Windows Service Host
The Windows Service Host is a vital part of the Windows operating system, but also a part which can be troublesome to some individuals. According to Microsoft,
| “ | svchost.exe is a generic host process name for services that run from dynamic-link libraries. | ” |
Since all internal Windows processes where previously DLLs, Microsoft had a problem when they wanted to switch to executable programs for these services. In the end, they officially made the switch, but old services where left as DLLs. SvcHost was added to the system to run the DLLs as executable programs.[1]
Issues
The problem with this is that multiple services run under the umbrella Service Host process. For this reason, malware will sometimes use the same name to "hide in plain sight." Using a tool like Process Explorer one can check the location of the executable. If it is not located in Windows\System32 of your operating drive, it is a fake. However, the legitimate svchost.exe can be misused. Even if you see the process running from the correct location, it may be running a malicious "service."
Process Name(s)
- svchost.exe (multiple occurrences)