generic host process

[steve07951]

Hi Ann
just a quicky lol
what is generic host process for win 32 services
cheers steve

[Annabell]

Hi Steve, LoL quicky Oooo


Svchost.exe

Windows 2000 introduced the generic service host process, Svchost.exe. The goal was to reduce system resources by consolidating the various processes hosting built-in operating system services into a single process. Or, it could permit the system administrator to configure the system to run certain services in their own processes, which would prevent one service from corrupting the private memory of other unrelated services. If you look at the Windows XP process list in Task Manager , you will notice at least four Svchost.exe processes: two running under the SYSTEM account (sometimes referred to as LocalSystem) and two running under two new service accounts: NETWORK SERVICE and LOCAL SERVICE.

One of the two Svchost processes running under SYSTEM hosts the bulk of the services, 29 of them in total. The second one hosts a single service, Remote Procedure Call (RPCSS). The reason this service needs to be in a separate process is that user-written DLLs are loaded into this process. By having RPC running in its own process, these DLLs cannot adversely affect the operation of the other built-in operating system services. The Svchost process running under NETWORK SERVICE hosts a single service, the DNS Client. The Svchost process running LOCAL SERVICE hosts the TCP/IP NetBIOS Helper, Remote Registry, Simple Service Discovery Protocol, and Web Client services.
The reason for the two new service accounts is to improve system security by reducing the privileges that services run with. LOCAL SERVICE is a built in account that doesn't need a password to log on. The account has only a few privileges, and is not a member of the local administrators group. So, if a service that is running under this account is compromised, it cannot take down the whole machine. LOCAL SERVICE also has no network credentials, so attempts to access a machine on the network will connect with the null session. The NETWORK SERVICE account has the same set of privileges as LOCAL SERVICE, but has access to the machine's credentials for outbound connections, similar to the SYSTEM account.

Its part of xp and 2000 o/s it could be a ligitamate application trying to acess the web could also be a Trojan, so have a good scan before you allow anything, i can recommend a good Trojan Scanner / Remover if you need one.

Ann

[steve07951]

Hi Ann i use NOD32 what do you think of it ?
Thanks for the quicky
cheers steve

[badboy]

Hi Ann,

got a LAN consisting of approx 100 HP thin client terminals running off a citrix farm. had a look at the DNS that other day and some clients have the same IP address?

I cleared out the DNS, looked good for a few days.

but................... its has started to duplicate IP addresses again?

since your the wizkid can you help or advice.

thanks

[lincsat]

Do you have a configuration problem with your DHCP server?

[Annabell]

Hi Steve, Good protection Nod 32 one of the best

@ Badboy - Reconfigure your router so that the DHCP server is not using the default IP address, say your IP is "eg" 192.168.0.1. Change the 0 to something else (not 1, that is another default) say 3. So change the LAN address of your router from default and if you connect with a Cat5 cable, then you should start seeing packets being received.

Ann

[badboy]

well the network is working fine, but jus that DNS is showing duplicate ip addresses. DHCP seems fine its giving out the correct leases. we dont have a router in place, all the servers are connected to a gigabit switch. we have 2 subnets, 192.168.80.0 is for our VoIP telephone system and 192.168.75.0 for our network. the other problem is, we are currently using roaming profiles, but it takes ages for a user to log in?

thanks

[Annabell]

Mmm roaming profiles, without a router I'm not sure, you need to talk to a member that is more familiar with your setup, sorry hun its no good me telling you something that i would do with a router when your not using one, So can any members reading this please give Badboy some advice

[badboy]

Hi anna

Trying to run some web reporting software called "surfcontrol"

when i type in the username and password it logs in, but reports the following error, and i am therefore unable to get the reports...

There was an error validating the database.
The database authentication settings, username or password are incorrect.

Wierd coz it dose let me log in with the username and password.

any ideas?

[Annabell]

Hi Badboy

Sounds like your only part logged in, this is mostly down to corruption of the software i suggest complete uninstall and manually remove all registry entries then reinstall in safe mode, hope this helps