Mark said:
Should I have to of these processes running under svchost.exe? One runs on
PID 2728 and the other on 3016. Am curious as I do not remember seeing this
behavior before. Had read/heard that sometimes malcious code can do
something like this as well. And yes, all scans and whatnot are up to date.
This may be nothing, but thought I would check here. Thanks for the input!
It is OK to have more than one svchost. There is stuff running
inside each one.
In WinXP, open a command window (MSDOS window) and type
tasklist /svc
That will list the processes. For each SVCHOST it will list
what is running in it.
They'll look a bit more unique, when viewed that way.
Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
SMSS.EXE 800 N/A
CSRSS.EXE 884 N/A
WINLOGON.EXE 908 N/A
SERVICES.EXE 952 Eventlog, PlugPlay
LSASS.EXE 964 PolicyAgent, ProtectedStorage, SamSs
SVCHOST.EXE 1124 DcomLaunch, TermService
SVCHOST.EXE 1228 RpcSs
SVCHOST.EXE 1352 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem,
FastUserSwitchingCompatibility, helpsvc,
Irmon, LanmanServer, lanmanworkstation,
Netman, Nla, Schedule, seclogon, SENS,
SharedAccess, ShellHWDetection, srservice,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
SVCHOST.EXE 1468 Dnscache
SVCHOST.EXE 1604 Alerter, LmHosts, RemoteRegistry, SSDPSRV
SPOOLSV.EXE 1840 Spooler
EXPLORER.EXE 204 N/A
SVCHOST.EXE 552 WebClient
SVCHOST.EXE 668 stisvc
....
HTH,
Paul
