主题：各位老大，给说说任务管理器中，各进程的作用 -- 大明湖

最近laptop受病毒所困，系统占用率极高，总是出现一些名字古怪的进程，而且强行结束后，竟然反复启动。愁啊！

尤其是一个名为svchost.exe的进程，内存使用率逐步增加，当达到一定值时，就会报错，说什么

Generic Host Process for Win32 Services has encountered a problem and needs to close. error report includes following file:

C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\WER12.tmp.dir00\svchost.exe.mdmp

各位大虾请教了！多谢！

下面这段是微软的解释。你有问题再问好了。

用你的错误信息到google查一下，应该有些解决办法的。

[SIZE=3][B]A description of Svchost.exe in Windows XP[/B][/SIZE]

[B]SUMMARY[/B]
This article describes Svchost.exe and its functions. Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs). 

[B]MORE INFORMATION[/B]

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. 

Svchost.exe groups are identified in the following registry key: 
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost

Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group. Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value: 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service

To view the list of services that are running in Svchost: 
Click Start on the Windows taskbar, and then click Run.
In the Open box, type CMD, and then press ENTER.
Type Tasklist /SVC, and then press ENTER.
Tasklist displays a list of active processes. The /SVC switch shows the list of active services in each process. For more information about a process, type the following command, and then press ENTER: 
Tasklist /FI "PID eq processID" (with the quotation marks) 

Good luck, man!

".Generic Host Process for win32 services has encountered a problem and needs to close". the signature code is

szAppName: szAppVer: 0.0.0.0 szModName: unknown

SzModVer: 0.0.0.0 Ofset: 00000000

郁闷啊

病毒我查了，补丁我打了。还是网络受攻击！请各位推荐好的防火墙！谢谢！

这时Service Pack 2中的模样。