Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What kind malware/spyware could someone put into a service that doesn't have it's own process on windows? I mean services that use svchost.exe for example, like this:
enter image description here

Could a service spy on my keyboard input? Take screenshots? Send/receive data over the internet? Infect other processes or files? Delete files? Kill processes?

share|improve this question
5  
Anything its programmed to do. A service could do all the things you mention if its programmed to do so. –  Ramhound May 20 '14 at 22:23

2 Answers 2

up vote 18 down vote accepted

What is a service?

A service is an application, no more, no less. The advantage is that a service can run without a user session. This allows things like databases, backups, the ability to login, etc to run when needed and without a user logged in.

What is svchost?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

So, essentially a service which uses svchost is just calling a .dll and can do pretty much anything with the right credentials and/or permissions.

If I remember correctly, there are viruses and other malware that do hide behind the svchost process, or name the executable svchost.exe to avoid detection.

share|improve this answer
1  
To take it one step further, if you use Process Explorer and you hover over the svchost instance it will tell you what services it is hosting. –  Scott Chamberlain May 21 '14 at 5:07
    
@ScottChamberlain You can also just right click and Go to Service(s) in the built-in task manager on any recent version of Windows (Vista+). –  Bob May 21 '14 at 12:22
1  
The Windows 8 Taskmanager makes it even easier: 250kb.de/u/140522/p/ZFP0uJMz2yVJ.png –  Forivin May 22 '14 at 18:28
    
@Forivin I'm curious how you managed to get a PNG to load in an upwards direction. And how you managed to get that to 1.5 MB - a PNG of mostly flat colours like that should be a couple hundred kB, max. –  Bob Jun 15 '14 at 9:29
    
@Bob You're actually not the first one to ask me that. :p I'm too lazy to find out why, but I created this screenshot by using AltGr+Print (loads a bitmap screenshot of the current window in the clipboard) and then pasted into an empty png file using Paint, so it's likely that it still is a bitmap (with a wrong extension). That would explain the size and maybe also the upwards loading. ;) –  Forivin Jun 18 '14 at 12:45

One of the easiest ways to determine what processes are running under svchost is to use:

Tweaking.com - svchost.exe Lookup Tool V1.5.0

http://www.tweaking.com/content/page/tweaking_com_svchost_exe_lookup_tool.html

Works well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.