What is svchost.exe?

PS. check my desktop screenshot to see what I mean.

It means you broke it.. JK

check this out http://www.igknighttec.com/Windows/WindowsXP/svchost_exe.php

It could very well be a real issue... security wise...

svchost.exe is a Generic Service Host, meaning an application is doing
something over TCP/IP....

Follow the instructions on this link from Microsoft to find out exactly what is loading and possibly doing on the web for that 3 minutes...

Because it is automatically doing something whatever it is....

:SUMMARY
: This article describes Svchost.exe and its functions. Svchost.exe is a
: generic host process name for services that run from dynamic-link libraries
: (DLLs).

some DLL files run as applications, which is one place you can get trojans and worms pecking at your system without you knowing it, or spyware that seems la-git, Logitec used to and still does have a backdoor app that loads when you install the drivers that come with the mouse which loads as a dll...

anyway...


Microsoft.com
http://support.microsoft.com/default.aspx?scid=kb;EN-US;314056

A Description of Svchost.exe in Windows XP
The information in this article applies to:
Microsoft Windows XP Professional

This article was previously published under Q314056
For a Microsoft Windows 2000 version of this article, see 250320.

Weaksid: thank you! I didn't know you could go in command line and see what service every instance of Svchost.exe is running. Very informative. Thanks again.

IPlural, by typing Tasklist /SVC one could see if it was a security leak.

possibly, if you know exactly what the dll/app listed does...

As far as security issues go and Generic Services...

GFI Lan Guard is a good utility for knwoing exactly whats doing what
on your system as far as networking goes...

There is a fully functional Freeware version for download if anyone is interested.

Provides in-depth information about all machines/devices
GFI LANguard N.S.S. scans your entire network, IP by IP, and provides information such as service pack level of the machine, missing security patches, open shares, open ports, services/applications active on the computer, key registry entries, weak passwords, users and groups, and more. Scan results are outputted to an HTML report, which can be customized/queried, enabling you to proactively secure your network - for example by shutting down unnecessary ports, closing shares, installing service packs and hotfixes, etc.

http://www.gfisoftware.com/lannetscan/index.htm

Also TaskInfo2003 v5 will dig into everything loaded and also
give much info to help with debugging/analyzing your system while running.

TaskInfo2003
http://www.iarsn.com

anyway...

Whatever it is, I know that it is a vital component of Windows and needs to run to maintain a connection. One time when I didn't know what it was, I blocked it with my firewall and it caused Windows to lock up after about 2-3 minutes of it trying to run.

Thanks for that.

I routinely closed the offending version of Svchost.exe (under the user name of NETWORK SERVICE) when I logged on, so I can't do anything about it now, but I'll save this page and all the links on it, so I can work out what's going on next time I reboot.

thats the problem withgeneric hooks and such... they are supposed to put the authors informtion inthe properties area of the app/dll so you can right click it and see who it is and what the freaking name is supposed to depict what it does...

but, I guess many hide that information by not entering it for reason of other reverse engineering things and such?

good luck with it, let us know if you nail it down

This program might help to figure out some issues...
http://www.tinysoftware.com/home/tiny2?s=2122213712249581270A0&la=EN&va=&pg=tpf4_overview