svchost

Published by Mesila; San Francisco, CA

I recently had unknown malware that was causing Windows to keep rebooting at odd moments. Another thing it did was install a kazillion services and then have all of them running at once. It wasn't something that any scanner would pick up--and being big on file sharing, I've made it a point to keep a whole army of antimalware programs around. I'm assuming the culprit was either one that was new at the time, or a variant that had morphed itself from an older version. Eventually, after a lot of fussing … Read more

This is a continuation of my previous posting (Using Process Explorer to tame svchost.exe - Advanced topics) which introduced the excellent Process Explorer program, a souped up version of Task Manager. According to the author, "Process Explorer works on Windows 9x/Me, Windows NT 4.0, Windows 2000, Windows XP, Server 2003, and 64-bit versions of Windows for x64 and IA64 processors, and Windows Vista." And, it's free.

When a computer is running slow, people sometimes guess at the underlying problem. An experienced Process Explorer user doesn't have to guess.

Below is the main Process Explorer … Read more

On February 5th, Peter Butler of CNET wrote a blog posting about using the free Process Explorer program to prevent an instance of the svchost.exe process from hogging the CPU on his CNET-provided* computer. This is a follow-up, a more advanced look at Process Explorer.

To people unfamiliar with Process Explorer, I usually call it Task Manager on steroids. But comparing Process Explorer to Task Manager is like comparing humans to amoebas. It's that far up the evolutionary scale.

Let me say up front that I am prejudiced. I think Process Explorer is an excellent program. I'd … Read more

The situation is familiar to countless Windows users: They're in a groove at work, firing off e-mails, crafting documentation, and even blogging on their personal site during breaktime, when suddenly, something takes over 99 percent of the CPU, slowing it to a virtual standstill. A quick look at the invaluable Process Explorer (or the standard Windows Task Manager) indicates that a process called svchost.exe is using all that CPU. What's more, there's one main CPU offender. Multiple versions of svchost.exe are running in the background and hogging CPU cycles. What is it? Is it spyware? Hackers? Terrorists?

Although there are historical cases of malware using svchost.exe, because of its common presence, it's most likely just Windows being Windows. Svchost.exe is a generic process name for Windows services that run from Microsoft DLLs (dynamically linked libraries). Each of those instances of svchost.exe in the process lists actually represents a group of services that each process is managing. With Process Explorer, it's easy to see which services each process manages, and stop them one by one to see which is the CPU culprit.

In the spring of 2007, a major problem arose with a Windows update that caused svchost.exe to use 100 percent of CPU because of an issue with Automatic Updates. To correct that bug, be sure that Windows is fully patched with the most recent updates.

The first thing to do is to determine which of the active svchost.exe processes is causing the slowdown. Fire up Process Explorer, and click on the CPU column header to sort the list of processes by processor usage. A list of processes, sorted from most processor intensive to least intensive, is displayed. When the computer stalls, switch over to Process Explorer and see which running process is causing the crunch.… Read more