TechSpot

Should I have multiple copies of svchost.exe running?

By Envergure
Sep 16, 2007
  1. Hey everyone.


    I was trying to install the BF2 demo, but it seems something was interfering with it. So I open Task Manager. Everything's more or less in line, except I have seven copies of svchost.exe running.

    Four of them are system processes, two are network services and one is a local service. They're using anything from 250k to 9.6M of memory. None of them appears to be doing anything at the moment.

    I searched my hard drives for svchost.exe and two files came up: one in C:\WINDOWS\system32, where it should be, and one in C:\WINDOWS\system32\dllcache, the name written in blue.

    I'm pretty confident it's not malware, unless a process can appear in Task Manager by a different name than its filename on disk.

    I know the program is used by the system to run tasks executed by DLLs, so my best theory is that for every DLL that gets run, a new copy of svchost has to be opened.

    Theories aside, however, I'd love to know exactly what's going on. Any ideas or suggestions are appreciated.


    Thanks!
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    It`s perfectly normal for there to be several instances of svchost.exe running in task manager.

    The file paths to your svchost.exe are prefectly legit. I.E C:\windows\system32\svchost.exe and C:\WINDOWS\system32\dllcache\svchost.exe in blue are normal.

    Regards Howard :)
     
  3. matav

    matav TS Enthusiast Posts: 174

    Svchost.exe is a generic host process name for services that run from DLLs within modern versions of the Microsoft Windows operating system...

    At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in Windows XP Professional can run the following command at the system prompt to get a breakdown:

    C:\>tasklist /svc /fi "imagename eq svchost.exe"
     
  4. Envergure

    Envergure TS Enthusiast Topic Starter Posts: 154

    That's interesting. Thanks for all your help!
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.