Jun 11 2009

How to find what’s running under SVCHost.exe

My PC was behaving sluggishly the other day. I tried to be patient, but had to fire up the task manager when I could bear it no longer. That’s when I noticed great gobs of my swap file allocated to “SVCHOST.EXE”:

whats-running-under-svchost_exe_tasklist-ss

The problem is, SVCHOST is a catch all windows service container. Meaning, many windows services run under the same instance of SVCHOST. How was I going to figure out which services might be the culprit?

Enter the tasklist command.

Tasklist displays info about running tasks, including SVCHOST.

Simply running tasklist at the command prompt displays a laundry list of all running processes. This wasn’t going to do it, so I ran it with the “/?” switch to try and find how to narrow the info…

/SVC Displays services hosted in each process.
/FI filter Displays a set of tasks that match a given criteria specified by the filter.

Looks good so far, now I need to know what filter to apply:

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    IMAGENAME       eq, ne                    Image name

OK, this gives us:

“C:\>tasklist /svc /FI “IMAGENAME EQ SCVHOST.EXE”

But it seems the filter is case sensitive, because when I run that command, I get this:

INFO: No tasks are running which match the specified criteria.

So, switching to lower case gives me what I want:

“C:\>tasklist /svc /FI “IMAGENAME EQ svchost.exe”

Image Name     PID        Services
=========== =====  =======================
svchost.exe     744        DcomLaunch
svchost.exe     844        RpcSs
svchost.exe     888        AeLookupSvc, AppMgmt,
                                    AudioSrv, BITS, Browser,
                                    CryptSvc, dmserver,
                                    EventSystem,lanmanserver,
                                    lanmanworkstation, Netman,
                                    Nla, RasMan, Schedule,
                                    seclogon, SENS,ShellHWDetection,
                                    Themes, winmgmt, wuauserv
svchost.exe     928         Dhcp, Dnscache
svchost.exe     976         LmHosts, W32Time
svchost.exe     1772       Net Driver HPZ12
svchost.exe     1816       Pml Driver HPZ12
svchost.exe     2424       TermService
svchost.exe     3312       TapiSrv
svchost.exe     2688       W3SVC

From there, it’s just a matter of shutting down or restarting each of the services listed under the process id 888 ( I got this from taskmanager).

Blog Traffic Exchange Related Posts Blog Traffic Exchange Related Websites
  • SVCHOST.exe - What is it and why are there so many of them? I get asked this a lot.  When you run Task Manager in XP and look at the process list, you see tons of svchost.exe processes running.  You can't kill them (you don't really want to) and there's no obvious reason that there are so many of them. What are they? ......
  • Maintenance for your Swimming Pool On a humid and hot day in August, there is nothing that feels quite as good as a dip in your pool. If your pool is looking a little bit more like a pond than a place for swimming, then nobody is going to be happy. Here are some tips......
  • Tennis Scoring A game of tennis starts with the service and ends when a player has scored 4 points, as long as they are also 2 points ahead of their opponent. Games are generally part of a set, which is a series of games played until one player has reached six wins,......
  • should I tip or not? If you're careful with your money you probably face a frequent dilemma of how much to tip various people in service positions. Tipping ranges from the $3 slipped to a doorman who hails a cab to a couple of hundred for some guys who move your stuff cross-country. Before I......
  • The Movers Will Help You To Relocate The relocation has always been a hard chaotic task which would be worse if you do not have enough time for it. The tedious work of packing your precious goods and making sure that they are carefully moved would become a head pain for everyone. In addition, if you should......