Svchost.exe
From Wikipedia, the free encyclopedia
In the Windows NT family of operating systems, Svchost.exe is the name of a process and its associated image for hosting services. These services are contained within dynamically-linked libraries (DLLs). Information about services is stored in the Services registry key (HKLM\SYSTEM\CurrentControlSet\Services). If a service key's ImagePath setting refers to svchost.exe, the service is to be hosted by this generic process. The DLL loaded by svchost.exe is referenced by the value of 'ServiceDll' in the 'Parameters' key within that service's registry key.
End users in Windows XP Professional (and derivatives, such as Windows Server 2003 and Windows XP Media Center Edition) can run the following command at the system prompt to get a breakdown:
tasklist /svc /fi "imagename eq svchost.exe"
(NB: This command does not work in Windows XP Home.)
As the Service Control Manager (services.exe) loads services following Windows startup, it loads several svchost.exe instances. Each instance hosts one or more services associated with that instance by the "-k <service_group>" parameter included in the ImagePath setting in the service's registry key. The svchost.exe process itself identifies the services it hosts by checking the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost subkeys.
Grouping multiple services into a single process conserves computing resources. However, if one of the services causes an unhandled exception, the entire process will be crashed. In addition, identifying component services can be more difficult for end users. In Windows NT 5.1 (XP) and later editions, the tasklist command with the /svc switch includes a list of component services in each process. In Windows 6.0 (Vista) and later, a "Services" tab in Windows Task Manager includes a list of services and their groups and Process IDs (PIDs). Microsoft's Sysinternals Process Explorer also provides information about services running under svchost.exe processes.
Because it is a common system process, malware often uses a process name of svchost.exe to disguise itself. Determining the image path of a process and its invoking command line can help identify software masquerading in this way. The svchost.exe file included in Windows is located in the %SystemRoot%\System32 folder.
The 30 April, 2007 release of Windows Server Update Services 3.0 led to reports of svchost.exe issues, including 100% CPU usage, memory hogging, and excessive laptop fan/power usage.[1]
[edit] See also
[edit] References
- ^ Keizer,Gregg (2007-05-12). "Microsoft Automatic Updates Fix not Working". PC World. http://www.pcworld.com/article/131770-1/article.html?tk=nl_dnxnws.
