What is svchost.exe?
Svchost.exe is a generic host process for Win32 services and is an integral part of Windows OS. It cannot be stopped or restarted manually. This process manages system services that run from dll, dynamic link libraries. Examples for such system services are Automatic Updates, Windows Firewall, Plug and Play, Fax Service, Windows Themes, and many more.
How svchost.exe works?
At startup, Svchost.exe checks the services portion of the registry and constructs a list of services that it needs to load. Under normal conditions, multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.
If the process svchost.exe uses high cpu resources, it is mostly due because the service "Automatic Updates" is downloading some new Windows update. But if you see the cpu usage is about 99% or 100%, you should know that maybe your computer is downloading virus caused by some hidden malware on your computer. Some malware like the Conficker worm changes the Windows Registry so that svchost loads the malware .dll file. In this case you only see the authentic svchost.exe process in the task manager.
How to display services associated with it?
Each instance of svchost.exe process seen in the Task Manager hosts a group of services. To see the list of services hosted by each instance of svchost.exe, you may use the Tasklist.exe console utility available in Windows XP Professional Edition as follows:
1. Click Start.
2. Clilck Run.
3. Type CMD.EXE
4. Type tasklist /svc >c:\taskList.txt
5. The taskList.txt will contain the list of Processes, their Process IDs and the Services running under each Process.
