How To Identify What Programs Started svchost.exe in Windows

27

winlogo.jpgI've been on a mission to decrease windows startup time and increase performance of my new Vista Computer. I have cut down on the number of services that need to be started and have been making some pretty good progress. I often check task manager to see how many process are running, and constantly see several svchost.exe processes.

How can I find out what is starting this process?

I can understand your confusion with svchost.exe. It seems like it's a "mystery" process that continues to multiply the longer Windows is running. But there is good reason why this process exists.

Some Components of Windows, that are implemented as Services, are known as Programs (executable) and run the background. These Programs are known as stand alone programs.

Another type of program exist, known as DLL's, which are a library of functions, that can not be implemented as a Service and run in the background on it's own. Because of this, a program named svchost.exe exist to run programs, implemented as DLL's, as a service.

Still confused? Let's take a visual look and see what programs (DLL's) are running that have been started by svchost.exe.

Open a command prompt and enter:

tasklist /svc /FI "IMAGENAME eq svchost.exe"

The above command will list all the svchost.exe processes and display the programs (DLL's) that have been started by svchost.exe.

Below is the output from my Computer (I have formatted so it can be viewed easily):

C:\Users\wtn>tasklist /svc /FI "IMAGENAME eq svchost.ex"e

Image Name       PID               Services                                   
===========  ====            ========
svchost.exe        768             DcomLaunch, PlugPlay


svchost.exe        828             RcSs


svchost.exe        856             WinDefend


svchost.exe        1012           Audiosrv, Dhcp, Eventlog, lmhosts, wscsvc


svchost.exe        1036           AudioEndpointBuilder, Netman, PcaSvc,      
SysMain, TrkWks, UxSms, WdiSystemHost,     
Wlansvc, WPDBusEnum, wudfsvc


svchost.exe        1048           AeLookupSvc, BITS, EapHost, gpsvc,         
LanmanServer, MMCSS, ProfSvc, RasMan,      
Schedule, seclogon, SENS, ShellHWDetection,
Themes, Winmgmt, wuauserv


svchost.exe        1224           EventSystem, fdPHost, FDResPub,            
LanmanWorkstation, netprofm, nsi, SSDPSRV, 
upnphost, W32Time, wcncsvc, WebClient


svchost.exe        1404           CryptSvc, Dnscache, KtmRm, NlaSvc, TapiSrv


svchost.exe        1608           BFE, DPS


svchost.exe        2000           stisvc


svchost.exe        340            WerSvc

Notice, I have ten instances of svchost.exe running with some of them responsible for starting multiple programs. You can clearly see what the programs are, such as Dnscache, Schedule, and. Windefend.

It's unknown as to exactly how and why svchost.exe runs in this fashion, but it may be for performance and troubleshooting (debugging) reasons.

Since the outout also displays the PID (Process Identification), you can then look at task Manager and see how much CPU and Memory each svchost process is consuming.

If you are not a fan of the command prompt, you can use the tool Process Explorer for identifing processes started by svchost.exe.

With Process Explorer, just mouse over the process and it will display all the services running inside svchost,exe. To get more information such as, CPU, memory, etc, right click on the process and select Properties.

svchost1.png


To get more information such as, CPU, memory, etc, right click on the process and select Properties.

As you can see svchost.exe is one process you do not want to kill or prevent from starting.

Comments on How To Identify What Programs Started svchost.exe in Windows Leave a Comment

October 8, 2007

Michael @ 9:57 pm #

Thanks for the info mate, I have a quite a few svchost.exe instances running, but now I know it's alright.

January 16, 2008

Denis @ 11:52 pm #

I think you have failed your mission, you have Vista LOL, sorry, thats low

February 14, 2008

Akinwale ebenezer @ 10:49 am #

hello,
Please i have been having the svchost/exe error on my system and it is giving me so much cause for worry, please can u send me the the detail infomation on how i can solve the problem. Thank you as i anticipation your reply. Bye.

May 9, 2008

Doyle @ 4:45 am #

I ran this also I use windows XP SP2, and says not recognized. I copy and pasted and am savvy as well.

May 13, 2008

Verlin @ 12:53 pm #

Thanks! Ran it here as quoted and worked well.

September 1, 2008

Gus from California @ 5:56 pm #

Something is calling SVChost which in turn tries to access the internet. This could be a trojan or something else undesirable, so I want to know what program is calling the SVChost. May be earthlink, who only does my Email these days, but they do weird things to verify if you are "On". Real Player trys to run a constant message board, that I hope I got shut off.

I tried the command line approach above, and it runs. In a flash. Then closes. No time to read what it says. Why doesn't that pane persist?

Is there a better, or alternative way to figure out who is constantly trying to access the internet on my computer? It is asking for server privilege, which I have nearly eliminated by the ZoneAlarm "ask" option, so not much happens, other than it is driving me nuts answering the "ask" panel. I would just flat blacklist, except that there are many valuable uses.

September 24, 2008

greg @ 8:33 pm #

thank you for the command line commands.

greg @ 8:34 pm #

Is it possible for a malware program to use svchost.exe?

September 25, 2008
February 23, 2009

mariposa @ 10:48 am #

i have process explorer. and i know i have a yucky trojan/malware problem i have been trying to get rid of unsuccessfully so far. and i have concluded through various malwarebytes anti malware scans and sd fixes etc etc that the file or shellpaths of the 2 rundll32 processes listed are in fact this trojan. ive always been unsure about the svchost.exe processes… but when i looked at the 'properties' of the process, i noticed it named the "parent" of this rundll32 (run a dll as an app) process, which was svchost.exe and in parentheses (916)
and there is a svchost process (916) in my list. i want to kill the process but i want to make sure its not an important process that also handles things my computer cannot function without, despite its infection.
can you tell me if its ok or not to just kill that svc host process its parented by?
im super tired, i hope all that made sense :)

also, what happens when you "suspend" a process>?

THANKS!!

March 20, 2009

Justin O. @ 8:59 am #

I'm running WinXP SP2 Home. When I enter "tasklist….." in a command window, it says " 'tasklist' is not recognized as an internal or external command, operable program or batch file."

March 25, 2009

Arshan @ 11:12 am #

If you are comfortable working with the Registry, you can get a good understanding of the description & functions of Svchost.exe at http://support.microsoft.com/kb/314056

May 26, 2009

Frank @ 4:30 pm #

Sometimes the red light is on constantly on my PC.
Sometimes when I leave the comp' the red light is on constanly.
If I move the mouse or press a key the red light slows and then flashes slowly.
Recently I managed to open task manager and could see that svchost.exe and wuauclt were busy in processes.
The OS is supposed to be W XP Home, sometimes it is W XP Professional, it depends what I happen to look at regarding info' it has on it.
I was able to put the tasklist etc into command prompt and it gave a list of the svchost.exe.
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\home>tasklist /svc /FI "IMAGENAME eq svchost.exe"

Image Name PID Services
========================= ====== =============================================
svchost.exe 700 DcomLaunch, TermService
svchost.exe 780 RpcSs
svchost.exe 848 AudioSrv, BITS, CryptSvc, Dhcp, dmserver,
EventSystem, FastUserSwitchingCompatibility,
helpsvc, HidServ, lanmanserver,
lanmanworkstation, Netman, Nla, RasMan,
Schedule, seclogon, SENS, SharedAccess,
ShellHWDetection, srservice, TapiSrv,
Themes, TrkWks, W32Time, winmgmt, wscsvc,
wuauserv, WZCSVC
svchost.exe 1116 Dnscache
svchost.exe 1268 LmHosts, SSDPSRV
svchost.exe 1844 WebClient
svchost.exe 2328 stisvc

I was able to select-copy-paste the result as you see it above from the command prompt.
Qs: Why are the numbers different?
Does anyone recognise any malware in amongst the list?

April 8, 2010

Pharme140 @ 6:35 am #

Hello! abgcefa interesting abgcefa site!

July 9, 2010

Bill Gates Needs to Get Cancer @ 6:12 pm #

I have had it with MS and the malware they call an OS. Switching to Ubuntu and getting Windblows off of my perfectly good Sony Vaio.

Die a horrible death Balmer and Gates.

August 18, 2010

Juicey @ 5:17 pm #

@Watching The Net:

I have Windows XP Professional SP3 and yet I get the same error as Justin O when I try to use the tasklist command in command prompt. Will look at Process Explorer.

Several times I've killed a sprialing svchost.exe process which was eating up memory which has usually resulted in my sound device subseqently not being recognised by my pc until I reboot. I notice wmprise.exe regularly runs. Have AVG and FIREFOX which I'm aware seem to have conflicts.

September 6, 2010

Bagby @ 10:32 am #

Just wanted to point out that the article *is* a failure.

The title is, "how to identify what programs started svchost", and in that, you have failed completely. The most relevant thing that you have to say is,

"It's unknown as to exactly how and why svchost.exe runs in this fashion,…"

I feel deceived and mislead. This does not tell me how to identify what started it, and so brings me no nearer to the solution to my problem.
I'm off to try to find something that actually answers the question that was asked. I'd appreciate it if you changed the title so that future searchers won't be mislead into coming here thinking there are any answers to that question.

December 9, 2010

Aaron Hopkins @ 8:17 pm #

@Bagby>
What a turd burglar you are! your post proves you can read, but doesnt prove you can listen.

If "How To Identify What Programs Started svchost.exe in Windows" and
svchost.exe (768) DcomLaunch, PlugPlay, isnt clear enough for you; Then i suggest you buy a mac.

December 10, 2010

Frank @ 3:59 am #

@mariposa:
Try: Malwarebytes, Spybot, rkll, Avira. Read up as much as you can prior to use. They aren't too difficult to use. Also: C Cleaner, Advanced System Care, Iobit.
Whilst one antimalware may find some malware another may find other malware.
It is better if you can have two computers having the info on one whilst doing the job on the other. If you don't have two computers then print the instructions.
It can sometimes take a couple of tries with the above before things are cleared up. It can take a long time as one antimalware is used at a time.
Do the scans overnight, it can take 3 to 4 hours to scan my computer.
There is also chkdsk (checkdisk) which is in XP, part of MS Windows.

There is info' regarding the different types of malware and what they sometimes look like.

February 27, 2011

Damian @ 11:41 am #

Sorry mate,
but I can understand Bagby's frustration.

identifying is something different then ending up with
a variation of names (processes). that's what I came for
and I am left with this:

AudioSrv, BITS, Browser, CryptSuc, Dhcp,
dmseruer, EuentSystem,
FastUserSwitchingCompatibility, HidServ,
lanmanserver, lanmanworkstation, Netman,
Nla, seclogon, SENS, SharedAccess,
ShellHWDetection, Themes, TrkWks, W32Time,
winmgmt, wscsuc, WZCSUC

one of them recreates the System Volume Information (SVI)
although it was deleted before. System restore is off and no virus
for sure. Unlocker has to kill svchost.exe first before it can delete SVI.
after killing svchost the processes above dissappear from the list.
works sometimes until reboot , sometimes only for minutes.

so where to go from here?

regards
Damian

ps
xp "Run" flashes the list because of its auto exit.
that "tasklist /svc /FI "IMAGENAME eq svchost.exe"
needs to placed in a batch file adding the command "pause'
on a separted line.

February 28, 2011

Damian @ 5:02 am #

well Mike,
and mouse right-click anywhere on the cmd screen
gets you the command line cut and
paste option to avoid typing.

regards
Damian

December 15, 2011

Md Rabeul Hasan @ 12:05 pm #

When i used internet in my computer after some time net connection error.then show a logo "svchost.exe-Application Error.so tel me what is the problem in my computer?

June 4, 2012

Alvin @ 7:20 am #

Hi there

I was wondering if you could give me some advice. The svchost.exe running the wuauserv, Schedule, SENS, ShellHDdetection, Themes, Winmgmt,RasMan, AeLookupSvc, gpsvc, LanmanServer, ProfSvc is sending out a lot of data when I am connected to the internet. I stopped the wuauserv in command and its still sending out huge amounts of data. I am viewing this information from TCP view and it gives me the PID of the svchost with the above named dll files running. I can not browse the internet at all because of this. Any ideas why this could be happening?

July 20, 2012

PATRICK @ 11:24 am #

OH WOW !
I have been frustrated for a long long time because I couldn't tell what was
behind all those SVCHOST.EXE ' s This Is magnificent Information.
THANKS FOR SHARING IT !

Leave a Comment

Fields marked by an asterisk (*) are required.

Subscribe without commenting