understand it.
>>>
>>>
>
>
>


--
((¯`'·.¸(¯`'·.((¯`'·.¸ * jason bean* ¸.·'´¯))¸.·'´¯)¸.·'´¯))

View my WeBpaGes
http://home.cogeco.ca/~jbean3
http://www.electrichaos.azn.nu/

W2K-SP4 has three instances of SVCHOST running.

On Thu, 28 Aug 2003 17:05:20 GMT, Eep² <(E-Mail Removed)> wrote:

>It wasn't normal for Win2K without any service packs. Only ONE (1) svchost.exe ran. SP2 added another, and SP3 still another. Dunno about SP4 since I haven't bothered with it but I wouldn't be surprised if it added yet another instance.

Duane Arnold <(E-Mail Removed)> wrote in message news:<Xns93DFD9B85B5C3notmenotmecom@204.127.204.17>...
> Eep² <(E-Mail Removed)> wrote in news:(E-Mail Removed):
>
> > Why not just run all the services under a SINGLE svchost.exe instead
> > of cluttering up Task Manager with multiple instances (which
> > progressively increased with each new service pack)?
> > Sheesh...Microslop inefficiency strikes again.
> >
> > Duane Arnold wrote:
> >
> >> Fred Ma <(E-Mail Removed)> wrote in
> >> news:(E-Mail Removed):
> >>
> >> > I just went through the procedure of
> >> > http://vil.nai.com/vil/content/v_100559.htm
> >> > to get rid of Nachi worm. I did the service
> >> > removal, file removal, stinger, SP2 upgrade,
> >> > the MS03-026 patch, etc. etc. (gasp!).
> >> > I didn't get much work done on my thesis tonight.
> >> >
> >> > I still have *3* instances of svchost.exe in my
> >> > task manager. Is this normal??
> >>
> >> http://support.microsoft.com/default...b;EN-US;250320
> >
> >
>
> As some of the other posters have indicated, three are the norm, but I
> have really never noticed three of them active at one time at start-up.
> But there can be more than 3 active. That's because not only does the O/S
> use SVChost.exe but other non O/S program dll's like third party
> application program may request the services of SVChost.exe to perform a
> task and the other svchost.exe may be busy performing other duties. So if
> that is the case, the O/S is going to start another svchost.exe to honor
> the request.
>
> Why is there not just one svchost.exe doing everything? Well not all
> services on a NT based O/S need be loaded at one time and if one
> svchost.exe was honoring all the requested tasks, I would think that
> would slow the O/S down, because something would have to wait until
> SVChost was free to honor the request. Using multiple occurrences of
> svchost.exe along with the multi tasking, dual processors/cpu(s) usage
> that can be accomplished with the NT based O/S makes for better
> performance. This is also due to the fact that the workstation and sever
> versions of a NT based O/S such as NT 4, Win 2K, XP, and 2K3 do not have
> that much of a difference in the core components and the functionality of
> the two versions. Think about it, you have 100 users or so using one
> server, so the O/S needs to honor the requests and not be bottle necked,
> because there is only one svchost.exe performing the tasks for
> everything. So, your workstaion version has a lot of the fuctionality of
> the server version.
>
> HTH
>
> Duane
I have 4 instances of svchost.exe - 1 for local service, 1 for network
service, and 2 for system services. My question is actually tied to
an ActiveX that becomes "active" when I access the internet and it has
the capacity to change it name. The following are some of the names
it has used:

□□þ□x□М□

□□€□x□М□

□□q□x□М□

□□~□x□М□

□□□□x□М□

□□

□□□□x□K□

□□€□x□L□

What gives here? Is this a rogue program? How do I find out more
about it? Any help will be greatly appreciated!!

Thanks!

(E-Mail Removed) (Judy) wrote in
news:(E-Mail Removed):

> Duane Arnold <(E-Mail Removed)> wrote in message
> news:<Xns93DFD9B85B5C3notmenotmecom@204.127.204.17>...
>> Eep² <(E-Mail Removed)> wrote in news:(E-Mail Removed):
>>
> I have 4 instances of svchost.exe - 1 for local service, 1 for network
> service, and 2 for system services. My question is actually tied to
> an ActiveX that becomes "active" when I access the internet and it has
> the capacity to change it name. The following are some of the names
> it has used:
>
> □□þ□x□М□
>
> □□€□x□М□
>
> □□q□x□М□
>
> □□~□x□М□
>
> □□□□x□М□
>
> □□
>
> □□□□x□K□
>
> □□€□x□L□
>
> What gives here? Is this a rogue program? How do I find out more
> about it? Any help will be greatly appreciated!!
>
> Thanks!
>


Yes, on my Win 2k Pro machine, 2 svchost.exe(s) are active. While on my
Win 2K Adv Server machine, there are 8 svchost.exe(s) with 2 hanging on
the loop back IP 127.0.0.1.

Are you sure that it's an ActiveX component? If it is an ActiveX
component, then it's going to need a hosting program so that it can run.

If it is an ActiveX component that is renaming itself, then the renamed
component is regeristing itself too, most likely using regsvr32. You
could use something like the 30 day full trial version of the the Cleaner
which will alert to the Registry being changed, then you can get rid of
the Cleaner, if it's any help. There are other Registry utilities that
have the alert on registry change.

Another thing you could do is use PRCview and when you know this program
is trying to access the Internet, start PRCview and view each running
program. You can highlight the prorgam and right-click and select
Modules. The Modules will show you all program elements that are being
used by the running program, including ActiveX components (OCX). PRCview
is free.

Another one is Active Ports that is free too.

You may also want to *harden* the NT based O/S from attack.

http://www.uksecurityonline.com/husdg/windows2000.php

This may help a little bit too.

http://www.windowsecurity.com/articl...jan_Horses_and
_Rootkit_Tools_in_a_Windows_Environment.html


HTH

Duane

"Johnny B" <(E-Mail Removed)> wrote in message news:<bAn3b.1825$(E-Mail Removed)>...
> Hello Fred,
>
> Was just commenting on the fact that 3 instances svchost.exe running at
> once, is perfectly normal.... I'd have to say every PC I've seen running
> 2000pro had 3 also.
> >
> > Sorry for the late reply, Johnny, but appreciate
> > the context you provided. That's OK, it's hard
> > for me to have paid much attention to the advice
> > that you're referring to because I didn't quite
> > understand it.
> >
> > Fred


John,

Call me the master of perpetuating misunderstandings,
but what I meant was that I didn't understanding the
so-called troll. Your first explanation was perfectly
clear, but I appreciate the time you took to elaborate
on it.

Fred