svchost.exe

[misschillout]

Hi there,

svchost.exe appearing 6 times in Task Manager. Is this normal or do i have to do something to get rid of the duplicates.

Thank you

[caperjack]

this is normal ,
http://support.microsoft.com/kb/314056

[Keith Ritchey]

Yes this process hosts Windows services. If you want to see, which process hosts which service you can run taklist.
1. Click Start|Run
2. Type cmd
3. In the console window type
tasklist /svc >c:\services.txt
4. Open exporer and open the services.txt where we redirected the tasklist output to
5. Now open the Windows Task Manager by pressing Ctrl+Esc
6. In the Task Manager dialog select View|Select Columns.. and check the PID (Process Identifier) checkbox in the Select Columns dialog box
7. Click OK to close the Select Columns dialog box
8. Look at the Image Name column to find the appropriate svchost.exe process and refer to PID column to find the process identifier for the current process
9. Now switch to Notepad where we have our services.txt opened
10. Locate the PID we've got in the Task Manager and look in the Services column to find the services hosted by this host process
For examle you may have there process that hosts your audio service (AudioSrv), LAN browser service to work with Windows Networking (Browser), schedule service (Schedule), skinning service Windows Themes (Themes) and so on.

Alternatively, you can try Windows Internals' Process Explorer.

[millertime1025]

Keith, I did what you said and have found that the services using all my resources are
Audiosrv, BITS, Browser, CryptSVc, Dhcp, ERSvc, EventSystem, HidServ, IRmon, lanmanserer, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, Shared Access, ShellHWDetection, srservice, TapiSrv, Themes, Trkwks, W23Time, winmgmt, wuauserv, WZCSVC.

Any of those seem suspicious?

[Keith Ritchey]

I guess, it's Windows Update service, or wuauserv in this list. By the way, you can find out the service name by running sc utility.
1. Open command window by typing %comspec% in the Run dialog or in Windows explorer window
2. In the command window type
sc GetDisplayName wuauserv
it will return service name. In this example it will be
Name = Automatic Updates

OK. Now we know the service name what we should look for. I guess, it's well known problem with Windows Automatic Updates service, described in article KB 916089. If you recieve an access violation error when you try to install this fix, try installing another fix and then try installing windows update fix again.

You can try registering WU components try copying this into text file, saving it with cmd name and running
rem stopping Automatic Updates service
net stop wuauserv
rem stopping Background Intelligent Transfer Service
net stop bits
rem moving out Automatic Update service storage folder
move %SystemRoot%\SoftwareDistribution %TEMP%\SoftwareDistribution
rem registering components
regsvr32 /s wuapi.dll
regsvr32 /s wuaueng.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s atl.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups.dll
regsvr32 /s wups2.dll
regsvr32 /s wuweb.dll
rem istalling the KB 927891 patch
set patchstorage=c:\patches
rem Windows Automatic Updates SVCHOST 100% CPU Load patch for Windows XP X86
%patchstorage%\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
rem Windows Automatic Updates SVCHOST 100% CPU Load patch for Windows Server 2003 x86
rem %patchstorage%\WindowsServer2003-KB927891-v3-x86-ENU.exe /quiet /norestart

[ralphie_boy]

See this post I put out today
http://www.daniweb.com/techtalkforums/post343790.html#post343790