On windows XP, the process SVCHOST.EXE is a mystery for most people. If you check your task manager, you may have several instances of this process running. On my XP home edition I have actually 7 of this processes. Microsoft describes SVCHOST.EXE on this document by the following sentences:
“At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. ”
In the document referenced above Microsoft show how to use the command TASKLIST /SVC in a command box to print information regarding the running SVCHOST.EXE. Fortunately, there are some other way to get information regarding SVCHOST.EXE. Langa Blog shows in this article, that we can use Windows Defender or process Explorer from sysinternals to displays information about SVCHOST.EXE. But the most complete software to display SVCHOST information is SVCHOST Informations. This freeware may be downloaded here. The author is called Pierre Torris. Actually only a French version is available. This application display each svchost process running then with a tree all the services attached to the process. You also have all the informations regarding the services: Library, account, start mode, etc. A screenshot is shown below:

















No Responses to “SVCHOST.EXE Demystified”
Please Wait
Leave a Reply