Difference between revisions of "Windows Service Host"
(finished for now) |
m (added to category: software) |
||
| Line 14: | Line 14: | ||
==External Links== | ==External Links== | ||
[https://malwaretips.com/blogs/svchost-exe-virus-removal How to detect and Deal with Malware Using the Name svchost.exe] | [https://malwaretips.com/blogs/svchost-exe-virus-removal How to detect and Deal with Malware Using the Name svchost.exe] | ||
| + | |||
| + | [[category:software]] | ||
Revision as of 15:43, February 4, 2016
The Windows Service Host is a vital part of the Windows operating system, but also a part which can be troublesome. to some individuals. According to Microsoft,
| “ | svchost.exe is a generic host process name for services that run from dynamic-link libraries. | ” |
Since all internal Windows processes used to be DLLs, Microsoft had a problem when they wanted to switch to executable programs for these services. In the end, they officially made the switch, but old services where left as DLLs. SvcHost was added to the system to run the DLLs as executable programs. [1]
Issues
The problem with this is that multiple services run under the umbrella Service Host process. For this reason, malware will sometimes use the same name to "hide in plain sight." Using a tool like Process Explorer one can check the location of the executable. If it is not located in Windows\System32 of your operating drive, it is a fake. However, the legitimate svchost.exe can be misused. Even if you see the process running from the correct location, it may be running a malicious "service."
Process Name(s)
- svchost.exe (multiple occurrences)
References
External Links
How to detect and Deal with Malware Using the Name svchost.exe