SVCHOST.EXE is perfectly ligit. It's a windows service host, i.e. a process that provides a running environment for your typical windows services, which are stored in dll files. Because you can't run a dll file, you need an executable which dynamically links to these dll's. That's svchost.

So from time to time, you may see several svchost processes popping up. Don't worry about it, those are just different environments for a number of different windows services (one svchost.exe per service).

If these bother you, or they take up too much processor time, you can always disable some services you don't need. If you don't know how to do that, it's probably best not to do it at all (so I won't tell you how; for your own safety).

Of course, like Raze states, there might still be other unsafety issues. One is the reason Raze mentions above (svchost.exe being run from a different location, meaning that it's not the original windows' svchost running); another is that some malign 'service' has found its way on your pc (so svchost itself is okay, but the dll it is linked to isn't).

For the first problem, just search your computer for all svchost.exe files (make sure you also search hidden and system files). If you find any other file than the one in c:\[WINFOLDER]\system32, try to remove it.

For the second problem, you may want to learn about services, how you get a list, and how you disable/remove them. Because it's too much to explain (and I have to start working now), you might be better off looking for some site that gives you the rundown and work from there.

Last edited by Sektor; 13/05/08 08:50 AM.
"The Large Print giveth, and the Small Print taketh away" - Tom Waits