Wednesday, August 10

Info - svchost.exe

 “svchost.exe is a generic host process name for services that run from dynamic-link libraries”

WHY svchost.exe IS FORMED ?
  • Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for re-usability. 
  • But the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.
  • Svchost.exe is a generic process name for Windows services that run from Microsoft DLLs (dynamically linked libraries). Each of those instances of svchost.exe in the process lists actually represents a group of services that each process is managing.

WHY SO MANY svchost.exe's RUNNING ?
  • If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.
  • Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. 

  • Another svchost.exe instance might run all the services related to the user interface, and so on. 
  • This grouping of services allows for better control and easier debugging.

WHERE svchost.exe IS LOCATED ?
  • The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. 
  • Svchost.exe groups are identified in the following registry key : 

Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes. Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group.

  • A problem tends to arise when one .dll can’t complete its task, which in turn bogs down the rest of the svchost programs. Unfortunately, the svchost.exe is used as a favourite access point for viruses and other malicious programs.
  • Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance. 
    The biggest problem is identifying what services are being run on a particular svchost.exe instance.


  • Press "Ctrl+alt+del" or Open RUN & Type "TASKMGR", to Open TASK MANAGER.
  • Click "Show processes from all users". Here you can see lots of "svchost.exe" Processes running.

  • Now to see What Services are running under any Instance of svchost.exe. Right Click on any "svchost.exe", Click "Go to Service(s)".


  • You can see this selected svchost.exe, is holding 3 services, Those are Highlighted.

  • If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.
  • TYPE : tasklist /SVC
  • The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.


No comments:

Post a Comment