3 ms·

> It always disguises as "C:\Windows\system32\svchost.exe" If I ever meet the manager who decided bundling half the services in the OS into svchost was a good

> It always disguises as "C:\Windows\system32\svchost.exe" If I ever meet the manager who decided bundling half the services in the OS into svchost was a good idea, I'll give him a piece of my mind. I've lost more hours to that (both cleaning malware and troubleshooting performance or crashes) than anything else on Windows since the 9x days.

SomeStupidPoint 9y ago
My work doubled down on that idea, and half of our software is packaged into the same JAR and run subsystems through CLI flags. So you just see "C:\...\app.jar" unless you dig into the flag halfway through to see it's "--widget-1" and not "--widget-2".
UnoriginalGuy 9y ago
Seems like a kneejerk reaction. The reason services are bundled into SVCHOST is that it offers reduced memory footprint and lower startup costs, which is still significant on resource constrained systems (which Windows embedded still targets)[0]. If malware didn't copycat SVCHOST they would just copycat one of a dozen other common Windows processes like conhst, dllhost, csrss, etc. As an aside, in Task Manager if you go to the details tab, select columns, command line. You'll see exactly what each instance of SVCHOST is running. Process Explorer gives you even more information than that. Process Explorer allows you to turn on Digital Signature checking. Run it as administrator. Select Columns -> Verified Signer. Options -> Verify Image Signatures. But also check your CA store to make sure no custom CA has been injected into the OS. [0] https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=42423 https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=...
- mysterydip 9y ago
  Now that there are nice tools like Process Explorer, it's less of an issue. Back in the day, you'd pull your hair out. Even so, the original premise of performance doesn't hold water to me. I load a process that has 10 services inside so I can use two of them, and that's somehow reduced memory compared to just running the two, just in case I want to run the other 8 later? Some of those services I have disabled and never want to run. It's still taking up the memory.
  - ethbro 9y ago
    Still, if MS is going to do it, then the onus seems to be on them to surface it in built-in tools.

SomeStupidPoint 9y ago

My work doubled down on that idea, and half of our software is packaged into the same JAR and run subsystems through CLI flags. So you just see "C:\...\app.jar" unless you dig into the flag halfway through to see it's "--widget-1" and not "--widget-2".

UnoriginalGuy 9y ago

Seems like a kneejerk reaction. The reason services are bundled into SVCHOST is that it offers reduced memory footprint and lower startup costs, which is still significant on resource constrained systems (which Windows embedded still targets)[0]. If malware didn't copycat SVCHOST they would just copycat one of a dozen other common Windows processes like conhst, dllhost, csrss, etc. As an aside, in Task Manager if you go to the details tab, select columns, command line. You'll see exactly what each instance of SVCHOST is running. Process Explorer gives you even more information than that. Process Explorer allows you to turn on Digital Signature checking. Run it as administrator. Select Columns -> Verified Signer. Options -> Verify Image Signatures. But also check your CA store to make sure no custom CA has been injected into the OS. [0] https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=42423 https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=...

mysterydip 9y ago
Now that there are nice tools like Process Explorer, it's less of an issue. Back in the day, you'd pull your hair out. Even so, the original premise of performance doesn't hold water to me. I load a process that has 10 services inside so I can use two of them, and that's somehow reduced memory compared to just running the two, just in case I want to run the other 8 later? Some of those services I have disabled and never want to run. It's still taking up the memory.
- ethbro 9y ago
  Still, if MS is going to do it, then the onus seems to be on them to surface it in built-in tools.