Thursday, February 11, 2010

What is svchost.exe and what is it doing?

Many of us wonder what exactly is svchost.exe and what it exactly does as you can see many instances of this exe running in Windows Task Manager. Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs). At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.

To check what services are running under each svchost the most preferred application used is Process Explorer from SysInternals. Using Process Explorer you can do variety of things and verify almost all the processes. Svchost Viewer is an open source application which only concentrates on svchost processes.
It displays all the instances of svchost.exe and there Process ID's on the left pane. Expanding the tree displays the processes running under each svchost.exe. The right pane displays the information of each process selected like amount of memory used, the amount of data written and read by the process. Information about the server selected in the left name.

svchost viewer is a small application around 40 kb and runs on Windows XP, Vista and Windows 7. It does not need any installation and comes in a exe format. The only prerequisite to run it is .Net Framework 2.0 or higher installed.

0 comments: