# svchost.exe infected?

**URL:** <https://boards.straightdope.com/t/svchost-exe-infected/225007>\
**Category:** Factual Questions\
**Created:** [January 17, 2004, 10:35pm UTC](https://boards.straightdope.com/t/svchost-exe-infected/225007 "2004-01-17T22:35:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bhb](https://avatars.discourse-cdn.com/v4/letter/b/7ab992/32.png) [@bhb](https://boards.straightdope.com/u/bhb)\
**Post date:** [January 17, 2004, 10:35pm UTC](https://boards.straightdope.com/t/svchost-exe-infected/225007/1 "2004-01-17T22:35:05Z")

</div>

I have 4 svchost.exe processes listed under task manager. I heard that the blaster virus or something similar exploits svchost.exe. How do I get rid of it, and stop this program from running multiple times. Also, regsvc never used to run until I installed a program (i uninstalled the program and now regsvc won’t stop running on startup i can’t end task it either) What’s the deal?

---

<div class="post-metadata">

**Author:** ![Doomtrain](https://avatars.discourse-cdn.com/v4/letter/d/0ea827/32.png) [@Doomtrain](https://boards.straightdope.com/u/Doomtrain)\
**Post date:** [January 17, 2004, 11:16pm UTC](https://boards.straightdope.com/t/svchost-exe-infected/225007/2 "2004-01-17T23:16:17Z")

</div>

If you’re on Windows XP, it’s pretty normal to have 3 or 4 running. If you’re worried, run a virus check, it’ll catch Blaster virusorsomethings.

---

<div class="post-metadata">

**Author:** ![Polycarp](https://avatars.discourse-cdn.com/v4/letter/p/82dd89/32.png) [@Polycarp](https://boards.straightdope.com/u/Polycarp)\
**Post date:** [January 17, 2004, 11:51pm UTC](https://boards.straightdope.com/t/svchost-exe-infected/225007/3 "2004-01-17T23:51:22Z")

</div>

There’s a patch available on the Microsoft website that closes SVCHOST.EXE to the exploiting viruses. (There were threads about this, including one that was made sticky here in GQ, a while ago.)

---

<div class="post-metadata">

**Author:** ![GorillaMan](https://avatars.discourse-cdn.com/v4/letter/g/50afbb/32.png) [@GorillaMan](https://boards.straightdope.com/u/GorillaMan)\
**Post date:** [January 18, 2004, 12:12am UTC](https://boards.straightdope.com/t/svchost-exe-infected/225007/4 "2004-01-18T00:12:40Z")

</div>

In Task Manager, there will be several processes listed as “svchost.exe”. Anything not identical to this, such as “Svchost.exe” or “SvcHost.exe” is likely to be a virus.

Unfortunately, many virus alerts don’t make the distinction - they may validly catch an svc-clone, but the way they inform you of it suggests that svchost.exe is inherently bad.