Member Avatar for misschillout

Hi there,

svchost.exe appearing 6 times in Task Manager. Is this normal or do i have to do something to get rid of the duplicates.

Thank you

  • 5 Contributors
  • 5 Replies
  • 1K Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by ralphie_boy

Dani AI

Generated

Yes — seeing several svchost.exe entries is expected. svchost.exe is the shared "Service Host" that loads service DLLs; Windows groups services into different host processes so a problem in one group does not crash everything. This is how Microsoft documents service-host grouping and why the number of svchost instances varies by OS and installed services. Service host grouping in Windows 10. (learn.microsoft.com)

If one svchost process is using excessive CPU or memory, focus on the service inside that host rather than killing svchost itself. Resource Monitor (Resmon) will show which service under a given PID is consuming CPU or network. Microsoft’s troubleshooting guide also shows a reliable isolation technique: temporarily move the suspect service into its own host process so you can identify it, then revert the change when done. For example:

sc config <ServiceName> type= own

After testing, set it back with type= share and restart the service. See Microsoft's guidance for the full procedure and cautions. (learn.microsoft.com)

Also verify the svchost executable is the genuine Windows file (it should live in %SystemRoot%\System32 or %SystemRoot%\SysWOW64) and run an up-to-date malware scan if anything looks out of place. Tools like Process Explorer or Resource Monitor make inspection easier. For general checking and signs of a fake svchost, see the overview at Lifewire. (lifewire.com)

This complements ’s Microsoft reference and ’s diagnostic approach; if you saw the high-usage services listed by , start with Windows Update/BITS but avoid permanently disabling core services — isolate, identify, fix, then revert.

Recommended Answers

All 5 Replies

Member Avatar for Keith Ritchey

Yes this process hosts Windows services. If you want to see, which process hosts which service you can run taklist.
1. Click Start|Run
2. Type cmd
3. In the console window type
tasklist /svc >c:\services.txt
4. Open exporer and open the services.txt where we redirected the tasklist output to
5. Now open the Windows Task Manager by pressing Ctrl+Esc
6. In the Task Manager dialog select View|Select Columns.. and check the PID (Process Identifier) checkbox in the Select Columns dialog box
7. Click OK to close the Select Columns dialog box
8. Look at the Image Name column to find the appropriate svchost.exe process and refer to PID column to find the process identifier for the current process
9. Now switch to Notepad where we have our services.txt opened
10. Locate the PID we've got in the Task Manager and look in the Services column to find the services hosted by this host process
For examle you may have there process that hosts your audio service (AudioSrv), LAN browser service to work with Windows Networking (Browser), schedule service (Schedule), skinning service Windows Themes (Themes) and so on.

Alternatively, you can try Windows Internals' Process Explorer.

Member Avatar for millertime1025

Keith, I did what you said and have found that the services using all my resources are
Audiosrv, BITS, Browser, CryptSVc, Dhcp, ERSvc, EventSystem, HidServ, IRmon, lanmanserer, lanmanworkstation, Netman, Nla, RasMan, Schedule, seclogon, SENS, Shared Access, ShellHWDetection, srservice, TapiSrv, Themes, Trkwks, W23Time, winmgmt, wuauserv, WZCSVC.

Any of those seem suspicious?

Member Avatar for Keith Ritchey

I guess, it's Windows Update service, or wuauserv in this list. By the way, you can find out the service name by running sc utility.
1. Open command window by typing %comspec% in the Run dialog or in Windows explorer window
2. In the command window type
sc GetDisplayName wuauserv
it will return service name. In this example it will be
Name = Automatic Updates

OK. Now we know the service name what we should look for. I guess, it's well known problem with Windows Automatic Updates service, described in . If you recieve an access violation error when you try to install this fix, try installing another fix and then try installing windows update fix again.

You can try registering WU components try copying this into text file, saving it with cmd name and running
rem stopping Automatic Updates service
net stop wuauserv
rem stopping Background Intelligent Transfer Service
net stop bits
rem moving out Automatic Update service storage folder
move %SystemRoot%\SoftwareDistribution %TEMP%\SoftwareDistribution
rem registering components
regsvr32 /s wuapi.dll
regsvr32 /s wuaueng.dll
regsvr32 /s wuaueng1.dll
regsvr32 /s atl.dll
regsvr32 /s wucltui.dll
regsvr32 /s wups.dll
regsvr32 /s wups2.dll
regsvr32 /s wuweb.dll
rem istalling the KB 927891 patch
set patchstorage=c:\patches
rem Windows Automatic Updates SVCHOST 100% CPU Load patch for Windows XP X86
%patchstorage%\WindowsXP-KB927891-v2-x86-ENU.exe /quiet /norestart
rem Windows Automatic Updates SVCHOST 100% CPU Load patch for Windows Server 2003 x86
rem %patchstorage%\WindowsServer2003-KB927891-v3-x86-ENU.exe /quiet /norestart

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.