Uncover the mystery of the svchost.exe Process

Uncover the mystery of the svchost.exe Process

Reprinted: Netease Technology

Svchost.exe is a very important process of the nt core system and is indispensable for 2000 and xp. Many viruses and Trojans will also call it. Therefore, an in-depth understanding of this program is one of the required courses for playing computer games.

Everyone is familiar with windows, but have you noticed the "svchost.exe" file in the system? Careful friends will find that there are multiple "svchost" processes in windows (open the Task Manager by pressing "ctrl + alt + del", and you can see the "process" tab here ), why? Let's unveil its secret.

Found

In the nt kernel-based windows operating system family, different versions of windows systems have different numbers of "svchost" processes. You can use the "Task Manager" to view the number of processes. In general, win2000 has two svchost processes, and winxp has four or more svchost processes (we can see that there are multiple such processes in the system, so do not immediately determine that the system has a virus ), there are more win2003 servers. These svchost processes provide many system services, such as remote procedure call, dmserver logical disk manager, and dhcp client.

To learn how many system services each svchost process provides, enter the "tlist-s" command in the win2000 Command Prompt window. This command is provided by win2000 support tools. In winxp, run the "tasklist/svc" command.

Svchost can contain multiple services

In-depth

Windows system processes are divided into two types: independent processes and shared processes. The "svchost.exe" file exists in the "% systemroot % system32" directory and is a shared process. With the increasing number of windows system services, Microsoft has made many services shared to the svchost.exe process to save system resources. But the svchost process only acts as a service host and cannot implement any service functions. That is, it can only provide conditions for other services to be started here, but it cannot provide any services to users. How are these services implemented?

Originally, these system services were implemented in the form of Dynamic Link Libraries (dll). They direct executable programs to svchost, and svchost calls the dynamic link libraries of the corresponding services to start the service. So how does svchost know which dynamic link library should be called by a system service? This is achieved through the parameters set by the System Service in the registry. The following describes the rpcss (remote procedure call) service as an example.

From the startup parameters, we can see that the service is started by svchost.

Instance

Take windows xp as an example. Click "start"/"run" and enter "services. msc "command to bring up the service dialog box, and then open the" remote procedure call "attribute dialog box, you can see that the path of the rpcss executable file is" c: windowssystem32svchost-k rpcss ", this indicates that the rpcss Service relies on svchost to call the "rpcss" parameter, while the parameter content is stored in the system registry.

In the run dialog box, enter "regedit.exe", Press enter, open registry editor, find the [hkey_local_machine systemcurrentcontrolsetservicesrpcss] item, and find the key "magepath" of the type "reg_expand_sz ", its key value is "% systemroot % system32svchost-k rpcss" (this is the Service Startup Command seen in the service window ), in addition, the "parameters" subitem contains a key named "servicedll" with the value "% systemroot % system32rpcss. dll ", where" rpcss. dll is the dynamic link library file to be used by the rpcss. In this way, the svchost process can start the service by reading the registry information of the "rpcss" service.

Confuse

Because the svchost process starts various services, viruses and Trojans try their best to use them and try to confuse users by using their features, to infect, intrude, and damage (for example, shock wave variant virus "w32.welchia. worm "). However, in windows, it is normal to have multiple svchost processes. Which of the infected machines is a virus process? Here is only an example.

Assume that windows XP is infected with "w32.welchia. worm. The normal svchost file exists in the "c: windowssystem32" directory. Be careful if the file appears in other directories. The "w32.welchia. worm" virus exists in the "c: windowssystem32wins" directory. Therefore, you can use the Process Manager to check the execution file path of the svchost process to easily detect whether the system is infected with viruses. The Job Manager in windows cannot view the process path. You can use a third-party process management software, such as the "windows optimization master" Process Manager, using these tools, you can easily view the execution file paths of all the svchost processes. Once the execution path is found to be unusual, you should immediately detect and process it.

Due to the length of the article, all functions of svchost cannot be described in detail. This is a special process in windows. If you are interested, refer to the relevant technical materials to learn more about it.