svchost.exe how many ??

i have 5 of these running ,is this normal ? i found that one
svchostt.exe was a trojan.got rid of that but worried that 1 of these
might be another malware.

On Sat, 17 Sep 2005 01:24:46 -0700, tarzan wrote:

> i have 5 of these running ,is this normal ? i found that one
> svchostt.exe was a trojan.got rid of that but worried that 1 of these
> might be another malware.

Well run Spybot search and destroy or a good av prog.

Dave

tarzan wrote:
> i have 5 of these running ,is this normal ? i found that one
> svchostt.exe was a trojan.got rid of that but worried that 1 of these
> might be another malware.
>

SVCHOST is the generic server process host in WinNT. It is similar to
the services offered by portmap in the unix world, i.e. RPC services of
various sorts. Multiple instances are definitely possible, and probable
on any networked win32 installation.

You can look through the properties of running services via
Administrative Tools->Computer Management->Services, and see how many of
them are invoked by running svchost with various arguments. You can
disable them, if that is your wish, but you may find various things stop
working.

A host-based software firewall should atleast detect which svchost's are
connecting to the outside world. Depending on the nature of the
connection you should allow or disallow them as required.

There is a (fairly unenlightening) description of svchost in the MS
knowledgebase, article 314056.
http://support.microsoft.com/?kbid=314056

Jim

> i have 5 of these running ,is this normal ? i found that one
> svchostt.exe was a trojan.got rid of that but worried that 1 of these
> might be another malware.

It varies - i`ve got some general tips and links to anti-virus / anti-
spyware utils (all free) on my site at http://www.coreutilities.co.uk

First off, if you`re not sure if there`s something lurking on your
system - especially if you use Nortons or McAfee :-} is to run Sysclean
from Trend. Its linked from the bottom of the second page on my site. It
uses the latest virus database that their paid-for product uses, so you
know you`re getting as good a scan as a fully paid-up customer -
consequently there are two links - one for the Sysclean program itself,
and one for the virus databases.

As for general AV software, Avast seems pretty good (and free) - pretty
much on a par with my old favourite from Kaspersky Labs.

--
Please add the word "newsgroup" in the subject line of personal emails
**** My email address includes "ngspamtrap" and "@btinternet.com" ****

"tarzan" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) oups.com...
>i have 5 of these running ,is this normal ? i found that one
> svchostt.exe was a trojan.got rid of that but worried that 1 of these
> might be another malware.

My good advice: the above is very normal, leave them be!

Some trojans may mimick the process's name slightly, but the one you
mentioned svchost.exe is normal.