multiple "svchost" in task manager !

[thaivannguyen]

My Task Mgr shows that I have 3 processes with the
name "svchost" in my PC, each is of different size.
Using File Search, I could only find 1 copy of svchost
in /winnt/System32 which I verified as the original one
from the Win2000 CD (by its date & size). I conclude that
there are 2 "svchost" hidden/embedded somewhere/in some
other file in my PC. Could it be spyware? What's the
legitimate svchost.exe for anyway? How do I uncover/rid
of them ?
Could anyone help? Thanks very much.

TN

 

[Lyle H. Gray]

My Task Mgr shows that I have 3 processes with the
name "svchost" in my PC, each is of different size.

What operating system? On my Windows 2000 Pro system, having 3 processes
named "svchost" is normal. I would assume that it's normal for Windows XP
as well.

 

[David Robbins]

My Task Mgr shows that I have 3 processes with the
name "svchost" in my PC, each is of different size.
Using File Search, I could only find 1 copy of svchost
in /winnt/System32 which I verified as the original one
from the Win2000 CD (by its date & size). I conclude that
there are 2 "svchost" hidden/embedded somewhere/in some
other file in my PC. Could it be spyware? What's the
legitimate svchost.exe for anyway? How do I uncover/rid
of them ?
Could anyone help? Thanks very much.

TN

this is normal. it is just the same program running 3 times for different
services.
lets see, google for svchost and the second link is:
http://www.ntfaq.com/Articles/Index.cfm?ArticleID=20609
which tells you what the program is and what it does.

 

[thaivannguyen]

I'm using the same OS. I became suspicious of the
svchost.exe after I found out that my dllhost.exe was
infected by some adware/spyware and cleaned it up.
My dllhost.exe had been patched to send out great
amount of info from my pc - upload = 10 x download - which
invoked my suspicion. I removed it, put back the correct
one, problem gone. Since then I found 3 copies of
svchost, all differ in size while I found only 1 copy in
mine; and it does not make sense to have 3 instances of
same "servo" (whatever the right term is), hence, the
wondering.

TN

 

[Steven L Umbach]

This is perfectly normal. See KB links on svchost and how to use tlist -s
command to see services it is managing. It never hurts to do virus/trojan
scan if you are concerned. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;250320
http://support.microsoft.com/default.aspx?scid=kb;en-us;263201

 

[thaivannguyen]

Thanks very much for your replies and info. I was not
aware I was hit with anything but some spying-ware. I'll
check on the leads that you gave. Thanks again.
TN.