do I need 13 svchost.exe's running in XP?

  • Thread starter Thread starter feedscrn
  • Start date Start date
F

feedscrn

In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+
 
feedscrn said:
In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?
Click to expand...

See:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

http://www.bleepingcomputer.com/tutorials/tutorial129.html
 
See:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

http://www.bleepingcomputer.com/tutorials/tutorial129.html
Click to expand...

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+
 
See:

http://www.bleepingcomputer.com/tutorials/tutorial129.html
Click to expand...

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+
 
See:

http://www.bleepingcomputer.com/tutorials/tutorial129.html
Click to expand...

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+
 
feedscrn said:
Very useful tool! Thank You.
Click to expand...

You're welcome. Glad to help.
I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.
Click to expand...

They're all normal. You can always Google these application extensions
if you wish.
 
Why not go into the Administrative Tools | Services applet, stop the services you don't want, and set their properties to not allow
them to start automatically (or even disable them)?
Click to expand...
 
In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+



=======================================================

I have 8 instances of svchost running


Another program you can use

svchost viewer

A program to see what all those svchost.exe are running.


Ever wondered what all those svchost.exe files are running ?? well here is
an app
to tell you, gives you some basic information like the Name, Description and
the
program path.


- No installation required.
- Only requirement is that you have .net installed (ver 2.0 or newer).
- Work in Windows XP (sp2) and Vista and Windows 7(Beta).
- Coded in C#

http://www.codeplex.com/svchostviewer
 
Process Explorer can display the command string that which determines what a
program is doing. This program was developed by Sysinternals which is now
owned by MS.
Jim
Jim
 
Svchost is exactly that a - "host" container - "guests" depend upon
application, utilities, services, etc. that are running.

Multiple instances of svchost are not unusual - in fact the norm.

Easy wasy to mess up the computer, in addition to messing with the Registry,
is to stop services, particularly those that start automatically.
 
Svchost is exactly that a  - "host" container - "guests" depend upon
application, utilities, services, etc. that are running.

Multiple instances of svchost are not unusual - in fact the norm.

Easy wasy to mess up the computer, in addition to messing with the Registry,
is to stop services, particularly those that start automatically.
Click to expand...

Agreed. Users must step lightly, or else a registry flower or two can
be trampled. This would not be good, and can make the pc unrunnable.
It's always a good idea to backup the registry before doing any
changes to it.

After everything, I conformed to the side of caution. One svchost.exe
service was permanently stopped, however:

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+
 
feedscrn said:
Agreed. Users must step lightly, or else a registry flower or two can
be trampled. This would not be good, and can make the pc unrunnable.
It's always a good idea to backup the registry before doing any
changes to it.

After everything, I conformed to the side of caution. One svchost.exe
service was permanently stopped, however:

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff.
Click to expand...

I don't blame you. (Then again, if you have a NAT router and the Windows
Firewall, it shouldn't matter. Still, it's not needed and it won't hurt
to disable it. Another layer of safety is just fine.)

For others:

http://www.blackviper.com/WinXP/Services/Remote_Registry.htm

Also, note that this service is not available in XP Home.
 
feedscrn said:
In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+
Click to expand...
- - -

SVCHOST.EXE = Generic Host Process for Win32 Services

The "tool" with Windows XP Professional edition is Tasklist.exe

Start> Run> CMD

At Command Prompt:
cd %UserProfile%\desktop

Then:
tasklist /svc >TaskSVC.txt
That will put a text file on your desktop that will show the services that
svchost (service host) is hosting, among other processes.

(One of my 6 current instances of svchost is hosting 29 services. :)

To display help showing other parameters available with that command:
tasklist /?

AFAIK, Tasklist is not available by default on XP Home Edition. Can someone
with an XP home CD confirm? Is there an optional tools folder on the CD?

HTH. (Hope This Helps. :)
--Richard
 
Richard said:
In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+
Click to expand...
- - -

SVCHOST.EXE = Generic Host Process for Win32 Services

The "tool" with Windows XP Professional edition is Tasklist.exe

Start> Run> CMD

At Command Prompt:
cd %UserProfile%\desktop

Then:
tasklist /svc >TaskSVC.txt
That will put a text file on your desktop that will show the services that
svchost (service host) is hosting, among other processes.

(One of my 6 current instances of svchost is hosting 29 services. :)

To display help showing other parameters available with that command:
tasklist /?

AFAIK, Tasklist is not available by default on XP Home Edition. Can someone
with an XP home CD confirm? Is there an optional tools folder on the CD?

HTH. (Hope This Helps. :)
--Richard


===========================================================

No it's not available in XP Home
Information and help with Windows svchost.exe
http://www.computerhope.com/issues/ch000517.htm

Windows XP Home users will need to download the tasklist.exe file from our
Windows XP download section.
 
Back
Top