Tip: Tracking Down That Wiley Svchost Process

Sometimes the computer seems pretty slow. You fire up Task Manager and a quick glance shows the CPU running at 100%! Flip to the Process tab, click on the CPU column heading (to sort) and see that svchost.exe is using all the cycles.

Traditionally, that’s when I’d say, “oh crap.” You see, you can have a lot of svchost.exe processes running at one time, each for various/combined purposes. Now what?

Here are two options to figure out what’s really going on

1. tasklist /svc
   Bring up a command prompt and type tasklist /svc and hit enter. Enjoy the resulting list — but look closely at the svchost.exe entries. The right column displays what processes are running “under the umbrella” of svchost.

   Here’s an example of 3 from one of my home machines, see how different each is?
   

2. ProcessExplorer
   Sysinternals is where you go for the handy windows utilities and ProcessExplorer is no exception. This utility is everything Task Manager could have been if Microsoft didn’t mind overwhelming 50% of the population.

   Here’s another example from one of my machines, The popup is the detail for that particular svchost.ext:
   

Just what is this crazy svchost.exe thingy anyways?

Our friends at Microsoft have a useful article on the topic at KB314056:

At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.

That’s actually an interesting article if you’re a windows person — some more tasklist command line arguments are mentioned.

Possibly Related posts:

1. Quick Process Monitor Tip
2. Wrestling with WSUS Bandwidth