Disabled Services

Question

Routing and Remote Access RemoteAccess Stopped Disabled Share Process c:\windows\system32\svchost.exe -k netsvcs Normal localSystem
Unless the user has disabled the service after the service started, are there any other possible explanations as to why the service has started if it has been disabled?
TIA, Gerry

Answer 1

Hi,
The real svchost.exe is a legitimate Windows process that performs services for other Windows programs. It's normal to have half a dozen or more of them running at once. At startup, Svchost.exe checks the services part of the registry to construct a list
of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. svchost always
runs under one of the three usernames SYSTEM, LOCAL SERVICE or NETWORK SERVICE. Running under any other username, especially yours or another user's username, is a symptom of malware.
You may capture the behavior by using Process monitor:
Process Monitor v3.05:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
How to use, please refer to this article:
Using Process Monitor to capture system events:
http://www.sophos.com/en-us/support/knowledgebase/119038.aspx
Please Note: Since the site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Hope it helps.
Regards,
Blair Deng
Blair Deng
TechNet Community Support