Skip to main content

What is svchost.exe And Why Is It Running?



What is svchost.exe And Why Is It Running?


You are no doubt reading this article because you are wondering why on earth
there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, 
and you don’t remember starting them… so what are they?
This article is part of our series explaining various processes found in Task Manager,
including: jusched.exe, dwm.exe, ctfmon.exe, wmpnetwk.exe, wmpnscfg.exe, 
mDNSResponder.exe, conhost.exe, rundll32.exe, Dpupdchk.exe, and Adobe_Updater.exe.
Do you know what those services are? Better start reading!

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that 
run from dynamic-link libraries”. Could we have that in english please?
Some time ago, Microsoft started moving all of the functionality from internal Windows
services into .dll files instead of .exe files. From a programming perspective this makes
more
sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows,
it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are 
a Lot of services required by Windows. If every single service ran under a single svchost.exe instance,
a failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and then a single svchost.exe instance is 
created for each group. For instance, one svchost.exe instance runs the 3 services related 
to the firewall. Another svchost.exe instance might run all the services related to the user interface,
and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t 
absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.
The biggest problem is identifying what services are being run on a particular svchost.exe instance…
we’ll cover that below.
If you are curious what we’re talking about, just open up Task Manager and check the 
“Show processes from all users” box:
image 

Checking From the Command Line (Vista or XP Pro)

If you want to see what services are being hosted by a particular svchost.exe instance, you can
use the tasklist command from the command prompt in order to see the list of services.
tasklist /SVC
image
The problem with using the command line method is that you don’t necessarily know what these
cryptic names refer to.

Checking in Task Manager in Vista

You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.
image
This will flip over to the Services tab, where the services running under that 
svchost.exe process 
will be selected: 

image
The great thing about doing it this way is that you can see the real name under the
Description column,
so you can choose to disable the service if you don’t want it running.

Using Process Explorer in Vista or XP

You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.
Hovering your mouse over one of the processes will show you a popup list of all the services:

image
Or you can double-click on a svchost.exe instance and select the Services tab, where you can 
choose to stop one of the services if you choose.

image 

Disabling Services

Open up Services from the administrative tools section of Control Panel, or type services.msc 
into the start menu search or run box.
Find the service in the list that you’d like to disable, and either double-click on it or right-click
and choose Properties.
image
Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.
 image
You could also use the command prompt to disable the service if you choose.
In this command
“trkwks” is the Service name from the above dialog, but if you go back to the 
tasklist command
                    at the beginning of this article you’ll notice you can find it there as well. 

            Command:

sc config trkwks start= disabled


Labels:

Comments

Post a Comment

Popular posts from this blog

Hacking via Cloning Site Using Kali Linux

Hacking via Cloning Site Using Kali Linux Hacking via Cloning Site Using Kali Linux  SET Attack Method : SET stands for Social Engineering Toolkist , primarily written by  David Kennedy . The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the  http://www.social-engineer.org  launch and has quickly became a standard tool in a penetration testers arsenal. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test. Actually this hacking method will works perfectly with DNS spoofing or Man in the Middle Attack method. Here in this tutorial I’m only writing how-to and step-by-step to perform the basic attack , but for the rest you can modified it with your own imagination. In this tutorial we will see how this attack methods can owned your com...
Post a Comment
Read more

Defacing Sites via HTML Injections (XSS)

Defacing Sites via HTML Injections Defacing Sites via HTML Injections What Is HTML Injection: "HTML Injection" is called as the Virtual Defacement Technique and also known as the "XSS" Cross Site Scripting. It is a very common vulnerability found when searched for most of the domains. This kind of a Vulnerability allows an "Attacker" to Inject some code into the applications affected in order to bypass access to the "Website" or to Infect any particular Page in that "Website". HTML injections = Cross Site Scripting, It is a Security Vulnerability in most of the sites, that allows an Attacker to Inject HTML Code into the Web Pages that are viewed by other users. XSS Attacks are essentially code injection attacks into the various interpreters in the browser. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash and other clinet side Languages. Well crafted Malicious Code can even hep the ...
Post a Comment
Read more

Hacking DNN Based Web Sites

Hacking DNN Based Web Sites Hacking DNN Based Web Sites Hacking DNN (Dot Net Nuke) CMS based websites is based on the Security Loop Hole in the CMS. For using that exploit we will see the few mentioned points which illustrates us on how to hack any live site based on Dot Net Nuke CMS. Vulnerability : This is the know Vulnerability in Dot Net Nuke (DNN) CMS. This allows aone user to Upload a File/Shell Remotely to hack that Site which is running on Dot Net Nuke CMS. The Link's for more Information regarding this Vulnerability is mentioned below -                                  http://www.exploit-db.com/exploits/12700/ Getting Started : Here we will use the Google Dork to trace the sites that are using DNN (Dot Net Nuke) CMS and are vulnerable to Remote File Upload. How To Do It : Here, I an mentioning the few points on how to Search for the existing Vulnerability in DNN. Let'...
Post a Comment
Read more

Excellent tricks and techniques of Google Hacks

Frontpage.. very nice clean search results listing !! I magine with me that you can steal or know the password of any web site designed by "Frontpage". But the file containing the password might be encrypted; to decrypt the file download the program " john the ripper". To see results; just write in the ( http://www.google.com/ ) search engine the code: "# -FrontPage-" inurl:service.pwd ============================================== This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. To see results; just write in the ( http://www.google.com/ ) search engine the code: "AutoCreate=TRUE password=*" ============================================== This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net. To see results; just write in the ( http://www.google.co...
Post a Comment
Read more

Hacking via BackTrack using SET Attack Method

Hacking via BackTrack using SET Attack Method Hacking via BackTrack using SET Attack  1. Click on Applications, BackTrack, Exploit Tools, Social Engineering Tools, Social Engineering Toolkit then select set.
Post a Comment
Read more