Is it normal to have 7 svchost.exe running at once?

Question

My parents are running Windows XP servicepac 3 on their PC. So, here is what I did. I went to start, run, msinfo32.exe, enter, soft ware environment, running tools. When I did this I know its okay to have svchost.exe running, but is it okay if 7 are running? If not please tell me what it means and how to stop it...If is normal then thanks for reading :)

Answer 1

Sometimes that's normal - if you have multiple apps accessing and uploading to the internet, which sometimes is impossible to determine if anything malicious is accessing svchost and using it to communicate to remote servers. That host application is used by the service registry so pretty much anything in your list of services (my computer -> manage -> services) can use it.



A few things I would do:

-find a trusted bandwidth monitoring app and carefully analyze your input/output bandwidth and see if there's unusual bandwidth activity to what you wouldn't expect.

-go through your list of services and analyze the ones that are currently running/enabled for startup and confirm they are legitimate.

-you can also go even further to see which individual module is accessing svchost using the resource monitor (for win7 and vista) or performance monitor in xp. You can even go down into the disk writing activity if you so desire.

Answer 2

Yes, 7 instances are okey if they are runned under SYSTEM, LOCAL SERVICE or NETWORK SERVICE and loaded from c:\Windows\System32. Here you could download a freeware utility to check what services are loaded using svchost.exe http://www.neuber.com/free/svchost-analyzer/index.html

Answer 3

Yeah it's probably fine. It just shows that a generic host process is running.