Windows 10: Svchost in syswow64, windows 32

I know it is supposed to be in windows 32 but is it suppose to be syswow64? Because I've read that it shouldn't be. So i did a factory reset and it is still there scand with bitdefender and Malwarebytes no virus found. Any information will be helpful. And why won't Microsoft confirm this themselves if they haven't already.

:)

 

Malware using SysWOW64/svchost

I've done a lot of research, but haven't yet found a current solution to this.

I have Norton 360 protection, and when I block the svchost from running, all malware symptoms stop, yet blocking that creates new problems.

-The main symptom is an unnamed file running in Task Manager taking up 50-60% cpu, and clicking "open file location" takes you to SysWOW64/svchost.

-When on google chrome, a bunch of websites try to pop up or connect, but Norton blocks all of them. The most frequent one called "Bitcoin Miner6"

-About 20 "proxychecker"s were in the TM, which I blocked with Norton without bad side-effects.

-Blue Screen of deaths were often early on, about 15 mins and every time I tried restarting my computer.

All these were stopped by Norton, though the main file can be still found in TM, but it uses hardly any cpu. It seems to need internet connection to work (when I don't have Norton block it), and is run by SysWOW64 about 30sec after startup, possibly as a
dll.

Anyway Norton can't find it no matter what, and running my computer without svchost is annoying.

 

What does the svchost do?

Lots of Windows services are tied to the SVChost, and /or are listed as SVChost in the process list(s).

Unfortunatley with Vista, there's a lot more dependencies between the services, and thus you'll be FORCED to run more instances of SVChosts; unlike XP where things were more independent and you could disable more features resulting in less SVChost instances. That and XP and Vista are different.

Regardless of your Windows version, you can check out some service slimming guides or goto Black Viper's website and take his advice. Depending on your needs you may be able to cut down the amount of SVChost running, and save some RAM.

XP should never have an SVChost using 50mb. Vista however can.

 

Analyzing Svchost processes in Windows

Here's how to track down detailed information about any Svchost.exe process running in Windows 7/8.

a) You can use the Tasklist command-line tool to learn which services are running in a Svchost.exe. Just run cmd (command prompt) and hit

Tasklist /svc /fo list

Scroll through the list and find what you need. It's not quite intuitive so you can use third party programs with gui. See below:

b) You can use svchost viewer. Best utility. Note: to run this under XP you need .Net framework 2.0





c) Svchost Process Analyzer is another app for that.





d) And another app called Svchost lookup tool





e) And it won't hurt if you use Process Explorer and System Explorer.


It's never bad to keep your system under control, plus all these apps are portable no installation is required.

kthbai