Re: multiple "svchost" in task manager !

From: Jamie Bulmer (JamieB_at_Quest-worldwide.com)
Date: 08/28/03 

Date: Thu, 28 Aug 2003 09:13:27 -0700

SVCHOST.EXE is usually running 3 or more times in both Win
2k and Win XP, this is normal. The service host runs
processes for other applications and services and you will
notice that the CPU time useage and memory allocation go
up and down when you perform various tasks such as
updating AV files, running IE and the such like. Recently
there has been a virus floating around that creates other
files called svchost.exe in the %systemroot%/system32/wins
directory, which on a normal system should be empty. If
you follow the correct instructions from your AV supplier
you should rid yourself of these nasty extra svchost.exe
and associated dll files. The correct svchost.exe file
should be in %systemroot%/system32, and this should not be
deleted, getting rid of it will cause a re-build to be
necessary.

>-----Original Message-----
> I'm using the same OS. I became suspicious of the
>svchost.exe after I found out that my dllhost.exe was
>infected by some adware/spyware and cleaned it up.
> My dllhost.exe had been patched to send out great
>amount of info from my pc - upload = 10 x download -
which
>invoked my suspicion. I removed it, put back the correct
>one, problem gone. Since then I found 3 copies of
>svchost, all differ in size while I found only 1 copy in
>mine; and it does not make sense to have 3 instances of
>same "servo" (whatever the right term is), hence, the
>wondering.