Multiple "svchost.exe" in XP 64bit

[The Damned]

When I open task Manager after my computer loads, I notice that I have several instances of svchost.exe running.

According to both official (namely, Microsoft) and unofficial (namely, various tech support sites), it is normal to have six versions of svchost.exe (a crucial component for Windows to operate, check it out yourself on google) running under XP 64-bit edition; two for SYSTEM, two for LOCAL SERVICE, and two for NETWORK SERVICE. This is because it uses one set of each for 32-bit apps, and the other for 64-bit apps.

The thing is, though... I have a third SYSTEM instance, and it's quite a bit larger in terms of memory usage.

The one highlighted is the one I'm talking about:

If I terminate that one, Windows still runs perfectly fine, with no change in memory or processor use. But when I open Task Manager again, I get this (again, the highlighted one is the one I'm talking about):

All of the "User Name" column disappears. Things still run fine, though. I can run Winamp while playing UT 2004, and leave Firefox and IRC running in the background. No problems at all.

I've gone through with virus scans, hijackthis, spybot, everything I have, and nothing shows up. According to pretty much every site I googled, there are some trojans and viri that like to hide with the same name as the real version. But like I said, nothing showed up on the scans. And there are no extra files with that name anywhere on my system (as the real svchost.exe is only found in the system folder). I've searched about thirty different sites, including MS's documentation and support services, looking for what this could be, and nothing has popped up.

It's probably nothing, but it does bother me somewhat. I'm running two firewalls, update whenever I need to, and scan at a rather regular rate, so there shouldn't be anything that got through. Anyone have any idea on what this is doing, or if it's doing anything at all?

[jmr]

I also have one svchost.exe that takes up roughly the same amount of memory too, but I've always just ignored it.

You can check what service(s) that this particular instance of svchost handles. Note: I'm using 32bit windows, so it may not be the same. As well, there's probably an easier way to check, this is just something I came up with.

-Right Click on My Computer, and select Manage

-In the left hand pane, select Services from the Services and Applications category.

-Take a note of what services are started.

-End the particular svchost task.

-Open a second instance of Computer Management (just repeat the first few steps), and compare the started services with the started ones in the previous instance.

Also, you can control which services run at startup in the computer management window as well, so if you see anything that's running which you think shouldn't be, you can disable it.

[Pyrion]

Task Manager is stupid for this sort of shit. Switch to SysInternals Process Explorer. Then you can find out if any processes named "svchost.exe" are being loaded by explorer.exe (these are the ones you want killed) as opposed to the normal svchosts that are loaded by services.exe. Process Explorer displays everything in a tree listing, child processes underneath parent processes and so forth. Also hovering over a process name with the mouse will tell you, if it's a service, what services each svchost.exe process is responsible for.

Also, read this, and stop bitching about your memory usage. Really, a 30MB working set size for a svchost is nothing.

EDIT: This is typical for my system. Vista Ultimate x64.

[The Damned]

Bitchin'? You be trippin'!

I thought it was nothing, and the program you linked shows it to be nothing out of the ordinary. I just wanted to make sure, since I never noticed it before.

Thanks for the help everyone.

[phill]

Task Manager is stupid for this sort of shit. Switch to SysInternals Process Explorer. Then you can find out if any processes named "svchost.exe" are being loaded by explorer.exe (these are the ones you want killed) as opposed to the normal svchosts that are loaded by services.exe. Process Explorer displays everything in a tree listing, child processes underneath parent processes and so forth. Also hovering over a process name with the mouse will tell you, if it's a service, what services each svchost.exe process is responsible for.

Also, read this, and stop bitching about your memory usage. Really, a 30MB working set size for a svchost is nothing.

EDIT: This is typical for my system. Vista Ultimate x64.

http://img375.imageshack.us/img375/6004/processexplorerfullviewnz9.png

Considering how Often this question comes up, it should be added to some sort of FAQ that is pinned to the top of the forum