Svchost exe windows vista

^✻ Фрагменты данных файлов предоставлены участником Exiftool (Phil Harvey) и распространяются под лицензией Perl Artistic.

From Wikipedia, the free encyclopedia

Svchost.exe (Service Host, or SvcHost) is a system process that can host one or more Windows services in the Windows NT family of operating systems.^[1] Svchost is essential in the implementation of shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concern to NT designers because creating Windows processes takes more time and consumes more memory than in other operating systems, e.g. in the Unix family.^[2] However, if one of the services causes an unhandled exception, the entire process may crash. In addition, identifying component services can be more difficult for end users. Problems with various hosted services, particularly with Windows Update,^[3][4] get reported by users (and headlined by the press) as involving svchost.

The svchost process was introduced in Windows 2000,^[5] although the underlying support for shared service processes has existed since Windows NT 3.1.^[2]

Its executable image, %SystemRoot%\System32\Svchost.exe or %SystemRoot%\SysWOW64\Svchost.exe (for 32-bit services running on 64-bit systems) runs in multiple instances, each hosting one or more services.

Services running in SvcHost are implemented as dynamically-linked libraries (DLLs). Each service’s registry key must have a value named ServiceDll under the Parameters subkey, pointing to the respective service’s DLL file. Their ImagePath definition is of the form %SystemRoot%\System32\svchost.exe -k %service group%; (i.e. netsvcs). Services sharing the same SvcHost process specify the same parameter, having a single entry in the SCM’s database. The first time that a SvcHost process is launched with a specific parameter, it looks for a value of the same name under the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost key, which it interprets as a list of service names. Then it notifies the SCM of all the services that it hosts. SCM does not launch a second SvcHost process for any of those received services; instead, it simply sends a «start» command to the respective SvcHost process containing the name of the service that should be launched within its context, and whose respective DLL SvcHost loads.

According to a 2003 Microsoft presentation, the minimum working set of a shared service is approximately 150 KB instead of 800 KB for a standalone process.^[6]

Starting with Windows 10 version 1703, Microsoft changed the way services are grouped into host processes. On client computer systems with more than 3.5 GB of memory, services are no longer grouped into shared host processes. Instead, each service is run in its own process. This results in better isolation of services, making the computer system more resilient to service failures and vulnerabilities and easier to debug. However, it adds some memory overhead. ^[7]

Starting with Windows Vista, the internal identification of services inside shared processes (svchost included) is achieved by so-called service tags. The service tag for each thread is stored in the SubProcessTag of its thread environment block (TEB). The tag is propagated across all threads that a main service thread subsequently starts, except for threads created indirectly by Windows thread-pool APIs.^[8]

The set of service tag management routines is currently an undocumented API, although it is used by some Windows utilities like netstat to display the TCP connections associated with each service. Some third-party tools like ScTagQuery also make use of this API.^[8]

In Windows XP and later editions, the command tasklist /svc shows a list of the services being run by each listed process (i.e. by each running instance of svchost.exe), with each separate instance of the svchost process identified by a unique Process ID number (PID).

In Windows Vista and Windows 7, the «Services» tab in Windows Task Manager includes a list of services, showing their groups and Process IDs (PIDs); right-clicking on an svchost instance in the Task Manager’s «Processes» tab and selecting «Go to Service(s)» switches to that list of services and selects the service running under the corresponding svchost instance.

In Windows 8, the Task Manager interface was streamlined so that each svchost entry can be expanded by a single click to a sub-list of services running inside it.

The Sysinternals Process Explorer (available as a free download from Microsoft) provides additional information about services running under svchost.exe processes, when the user hovers the mouse over an svchost instance in Process Explorer.

None of the above methods allows the user to identify which of the multiple services running inside an svchost instance accesses a particular resource, i.e. processor, disk, network or memory; the Windows Resource Monitor only accounts for (most of) those resources at process level. It does however show processor usage at service level, on the «CPU» tab.^[9] A service-aware list of TCP connections and UDP ports opened can be obtained using the command netstat -b.^[10]

In order to troubleshoot other kinds of problems with a service running inside an svchost instance, the service(s) suspected to be causing the problem must (all) be reconfigured so that each runs inside its own svchost instance. For example, sc config foo type= own will reconfigure the service named «foo» to run in its own svchost instance. Changing the type back to shared is done by an analogous command. The service must be restarted for such a configuration change to take effect. This debugging process is not foolproof however; in some cases, a heisenbug may occur, which causes the problem to go away when the service is running separately.^[11]

A more complex method of troubleshooting is to create an isolated service group.^[12]

In Windows 10, starting with release 1703, svchost was redesigned by Microsoft to host only one service per process, depending on available system memory.^[13] The default setting causes services to be hosted independently if the system has at least 3.5 GB of RAM.

• inetd
• systemd
• Service Control Manager
• List of Microsoft Windows components
• Windows NT startup process

• Russinovich, Mark; Solomon, David; Ionescu, Alex (2009), Windows® Internals (5th ed.), Microsoft Press, ISBN 978-0-7356-2530-3
• Russinovich, Mark; Solomon, David; Ionescu, Alex (2012), Windows Internals. Part 1 (6th ed.), Microsoft Press, ISBN 978-0-7356-4873-9

• svchost.exe uitgelegd
• ScTagQuery

Problems from Svchost.exe 

Svchost.exe is known to cause high CPU usage problems. I’m sure you’ve been in a situation like this: you’re working on your computer and enjoying yourself when all of a sudden it becomes agonizingly slow and even starts freezing up. You press CTRL+ALT+DEL to open the Task Manager, click on the Processes tab, and see that there are several instances of svchost.exe running and one of them is using up 90% — 100% of CPU! (NB Windows Vista and Windows 7 users need to check Show processes from all users to be able to see all svchost.exe instances). Some people will think: “OMG! My computer’s got a virus!!!”. Well, that might be true, because some malware masks itself as svchost, but most likely it’s just Windows being Windows.

How to Stop It?

Now the question is how to stop svchost.exe from stealing CPU usage. First of all, you’ll need to find out which of the svchost file instances is the culprit and is causing your computer to slow down. Also you need to identify the actual application running it.

Luckily, it’s easy. There is a very useful free Microsoft (originally Sysinternals) tool called Process Explorer, that gives you detailed information for each running process. All you need to do is download it and click the .exe file — no installation is required.

Once you’ve got it running, hover the mouse point over each svchost process and a tooltip windows with all the information needed will appear.

How to Fix It?

First of all, if the process that is eating up CPU is not a Windows process, kill it and uninstall the program that runs it. Also scan your computer for viruses and other malware.

However, most likely it will be a Windows process, such as Task Scheduler, firewall, or Windows Update. Sometimes simply restarting your computer gets rid of the problem. If not, try downloading the most recent Windows Updates. If for some reason you can’t, go to the Control Panel — Administrative Tools — double-click the Services shortcut (or click Start — Run — type in services.msc — hit Enter), find the required service, right-click on it, go to Properties and select Disabled from the Startup type box. You can always re-enable it later, so don’t worry. Reboot your computer and then go to the Microsoft website and download updates. Install them, re-enable the service that you have stopped, and restart again. Hopefully everything will be working now.

Another way to get rid of svchost.exe high CPU usage problem is to open the Task Manager (CTRL+ALT+DEL), find the process that is causing the problem, right-click on it, go to Set Priority and set it to Below Normal (or Idle if Below Normal doesn’t help). Keep in mind that setting it to Idle might interfere with your networking services, especially if you’re at work and part of a large network.

Learn more about svchost.exe…