In
software Svchost.exe is a generic host
process name for services that run from
dynamic-link libraries (DLLs) within the
Microsoft Windows operating system.
At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in
Windows XP Professional (and derivatives, such as
Windows Server 2003 and
Windows XP Media Center Edition) can run the following command at the system prompt to get a breakdown:
tasklist /svc /fi "imagename eq svchost.exe"
(NB: This command does not work in Windows XP Home.)
Due to being widespread among running processes, svchost.exe has long been a common disguise used by
malware to hide its presence from the user. (One of the common
trojan horses deceptively uses scvhost.exe). Users may then run
tasklist with no arguments and match the reported
PIDs with the previously shown Svchost instances. If memory usage appears abnormal, the user can look up the service names shown by their command on the internet to see if it is a known service or
malware.
The Svchost.exe file is located in the %SystemRoot%\System32 folder. The main
registry key involved at bootup is
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost (values in this key will show the user at least a partial list of the actual processes behind instances of svchost).
The
30 April, 2007 release of
WSUS 3.0 led to reports of svchost.exe issues, including 100% CPU usage, memory hogging, and excessive laptop fan/power usage.
[1]
[edit] See also
×