Difference between revisions of "Windows Service Host"
(Saving progress, more soon) |
(finished for now) |
||
| Line 1: | Line 1: | ||
The '''Windows Service Host''' is a vital part of the [[Windows]] [[operating system]], but also a part which can be troublesome. to some individuals. According to [[Microsoft]], | The '''Windows Service Host''' is a vital part of the [[Windows]] [[operating system]], but also a part which can be troublesome. to some individuals. According to [[Microsoft]], | ||
{{cquote|svchost.exe is a generic host process name for services that run from dynamic-link libraries.}} | {{cquote|svchost.exe is a generic host process name for services that run from dynamic-link libraries.}} | ||
| − | Since all internal [[Windows]] processes used to be [[Dynamic-Link Library|DLL]]s, [[Microsoft]] had a problem when they wanted to switch to executable [[software|programs]] for these services. In the end, they officially made the switch, but old services where left as [[Dynamic-Link Library|DLL]]s. SvcHost was added to the system to run the [[Dynamic-Link Library|DLL]]s as executable [[software|programs]]. The problem with this is that multiple services run under the umbrella Service Host process. | + | Since all internal [[Windows]] processes used to be [[Dynamic-Link Library|DLL]]s, [[Microsoft]] had a problem when they wanted to switch to executable [[software|programs]] for these services. In the end, they officially made the switch, but old services where left as [[Dynamic-Link Library|DLL]]s. SvcHost was added to the system to run the [[Dynamic-Link Library|DLL]]s as executable [[software|programs]]. <ref>http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running</ref> |
| + | |||
| + | ==Issues== | ||
| + | The problem with this is that multiple services run under the umbrella Service Host process. For this reason, malware will sometimes use the same name to "hide in plain sight." Using a tool like [[Process Explorer]] one can check the location of the executable. If it is not located in Windows\System32 of your operating drive, it is a fake. However, the legitimate svchost.exe can be misused. Even if you see the process running from the correct location, it may be running a malicious "service." | ||
| + | |||
| + | ==Process Name(s)== | ||
| + | *svchost.exe (multiple occurrences) | ||
| + | |||
| + | ==References== | ||
| + | {{reflist}} | ||
==External Links== | ==External Links== | ||
| − | + | [https://malwaretips.com/blogs/svchost-exe-virus-removal How to detect and Deal with Malware Using the Name svchost.exe] | |
| − | [https://malwaretips.com/blogs/svchost-exe-virus-removal] | ||
Revision as of 14:40, February 4, 2016
The Windows Service Host is a vital part of the Windows operating system, but also a part which can be troublesome. to some individuals. According to Microsoft,
| “ | svchost.exe is a generic host process name for services that run from dynamic-link libraries. | ” |
Since all internal Windows processes used to be DLLs, Microsoft had a problem when they wanted to switch to executable programs for these services. In the end, they officially made the switch, but old services where left as DLLs. SvcHost was added to the system to run the DLLs as executable programs. [1]
Issues
The problem with this is that multiple services run under the umbrella Service Host process. For this reason, malware will sometimes use the same name to "hide in plain sight." Using a tool like Process Explorer one can check the location of the executable. If it is not located in Windows\System32 of your operating drive, it is a fake. However, the legitimate svchost.exe can be misused. Even if you see the process running from the correct location, it may be running a malicious "service."
Process Name(s)
- svchost.exe (multiple occurrences)
References
External Links
How to detect and Deal with Malware Using the Name svchost.exe