do I need 13 svchost.exe's running in XP?

feedscrn · External Since: Sep 13, 2009 Posts: 6

In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+

Daave · External Since: May 06, 2009 Posts: 71

feedscrn wrote:
> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
> System / 5-Local Service / 2-Network Service
>
> The only app running is Windows Task Manager. McAfee is running in the
> background. My laptop wireless switch is turned Off.
>
> It seems excessive, is all I'm saying. Is there a tool that Microsoft
> provides to see what each svchost.exe program is doing?

See:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

http://www.bleepingcomputer.com/tutorials/tutorial129.html

MarkJSpinnover · External Since: Sep 13, 2009 Posts: 2

On Sep 13, 9:14 am, "Daave" <da....DeleteThis@example.com> wrote:
> See:
>
> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
>
> http://www.bleepingcomputer.com/tutorials/tutorial129.html

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+

MarkJSpinnover · External Since: Sep 13, 2009 Posts: 2

On Sep 13, 9:14 am, "Daave" <da... DeleteThis @example.com> wrote:

> See:

> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> http://www.bleepingcomputer.com/tutorials/tutorial129.html

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+

feedscrn · External Since: Sep 13, 2009 Posts: 6

On Sep 13, 9:14 am, "Daave" <da....TakeThisOut@example.com> wrote:

> See:

> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

> http://www.bleepingcomputer.com/tutorials/tutorial129.html

Very useful tool! Thank You.

I found that if the sort is done in the first column, then I can dbl-
click on each svchost.exe and it immediately goes to the Services tab.
If there is a description, it will be under the big window. I can then
hit the Esc key to go back.

There are a couple of 'services' ala svchost.exe instances that I find
questionable.... These are listed below. Does anyone else have these
running?

stisvc - Display Name: Windows Image Acquisition (WIA)
Path: C:\WINDOWS\sysem32\wiaservc.dll
Purpose: Provides image acquisition services for scanners
and cameras.
-I do have an HP all-in-one scanner/printer/fax, this is probably used
for this. I don't use the 'direct from pc to scanner' feature that
much.

WebClient - Display Name- WebClient
Path: C:\WINDOWS\System32\webclnt.dll
Purpose: Enables Windows-based programs to create, access,
and modify Internet-based files. If this service is stopped, these
functions will not be available. If this service is disabled, any
services that explicitly depend on it will fail to start.
-Possibly connected to the HP all-in-one device above.

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff. Comes in an svchost.exe with LmHosts service, which
looks harmless.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+

Daave · External Since: May 06, 2009 Posts: 71

feedscrn wrote:
> On Sep 13, 9:14 am, "Daave" <da... DeleteThis @example.com> wrote:
>
>> See:
>
>> http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
>
>> http://www.bleepingcomputer.com/tutorials/tutorial129.html
>
> Very useful tool! Thank You.

You're welcome. Glad to help.

> I found that if the sort is done in the first column, then I can dbl-
> click on each svchost.exe and it immediately goes to the Services tab.
> If there is a description, it will be under the big window. I can then
> hit the Esc key to go back.
>
> There are a couple of 'services' ala svchost.exe instances that I find
> questionable.... These are listed below. Does anyone else have these
> running?
>
> stisvc - Display Name: Windows Image Acquisition (WIA)
> Path: C:\WINDOWS\sysem32\wiaservc.dll
> Purpose: Provides image acquisition services for scanners
> and cameras.
> -I do have an HP all-in-one scanner/printer/fax, this is probably used
> for this. I don't use the 'direct from pc to scanner' feature that
> much.
>
> WebClient - Display Name- WebClient
> Path: C:\WINDOWS\System32\webclnt.dll
> Purpose: Enables Windows-based programs to create, access,
> and modify Internet-based files. If this service is stopped, these
> functions will not be available. If this service is disabled, any
> services that explicitly depend on it will fail to start.
> -Possibly connected to the HP all-in-one device above.
>
> RemoteRegistry - Display Name: Remote Registry
> Path: C:\WINDOWS\system32\regsvc.dll
> Purpose: Enables remote users to modify registry settings
> on this computer. If this service is stopped, the registry can be
> modified only by users on this computer. If this service is disabled,
> any services that explicitly depend on it will fail to start.
> -Scary stuff. Comes in an svchost.exe with LmHosts service, which
> looks harmless.

They're all normal. You can always Google these application extensions
if you wish.

feedscrn · External Since: Sep 13, 2009 Posts: 6

On Sep 14, 4:27 am, Scot T Brennecke <Sc....DeleteThis@Spamhater.MVPs.org> wrote
in
microsoft.public.vc.mfc (copied Scot's answer from NG):

> Why not go into the Administrative Tools | Services applet, stop the services you don't want, and set their properties to not allow
> them to start automatically (or even disable them)?

Touch Base · External Since: Mar 24, 2009 Posts: 9

"feedscrn" <feedscrn RemoveThis @yahoo.com> wrote in message
news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com...
In Windows Task Manager, I found 13 svchost.exe instances running: 6-
System / 5-Local Service / 2-Network Service

The only app running is Windows Task Manager. McAfee is running in the
background. My laptop wireless switch is turned Off.

It seems excessive, is all I'm saying. Is there a tool that Microsoft
provides to see what each svchost.exe program is doing?

Thank You,

FeedScrn
+-------------------------------------+
| The Screen is hungry, Feed it! |
+-------------------------------------+

=======================================================

I have 8 instances of svchost running

Another program you can use

svchost viewer

A program to see what all those svchost.exe are running.

Ever wondered what all those svchost.exe files are running ?? well here is
an app
to tell you, gives you some basic information like the Name, Description and
the
program path.

- No installation required.
- Only requirement is that you have .net installed (ver 2.0 or newer).
- Work in Windows XP (sp2) and Vista and Windows 7(Beta).
- Coded in C#

http://www.codeplex.com/svchostviewer

--
Regards,
Touch Base
Report back on the results, good or bad so others may benefit

Jim · External Since: Jan 08, 2009 Posts: 22

Process Explorer can display the command string that which determines what a
program is doing. This program was developed by Sysinternals which is now
owned by MS.
Jim
Jim
"Touch Base" <nospam.RemoveThis@_nospam.com> wrote in message
news:ecwNwncNKHA.4004@TK2MSFTNGP04.phx.gbl...
>
> "feedscrn" <feedscrn.RemoveThis@yahoo.com> wrote in message
> news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com...
> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
> System / 5-Local Service / 2-Network Service
>
> The only app running is Windows Task Manager. McAfee is running in the
> background. My laptop wireless switch is turned Off.
>
> It seems excessive, is all I'm saying. Is there a tool that Microsoft
> provides to see what each svchost.exe program is doing?
>
> Thank You,
>
> FeedScrn
> +-------------------------------------+
> | The Screen is hungry, Feed it! |
> +-------------------------------------+
>
>
>
> =======================================================
>
> I have 8 instances of svchost running
>
>
> Another program you can use
>
> svchost viewer
>
> A program to see what all those svchost.exe are running.
>
>
> Ever wondered what all those svchost.exe files are running ?? well here is
> an app
> to tell you, gives you some basic information like the Name, Description
> and
> the
> program path.
>
>
> - No installation required.
> - Only requirement is that you have .net installed (ver 2.0 or newer).
> - Work in Windows XP (sp2) and Vista and Windows 7(Beta).
> - Coded in C#
>
> http://www.codeplex.com/svchostviewer
>
>
> --
> Regards,
> Touch Base
> Report back on the results, good or bad so others may benefit
>
>
>

AJR · External Since: Apr 23, 2005 Posts: 623

Svchost is exactly that a - "host" container - "guests" depend upon
application, utilities, services, etc. that are running.

Multiple instances of svchost are not unusual - in fact the norm.

Easy wasy to mess up the computer, in addition to messing with the Registry,
is to stop services, particularly those that start automatically.

"feedscrn" <feedscrn DeleteThis @yahoo.com> wrote in message
news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com...
> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
> System / 5-Local Service / 2-Network Service
>
> The only app running is Windows Task Manager. McAfee is running in the
> background. My laptop wireless switch is turned Off.
>
> It seems excessive, is all I'm saying. Is there a tool that Microsoft
> provides to see what each svchost.exe program is doing?
>
> Thank You,
>
> FeedScrn
> +-------------------------------------+
> | The Screen is hungry, Feed it! |
> +-------------------------------------+

feedscrn · External Since: Sep 13, 2009 Posts: 6

On Sep 15, 4:35 pm, "AJR" <ajr... RemoveThis @comcast.net> wrote:
> Svchost is exactly that a - "host" container - "guests" depend upon
> application, utilities, services, etc. that are running.
>
> Multiple instances of svchost are not unusual - in fact the norm.
>
> Easy wasy to mess up the computer, in addition to messing with the Registry,
> is to stop services, particularly those that start automatically.

Agreed. Users must step lightly, or else a registry flower or two can
be trampled. This would not be good, and can make the pc unrunnable.
It's always a good idea to backup the registry before doing any
changes to it.

After everything, I conformed to the side of caution. One svchost.exe
service was permanently stopped, however:

RemoteRegistry - Display Name: Remote Registry
Path: C:\WINDOWS\system32\regsvc.dll
Purpose: Enables remote users to modify registry settings
on this computer. If this service is stopped, the registry can be
modified only by users on this computer. If this service is disabled,
any services that explicitly depend on it will fail to start.
-Scary stuff.

FeedScrn
+------------------------------------------+
| The Screen is hungry, Feed it! |
+------------------------------------------+

Daave · External Since: May 06, 2009 Posts: 71

feedscrn wrote:
> On Sep 15, 4:35 pm, "AJR" <ajr....RemoveThis@comcast.net> wrote:
>> Svchost is exactly that a - "host" container - "guests" depend upon
>> application, utilities, services, etc. that are running.
>>
>> Multiple instances of svchost are not unusual - in fact the norm.
>>
>> Easy wasy to mess up the computer, in addition to messing with the
>> Registry, is to stop services, particularly those that start
>> automatically.
>
> Agreed. Users must step lightly, or else a registry flower or two can
> be trampled. This would not be good, and can make the pc unrunnable.
> It's always a good idea to backup the registry before doing any
> changes to it.
>
> After everything, I conformed to the side of caution. One svchost.exe
> service was permanently stopped, however:
>
> RemoteRegistry - Display Name: Remote Registry
> Path: C:\WINDOWS\system32\regsvc.dll
> Purpose: Enables remote users to modify registry settings
> on this computer. If this service is stopped, the registry can be
> modified only by users on this computer. If this service is disabled,
> any services that explicitly depend on it will fail to start.
> -Scary stuff.

I don't blame you. (Then again, if you have a NAT router and the Windows
Firewall, it shouldn't matter. Still, it's not needed and it won't hurt
to disable it. Another layer of safety is just fine.)

For others:

http://www.blackviper.com/WinXP/Services/Remote_Registry.htm

Also, note that this service is not available in XP Home.

Richard · External Since: May 13, 2009 Posts: 36

> "feedscrn" <feedscrn.RemoveThis@yahoo.com> wrote in message
> news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com...
> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
> System / 5-Local Service / 2-Network Service
>
> The only app running is Windows Task Manager. McAfee is running in the
> background. My laptop wireless switch is turned Off.
>
> It seems excessive, is all I'm saying. Is there a tool that Microsoft
> provides to see what each svchost.exe program is doing?
>
> Thank You,
>
> FeedScrn
> +-------------------------------------+
> | The Screen is hungry, Feed it! |
> +-------------------------------------+
- - -

SVCHOST.EXE = Generic Host Process for Win32 Services

The "tool" with Windows XP Professional edition is Tasklist.exe

Start> Run> CMD

At Command Prompt:
cd %UserProfile%\desktop

Then:
tasklist /svc >TaskSVC.txt
That will put a text file on your desktop that will show the services that
svchost (service host) is hosting, among other processes.

(One of my 6 current instances of svchost is hosting 29 services. Smile

To display help showing other parameters available with that command:
tasklist /?

AFAIK, Tasklist is not available by default on XP Home Edition. Can someone
with an XP home CD confirm? Is there an optional tools folder on the CD?

HTH. (Hope This Helps. Smile

--Richard

Touch Base · External Since: Mar 24, 2009 Posts: 9

"Richard" <richard RemoveThis @avbtab.org> wrote in message
news:OWJ68H7TKHA.3720@TK2MSFTNGP02.phx.gbl...
> "feedscrn" <feedscrn RemoveThis @yahoo.com> wrote in message
> news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com...
> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
> System / 5-Local Service / 2-Network Service
>
> The only app running is Windows Task Manager. McAfee is running in the
> background. My laptop wireless switch is turned Off.
>
> It seems excessive, is all I'm saying. Is there a tool that Microsoft
> provides to see what each svchost.exe program is doing?
>
> Thank You,
>
> FeedScrn
> +-------------------------------------+
> | The Screen is hungry, Feed it! |
> +-------------------------------------+
- - -

SVCHOST.EXE = Generic Host Process for Win32 Services

The "tool" with Windows XP Professional edition is Tasklist.exe

Start> Run> CMD

At Command Prompt:
cd %UserProfile%\desktop

Then:
tasklist /svc >TaskSVC.txt
That will put a text file on your desktop that will show the services that
svchost (service host) is hosting, among other processes.

(One of my 6 current instances of svchost is hosting 29 services. Smile

To display help showing other parameters available with that command:
tasklist /?

AFAIK, Tasklist is not available by default on XP Home Edition. Can someone
with an XP home CD confirm? Is there an optional tools folder on the CD?

HTH. (Hope This Helps. Smile

--Richard

===========================================================

No it's not available in XP Home
Information and help with Windows svchost.exe
http://www.computerhope.com/issues/ch000517.htm

Windows XP Home users will need to download the tasklist.exe file from our
Windows XP download section.

--
Regards,
Touch Base
Report back on the results, good or bad so others may benefit

Richard · External Since: May 13, 2009 Posts: 36

>>> "feedscrn" <feedscrn RemoveThis @yahoo.com> wrote in message
>>> news:7c92f730-9574-4c75-922e-e308fc7f391a@o41g2000yqb.googlegroups.com
>>> In Windows Task Manager, I found 13 svchost.exe instances running: 6-
>>> System / 5-Local Service / 2-Network Service
>>>
>>> The only app running is Windows Task Manager. McAfee is running in the
>>> background. My laptop wireless switch is turned Off.
>>>
>>> It seems excessive, is all I'm saying. Is there a tool that Microsoft
>>> provides to see what each svchost.exe program is doing?
>>>
>>> Thank You,
>>>
>>> FeedScrn
>>> +-------------------------------------+
>>> | The Screen is hungry, Feed it! |
>>> +-------------------------------------+

>> "Richard" <richard RemoveThis @avbtab.org> wrote in message
>> news:OWJ68H7TKHA.3720@TK2MSFTNGP02.phx.gbl...
>> SVCHOST.EXE = Generic Host Process for Win32 Services
>>
>> The "tool" with Windows XP Professional edition is Tasklist.exe
>>
>> Start> Run> CMD
>>
>> At Command Prompt:
>> cd %UserProfile%\desktop
>>
>> Then:
>> tasklist /svc >TaskSVC.txt
>> That will put a text file on your desktop that will show the services
>> that svchost (service host) is hosting, among other processes.
>>
>> (One of my 6 current instances of svchost is hosting 29 services. Smile

>>
>> To display help showing other parameters available with that command:
>> tasklist /?
>>
>> AFAIK, Tasklist is not available by default on XP Home Edition. Can
>> someone with an XP home CD confirm? Is there an optional tools folder
>> on the CD?
>>
>> HTH. (Hope This Helps. Smile

>> --Richard

> "Touch Base" <nospam RemoveThis @_nospam.com> wrote in message
> news:eElz0qYUKHA.3720@TK2MSFTNGP02.phx.gbl...
> No it's not available in XP Home
> Information and help with Windows svchost.exe
> http://www.computerhope.com/issues/ch000517.htm
>
> Windows XP Home users will need to download the tasklist.exe file from our
> Windows XP download section.
> --
> Regards,
> Touch Base
> Report back on the results, good or bad so others may benefit

Thanks, I found:
tasklist.exe download here:
http://www.computerhope.com/download/winxp.htm

Managing Windows XP Programs from the Command Line- Tasklist
http://commandwindows.com/tasklist.htm

HTH. --Richard