如果在系统上打开任务管理器或进程资源管理器，您将看到许多服务正在运行。但是一个服务对你的系统有多大的影响，特别是当它被恶意软件“破坏”的时候？今天的超级用户问答帖子回答了一位好奇的读者的问题。

今天的问答环节是由SuperUser提供的，SuperUser是Stack Exchange的一个分支，是一个由社区驱动的问答网站分组。

问题

超级用户读者Forivin想知道一个服务对Windows系统的影响有多大，特别是当它被恶意软件“破坏”时：

What kind malware/spyware could someone put into a service that does not have its own process on Windows? I mean services that use svchost.exe for example, like this:

Could a service spy on my keyboard input? Take screenshots? Send and/or receive data over the internet? Infect other processes or files? Delete files? Kill processes?

服务对Windows安装的影响有多大？恶意软件“被破坏”的服务有什么限制吗？

答案

超级用户贡献者Keltari为我们提供了答案：

What is a service?

A service is an application, no more, no less. The advantage is that a service can run without a user session. This allows things like databases, backups, the ability to login, etc. to run when needed and without a user logged in.

What is svchost?

• According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in English please?
• Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective, this makes more sense for reusability…but the problem is that you can not launch a .dll file directly from Windows, it has to be loaded up from a running executable (exe). Thus the svchost.exe process was born.

So, essentially a service which uses svchost is just calling a .dll and can do pretty much anything with the right credentials and/or permissi***.

If I remember correctly, there are viruses and other malware that do hide behind the svchost process, or name the executable svchost.exe to avoid detection.

有什么要补充的解释吗？在评论中发出声音。想从其他精通技术的Stack Exchange用户那里了解更多答案吗？在这里查看完整的讨论主题。