Why are there so many copies of svchost.exe on my machine?

A. Svchost is a generic host process that hosts services run from DLLs. During development, it's customary to separate new or changing services to increase the reliability and ease of troubleshooting; thus, on a beta OS version, you see more svchost processes running than on a release version.

To find out what's inside each copy of svchost.exe, use the Resource Kit Support Tools' tlist.exe (with the -s switch). (You need to install the Support Tools from supporttools on your product CD-ROM; they don't install by default.) Below is sample output from the tlist command:

C:>tlist -s0 System Process4 System176 smss.exe208 csrss.exe Title:172 winlogon.exe Title: NetDDE Agent256 services.exe Svcs: Eventlog,PlugPlay268 lsass.exe Svcs: Netlogon,PolicyAgent,ProtectedStorage,SamSs320 svchost.exe Svcs: RpcSs420 svchost.exe Svcs: AudioSrv,Browser,CryptSvc,Dhcp,dmserver,EventSystem,FastUserSwitchingCompatibilityServices,helpsvc,HidServ,lanmanserver,lanmanworkstation,Netman,Nla,Schedule,seclogon,SENS,ShellHWDetection,TermService,ThemeService,TrkWks,uploadmgr,W32Time,WmdmPmSp,wuauser480 svchost.exe Svcs: Dnscache500 svchost.exe Svcs: LmHosts,Messenger,RemoteRegistry,SSDPSRV,WebClient544 spoolsv.exe Svcs: Spooler660 DKService.exe Svcs: Diskeeper800 svchost.exe Svcs: winmgmt1092 explorer.exe Title: Program Manager1244 ctfmon.exe Title:900 ISATRAY.EXE Title: IsaTray1344 NAVAPW32.EXE Title: Norton AntiVirus Auto-Protect1212 FRONTPG.EXE Title: Microsoft FrontPage - D:asp www.ntfaq.comNTFAQ5apr2001.htm428 NAVAPSVC.EXE Svcs: NAV Auto-Protect1376 ALERTSVC.EXE Svcs: NAV Alert1372 PowerDVD.exe Title: PowerDVD444 OUTLOOK.EXE Title: Tasks - Microsoft Outlook1268 msmsgs.exe Title:1436 MDM.EXE Title: OleMainThreadWndName632 WINWORD.EXE Title: DDE Server Window1404 IEXPLORE.EXE Title: Q250320 - Description of Svchost.exe - Microsoft Internet Explorer1348 cmd.exe Title: E:WINDOWSSystem32cmd.exe - tlist -s1428 tlist.exe

Many services, drivers, and modules load at system startup and are essential to system operation. Even though they show up in Task Manager, they're still critical.

The svchosts are defined in the registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost.