{"id":75,"date":"2007-07-09T14:14:18","date_gmt":"2007-07-09T14:14:18","guid":{"rendered":"http:\/\/thebackroomtech.wordpress.com\/2007\/07\/09\/identifying-processes-running-as-svchostexe\/"},"modified":"2018-05-03T14:08:12","modified_gmt":"2018-05-03T14:08:12","slug":"identifying-processes-running-as-svchostexe","status":"publish","type":"post","link":"https:\/\/thebackroomtech.com\/identifying-processes-running-as-svchostexe\/","title":{"rendered":"Identifying Processes Running as svchost.exe"},"content":{"rendered":"

I have previously written about experiences with systems becoming unresponsive and reporting svchost.exe utilizing 99% of the CPU. Since so many different .dll’s run as this generic host process, identifying exactly which program is the cause of the high CPU usage is often difficult.<\/p>\n

According to KB314056, the Svchost.exe file is located in the %SystemRoot%\\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.<\/p>\n

Svchost.exe service groups are listed in the following registry key:<\/p>\n

HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsNT\\CurrentVersion\\Svchost<\/pre>\n
Windows XP Pro has a built in function that can be run from a command prompt called tasklist.exe that provides information useful in tracking down the offending programs.<\/p>\n
Running tasklist.exe<\/i><\/a> with no switches will provide a list of running processes, their PID, console type and memory usage. Notice svchost.exe, which has many PIDs. That’s because svchost hosts many different Windows processes<\/a> inside of it.<\/p>\n
\"\"<\/a><\/p>\n
To determine which PID is running which service, run<\/p>\n
tasklist.exe \/SVC<\/i><\/pre>\n
\"\"<\/a><\/p>\n
Notice the additional information that is shown about which instances services are run from.<\/p>\n
You can list services and applications on a remote system by running<\/p>\n
tasklist.exe \/s remoteIPaddress <\/i><\/pre>\n
or<\/p>\n
tasklist.exe \/s remoteComputerName<\/i><\/pre>\n
\"\"<\/a><\/p>\n
If you want even more detail about the process and applications running, type:<\/p>\n
tasklist \/M <\/i><\/pre>\n
This will show which .dlls are in use by the processes.<\/p>\n
If you want to isolate a service shared from svchost.exe, My Green Paste has a nice post on manipulating this service via the registry.<\/p>\n
Once you’ve isolated the offending process that is causing the excessive resource utilization, use taskkill.exe<\/i> to kill the offending application. You may need to specify the \/F<\/i> switch to force the offending process to be killed.<\/p>\n
\"\"<\/a><\/p>\n
Obviously killing the wrong processes can crash your machine, and editing the registry can make it unbootable, so before making changes make sure you have a recent backup.<\/p>\n
Ask the Performance Team has published a new post on svchost.exe<\/a> with some really detailed information. I think the methods of creating isolated processes and isolated service groups would be most helpful in troubleshooting performance and bottleneck issues.<\/p>\n","protected":false},"excerpt":{"rendered":"
I have previously written about experiences with systems becoming unresponsive and reporting svchost.exe utilizing 99% of the CPU. Since so many different .dll’s run as this generic host process, identifying […]<\/p>\n","protected":false},"author":5,"featured_media":3119,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"updated_on":"","footnotes":""},"categories":[52],"tags":[],"class_list":{"0":"post-75","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-troubleshooting"},"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t