Help to clear confusion about the svchost.exe entries running in Task Manager

In Vista and Win 7, open TaskManager/Processes, right click on one of the svchost entries and choose 'Go to Services'.

This will highlight all the services running under that particular ID (PID).

In real English this takes away a lot of the mystery which confuses so many people. You can also stop a service at this point, BUT, be very careful or you may crash your machine and require a reboot if you pick a critical System Service.

Cheers

.... each Svchost.exe is simply a group of services running at any particular time and to have a number running is perfectly normal. (At the moment my computer is doing nothing in particular but there are 12 svchost entries showing in Task Manager). No problem.

Also a good little read here
What is svchost.exe And Why Is It Running?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Good explanation boopme

That is an excellent article BM. Explains it much better than I did, LOL. I reckon it should be pinned as a swag of users are perplexed by this subject.

Cheers

Grinler has pointed out that there is a tutorial here at BC

http://www.bleepingcomputer.com/tutorials/list-services-running-under-svchost.exe-process/

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Interesting.......But HAVING PROCESSES (EXE's) RUNNING CONSTANTLY USES MORE MEMORY AND RAM!! (You could notice slowdowns,etc)

The older way WAS BETTER!! (As most everything OLDER is better)

But HAVING PROCESSES (EXE's) RUNNING CONSTANTLY USES MORE MEMORY AND RAM!!

I think you might have missed the point that this utilizes less .exe's ("into .dll files instead of .exe files").

Simply having code loaded into memory in dynamic link libraries doesn't mean its "running", it only executes when it's called. And whilst it uses memory, it's going to have to do that anyway, and having one .exe whose sole purpose is to load say five .dll's has less overhead than loading five .exe's with the same code function. It simply isn't true to say the old way is always automatically better.

Thank you very much for the information and links in this thread. There are some very good resources here.

Great little piece of info thanks a lot for the article, cleared up some questions i have had.