Why so many svchost.exe running

The last time I was checking the Task Manager in windows I was surprised to see the number of svchost.exe processes running. So, did some Google and here I came up with this. This blog try to explain the background of svchost.exe and why there are so many of them on our computer process list.

Background

First of all let me tell you that you don’t start or stop these processes nor you can kill them! As we use dictionary for English word definition, so as per Microsoft definition “svchost.exe” is a generic host process name for services which start from DLL (Dynamic Linked Libraries). Difficult to digest? Let try simple English.

Due to increase the re-usability of DLL MS (MicroSoft) started shifting all the functionality from .exe to .dll. This makes complete sense in terms of modularizing and re-usability of code. But the problem is that DLLs cannot be launched directly from Windows, you have to use .exe as container to load DLLs. That’s how svchost.exe started πŸ™‚

You might have had look at Services section in Control Panel. Windows needs lots of services to operate properly. If they would have been running under single svchost.exe for instance, failure to this may bring down all services running and Windows as well. That is the reason they are running in separated svchost.exe

What to do bout it???

We cannot stop all the services :P, but we can bring down certain services which are not needed. Just in case if you see one svchost.exe consuming more CPU or Memory then you should restart that instance. The crux of the problem is to identify which all services are running under single “svchost.exe”. For matter of fact, that is pretty simple πŸ™‚ Just start the task manager by right clicking on Windows Taskbar or pressing Cntl + Shift + Esc key together. In “Processes” tab click on “Show processes from all users”.

Windows-8-Taskbar

Windows 8 Taskbar

For command line users, you just have to use following command to view all the services hosted under one svchost.exe. The only issue with this command line output is to understand the meaning of these cryptic names.

tasklist /SVC
Command Prompt Output for Services List

Command Prompt Output for Services List

Let’s get back to our user friendly GUI Task Manager πŸ™‚ To dig further, just right click on any of the “svchost.exe” process and select “Go to Service(s)” menu item.

Services List in Windows 8

Services List in Windows 8

This will switch the tab from “Processes” to “Services” with related services are highlighted.

Service Level Operation for User

Service Level Operation for User

This will help you get the meaning full name from Description column, which can be used to identify the services which can be stopped / disabled. Once decided which services to stop / disable, you can go to Services section in Control Panel do the same.

Hope this helps πŸ™‚

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056