svchost.exe有啥用。。。。

zy52133

最近我一机器在上网期间常出现svchost.exe由于出错而被关闭的错误关闭后不能用剪粘板，在要下载一些东东时没法拷贝一些网址很不方便请问svchost这个文件是什么东东有什么用哟为什么会出现这种现象呢是不是中招了哟。。。。。\r\n但用最新病毒杳无呀。。。。。\r\n\r\n在线等待中。。。。。

huak

Svchost.exe COM+ Event System (EventSystem)\r\n\r\nSUMMARY\r\nSvchost.exe is a generic host process name for services that are run from dynamic-link libraries (DLLs). The Svchost.exe file is located in the %SystemRoot%\\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.\r\n\r\nSvchost.exe groups are identified in the following registry key: \r\nHKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost\r\n\r\nEach value under this key represents a separate Svchost group and is displayed as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service_names extracted from the following registry key, whose Parameters key contains a ServiceDLL value: \r\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Service\r\n\r\nMORE INFORMATION\r\nTo view the list of services that are running in Svchost: \r\nFrom the Windows 2000 installation CD\'s Support\\Tools folder, Extract the Tlist.exe utility from the Support.cab file.\r\nOn the Start menu, click Run, and then type cmd.\r\nChange folder to the location from which you extracted the Tlist.exe utility.\r\nType tlist -s.\r\nTlist.exe displays a list of active processes. The -s switch shows the list of active services in each process. For more information about the process, type tlist pid.\r\n\r\nThe following sample Tlist output shows two instances of Svchost.exe running: \r\n0 System Process \r\n8 System \r\n132 smss.exe \r\n160 csrss.exe Title: \r\n180 winlogon.exe Title: NetDDE Agent \r\n208 services.exe Svcs: AppMgmt,Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,LanmanWorkstation,LmHosts,Messenger,PlugPlay,ProtectedStorage,seclogon,TrkWks,W32Time,Wmi\r\n220 lsass.exe Svcs: Netlogon,PolicyAgent,SamSs \r\n404 svchost.exe Svcs: RpcSs \r\n452 spoolsv.exe Svcs: Spooler \r\n544 cisvc.exe Svcs: cisvc \r\n556 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv \r\n580 regsvc.exe Svcs: RemoteRegistry \r\n596 mstask.exe Svcs: Schedule \r\n660 snmp.exe Svcs: SNMP \r\n728 winmgmt.exe Svcs: WinMgmt \r\n852 cidaemon.exe Title: OleMainThreadWndName \r\n812 explorer.exe Title: Program Manager \r\n1032 OSA.EXE Title: Reminder \r\n1300 cmd.exe Title: D:\\WINNT5\\System32\\cmd.exe - tlist -s \r\n1080 MAPISP32.EXE Title: WMS Idle \r\n1264 rundll32.exe Title: \r\n1000 mmc.exe Title: Device Manager \r\n1144 tlist.exe \r\n\r\nThe registry setting for the two groupings for this example are as follows: \r\nHKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost:\r\nnetsvcs: Reg_Multi_SZ: EventSystem Ias Iprip Irmon Netman Nwsapagent Rasauto Rasman Remoteaccess SENS Sharedaccess Tapisrv Ntmssvc\r\nrpcss :Reg_Multi_SZ: RpcSs

zy52133

后来查到了这相当于一个中转程序开机时系统读取注册表并加载一部分程序另载时就要用到这个程序来中转所以有可能在进程中就有几个svchost在运行呵这个是正常的呵我还以为是病毒呢。。。

一步一个脚印

有一蠕虫病毒在system32\\wins\\下面生成两个文件并更名为svchost.exe 、dllhost.exe

田博路

Svchost.exe文件对那些从动态连接库中运行的服务来说是一个普通的主机进程名。 \r\nSvhost.exe文件定位在系统的%systemroot%\\system32文件夹下。在启动的时候,Svchost.exe \r\n检查注册表中的位置来构建需要加载的服务列表。这就会使多个Svchost.exe在同一时间运行每个Svchost.exe\r\n的回话期间都包含一组服务，以至于单独的服务必须依靠Svchost.exe怎样和在那里启动。这样就更加容易控制\r\n和查找错误。Svchost.exe 组是用下面的注册表值来识别。 \r\nHKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Svchost \r\n每个在这个键下的值代表一个独立的Svchost组，并且当你正在看活动的进程时，它显示作为一个单独的例子。\r\n每个键值都是REG_MULTI_SZ类型的值而且包括运行在Svchost组内的服务。\r\n每个Svchost组都包含一个或多个从注册表值中选取的服务名，这个服务的参数值包含了一个ServiceDLL值。 \r\nHKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Service

liruitu

你后来是怎么处理的？我也遇到这样的问题了

liuhsh

svchost.exe\r\n用于启动时构建需要加载的服务列表，每个svchost.exe回话期间都包含一组服务的相关信息，因此多个svchost.exe会在同一时间运行