svchost puzzle

[Guest]

I wondered why Task Manager shows 5 separate instances of svchost.exe loaded
in RAM. Consulted Article ID314056 (06-09-2004) "To view the list of
services that are running in Svchost:" Advice: Click Start>Run. Type "CMD"
<enter> then type "Tasklist /SVC" in the DOS box. So I do it. Result:

" 'Tasklist' is not recognized as an internal or external command, operable
program or batch file."

To be doubly sure, I enter the selfsame command in Command Prompt. Same
version of command.com comes back with the identical response.

Does anybody know what is going on here? If Article 314056 has been
superseded, is there anything that replaces it? I'd just like to know why
one single Process uses up over 100K in my memory.

 

[Rick \Nutcase\ Rogers]

Hi,

Tasklist is not available in WinXP Home, only in Pro (note that the "applies
to" section mentions only Pro as well). Multiple instances of svchost.exe
are normal, the only issue I normally see is a trojan variant under
C:\Windows\system32\wins. Try Process Explorer from Sysinternals:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[Stan Brown]

Tue, 28 Feb 2006 20:13:06 -0800 from jayvan24 <jbet24@{NOSPAM}
msn.com>:

I wondered why Task Manager shows 5 separate instances of svchost.exe loaded
in RAM.

This is normal. SVCHOST runs a bunch of other processes, though it
would be nice if those processes showed in Task Mangler.

My solution is to download and run the free Process Explorer from
www.sysinternals.com -- not only does it look inside each instance of
SVCHOST, it has a handy right-click to let you google for information
about any process. This makes it almost painless to check for
suspected malware.

 

[Stan Brown]

Wed, 1 Mar 2006 06:10:11 -0500 from Rick "Nutcase" Rogers

Try Process Explorer from Sysinternals:
http://www.sysinternals.com/Utilities/ProcessExplorer.html

I see great minds think alike (and ours do too).

I posted my response before I saw yours.

 

[Guest]

Stan: With two great minds in agreement, how can I go wrong? Thanks to you
both. Process Explorer sounds like it will fit the bill. This thread is
snipped.

 

[Guest]

Nutcase: Sounds eminently sane to me. Thanks to you and Stan both. I'll
follow the link as soon as this is posted.

 

[Rick \Nutcase\ Rogers]

I see great minds think alike (and ours do too).

<g>

Been using that utility for many years, lot's of cool tools there.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org