Hi everyone,

My laptop running Windows xp is showing that 7 of the same program are running at the same time. I see this under the Processes Tab of the Windows Task Manager. The program is called svchost.exe. Thier are 7 svchost.exe running at the same time is this normal?

100% normal. They represent your services, usually more than one service per process.

Yes, it's ok. In my computer, there's one! I disabled any services at msconfig to speed up. But I don't recommend to do this.

The Service Host is how some processes interconnect with the Windows OS.
This provides for a simple interface for developers to code to, but at the same time can take up a lot of resources. It has also been identified as one of the biggest memory leaks, but this is not the Service Host coding at fault per se, but the way that the application/process uses it. I'd like to see less utilization of this in the future, especially as related to the Vista Sidebar, which opens a new on per Gadget.....BAH.

Even on .NET it isn't very simple and as a System Administrator, services are fairly hard to monitor. I don't like them either but in some situations, they make more sense than a tray application (e.g. like a subcomponent of IIS, hardware, etc.).

If there are that many instances of svchost running, I would be inclined to open up services.msc and make sure nothing nasty is going on.

True that!
I've used applications like ProcMon and others that can show exactly what initiated or is using the Service Host instance. With several running, you should be able to easily identify which process is using which instance of svchost, but MS does not provide this by default or easily.

Can also use "Process Explorer" to see some details of what's running under some of the svchost processes.

Process Explorer Ver. 11.13 as of 20080415
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
http://download.sysinternals.com/Files/ProcessExplorer.zip

edit-update procexplorer version from 11.11 to 11.13

I'm not sure if you can in XP, but in Vista at least you can select an instance of svchost in Task Manager and select "Go to Service(s)" and it will show you what services are using it. --> http://img291.imageshack.us/img291/1756/88965893cd5.jpg

EDIT: Just fired up XP (SP3) in VMware, the Task Manager doesn't sport the feature.

McFly said:

Process Explorer (see my post above) does much the same thing when you simply move the mouse pointer over the svchost.exe in which you're interested.

You can also right-click on the svchost.exe of interest, then select "properties", then select the "services" tab. (the right-click>>properties window shows a wealth of info about what's going on with each service running under that svchost.exe process) Example:
http://img231.imageshack.us/img231/8672/procexplorerexampleuo8.jpg


You also have some real-time control over processes and services. You can set its priority, kill, suspend, restart, etc. However, do that kind of stuff at your own risk.

Along similar lines, XPsysPad is another nice freeware program to use for system management. It can really simplify accesing system tools and information. http://www.xtort.net/xtort-software/xpsyspad/



edit-cleanup
edit-add image of ProcessExplorer...svchost.exe>>properties>>services
edit-add info on real-time controls
edit-sorry about multiple edits...pain meds are seriously fuzzying up my brain today

what's the deal john, hiding the fact that you use symantic products?

~Vel said:
Nope. I prefer people have as little info about any of the combination of security systems installed on my computers that might reveal weaknesses. More than just security-related processes are redacted as well. People don't need to know everything I do.

Well, unless you're the Air Force, of course.
http://blog.wired.com/defense/2008/05/air-force-mater.html

Or, unless you're one of......"THEM "
http://www.hardwareanalysis.com/content/topic/71278/
http://youtube.com/watch?v=8lXdyD2Yzls
even better, but R rated...
http://youtube.com/watch?v=N_sjzSNpkQw

Hmmz, I use Process Monitor a lot, but I'm not sure I've used Process Explorer. I'll have to download that.

Hehe, I just downloaded and used Process Explorer. There was an HP Network Device Lookup something or other that was running under svchost.exe consuming 98-100% CPU usage. It is very helpful, I say.

Thought I'd go an have a look and - in my Vista (Bus) there are no scvhost.exe's running but all the processes are listed with a description. Very helpful of Mr Microsoft I say.
But thanks for the good discussion - I'll look at my XP scvhost's tomorrow when I'm on my big computer.

Use the total security software to solve the problem