digg

Facebook Connect Join Digg About

Unlocking the Mysteries of 'Svchost.exe'

langa.com — Svchost.exe can, and usually does, run several instances of itself at any given time, each instance running several associated services. How do you find out what these "services" are?

Who dugg this? Made popular Oct 7, 2006

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

40 Comments

show profanity settings
expand all
  • latova, on 10/12/2007, -6/+57Yar. I say yee svchost holds would be treasure!
  • ziki, on 10/12/2007, -1/+33+digg for reference to process explorer
  • surian, on 10/12/2007, -2/+27talking like a pirate is never over... er... yarrr matey!
  • culbeda, on 10/12/2007, -3/+211) The article doesn't even explain what SVCHOST is. It is a "host service" that wraps around another service. It's a way to share the common parts of the code (error logging, graceful startup/shutdown, etc.) without having to rewrite it (and consequently update/patch it) for each individual service. Since many services rely on it, you see it multiple times in task manager.

    2) How bad are your proof-reading skills when you have a typo in the *2nd* word of the article.

    3) Using Sysinternal Process Explorer is free (eventually Defender will NOT be), and it won't interfere with the operation of your PC.

    4) If this isn't blogspam, the submitter needs to google around before submitting crap like this. There are a number of superior articles out there on SVCHOST.
  • digga, on 10/12/2007, -0/+15It's a great way to hide stuff from the user. I'd rather see a lot more "real" processes than a handful of generic black boxes.
  • inactive, on 10/12/2007, -2/+13Errrm, when you google SVCHOST or ... gee... anything ... it's articles like this that you find? Without these, Google would be useless.
  • Jugalator, on 10/12/2007, -0/+11"Using Sysinternal Process Explorer is free (eventually Defender will NOT be)"

    And even worse as for this article, you can find out which services are running for which svchost without even using external tools by using tasklist /svc on XP.
  • lustre, on 10/12/2007, -1/+10Agreed. An excellent replacement for task manager. Coupled with autoruns, the two are a formidable tool.
  • EricPeters, on 10/12/2007, -2/+9Maybe he's a beta tester. Like I am.
  • VeganG, on 10/12/2007, -2/+8Would some googled article have more merit than this one?
  • Kickboy, on 10/12/2007, -2/+8Or you can just go to Start > Run and type in 'services.msc'.
  • Jugalator, on 10/12/2007, -1/+6... and the "power user" way:

    From a Windows XP Professional English (or later) command-prompt, type:

    tasklist /svc /fi "imagename eq svchost.exe"

    If not using the English XP, replace "imagename" above with the first column name of the output you get from the "tasklist" command on its own.

    The listed PID's will obviously match the PID's from the respective svchost.exe processes in the Task Manager.
  • greatcaffeine, on 10/12/2007, -1/+6The only mysterious thing about it is why it displays an error or two before my Windows machine shuts down.
  • po43292, on 10/12/2007, -0/+4svch0st is a virus/spyware, notice the zero. Sounds weird but I really read that somewhere a while back when I got somebody's idea of a joke on my system.
  • Hitchhiker90, on 10/12/2007, -1/+5Holy crap, a useful comment! You can't be posting stuff like that here.
  • TheKillDoctor, on 10/12/2007, -0/+1Sysinternal Process Explorer is the only way to go (recently bought my microsoft too).

    Also Fred Langa (the blog idoit) has got to be the worst PC writer on the planet. He does nothing but scrape other people's ideas off the net and post them as his own.
  • glafira, on 10/12/2007, -0/+2Thanks to the digger this has been a mystery to me for ages.
  • willowy, on 10/12/2007, -0/+2I've never seen that program before, but I totally appreciate the link -- those mystery processes are something I've always wondered about!
  • DreadPirateWes, on 10/12/2007, -1/+2No he's talking about the command tasklist not the Task Manager. You might have to install some of the extra tools from the XP disk...not sure if they're on the Home.
  • orenlevy1, on 10/12/2007, -0/+1Very nice one, great info
  • striker1211, on 10/12/2007, -0/+1Umm... it doesnt explain anything really. He doesnt even mention tasklist doesnt exist on xp home, nor the snap-in.... bah. I want to know WHY it requires multiple processes when they are running with the same user permissions. Why not have them all on one exe? How does it know it needs to spawn a new svchost? They are started by "something" like svchost.exe -k servicename, yet they dont spawn different processes... does the current instance of svchost check if it has any more resources to give out and if not it spawns a new one? anyone know?
  • khag7, on 10/12/2007, -0/+1@ScottM

    I guess you have a few bugs now too. maybe foley will beta test you
  • dylanbright, on 10/12/2007, -1/+1Process Explorer is cool, but you can see what's running in your svchost instances with tasklist /svc without downloading anything. I think any article on what svchost is should mention that.
  • londonjack, on 10/12/2007, -0/+0I always wondered what that file was
  • robohead, on 10/12/2007, -0/+0Thanks for the digg! I always thought there were some sketchy things hiding behind svchost, but I never tried to figure out how to detect these damn things.
  • cradlerockstyle, on 10/12/2007, -0/+0i have 1Gb of ram in my brand new P4 3.2Ghz machine and i have an "svchost.exe" process running typically consuming about 30-45MB of memory. is this a typical amount?
    i have run a couple of different spyware scans and virus scans and they aren't pulling anything up.
    any ideas?
  • alwaysmc2, on 10/12/2007, -3/+3And if you run Vista you can just go to the task manager (CRL+Shift+ESC is the fastest way) and click on the "services" tab.

    (but Vista also has Windows Defender built in, so you can use that also I guess.)
  • TheTrueAPlus, on 10/12/2007, -1/+1Where do you get tasklist for xp home?
  • tvaughn05, on 10/12/2007, -2/+1Um, Ctrl-Alt-Del.
  • starquake, on 10/12/2007, -5/+4Everyone can be a beta tester now...
  • inactive, on 10/12/2007, -6/+4I beta tested your mother




    She had a few bugs
  • MioTheGreat, on 10/12/2007, -8/+2Eh. What's mysterious about it? It's a process that houses services so you have less overall processes. Manage it with services.msc, or the 'Services' tab in Vista's task manager.
  • VaporBro, on 10/26/2007, -11/+5Thank you DIGG! Something I already knew about yaaay! Time for WEED. Anytime is the right time for WEED. WEED and DIGG each have 4 letters. You know what THAT means? IT'S WEED TIME! WEEEEEEEEED TIMMMMMME!
  • jopsen, on 10/12/2007, -13/+3does run under wine ???
  • theratdotus, on 10/12/2007, -18/+2vista? are yee a pirate?
  • JesusFaction, on 10/12/2007, -23/+3"Svchost.exe shoes up when you view the Process tab in Windows XP's Task Manager"
  • mrWoot, on 10/12/2007, -25/+2Alright, with all that said, what have this given us? Information? Why not just google svchost and learn from there.
  • Equistatic, on 10/12/2007, -45/+9Wow, Really? A your momma joke?
  • inactive, on 10/12/2007, -51/+7So has ya mum ;)
  • ihate2regist, on 10/12/2007, -56/+8talk like a pirate day has come and gone

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...

© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.