How To Control Svchost.exe

Ok, maybe like me you still discover that Windows finds a way to confuse you just when you thought you had cracked it! Yep, finally, you know what those programs running in the system tray are doing, and why those pop ups occur; you have even cracked how to optimize the performance of your machine. Then just as you think that you understand the processes – it happens again.

What’s that?!

I refer to what seems to be an endless list at times from a process called svchost.exe or service host. At first, the only understanding I could fathom from its annoying presence was that it was consuming a lot of memory.

Windows XP introduced the concept of svchost to start running multiple services within a single process. You can see that the list of processes is a long one. Just take a look at your processes where we will begin to control svchost.exe’s presence:

1. Right click on the clock.

2. Select the Processes tab

3. Scroll down the list and you will see a list of svchost.exe instances.

The system processes listed on the Services tab will show you what is attached to each of those svchost.exe instances. For various functions within windows from when it starts up to running desktop applications, many services need to run concurrently so you will see several instances of svchost as shown above.

Right click on one of the svchost.exe files as above and select ‘Go to Service’. This will take you to the service attached to that svchost process. You will find that 3 or more services are attached to the svchost files. However, too many svchost files can drain memory resources.

Another issue with svchost is that it can attract viruses. Trojans can sit comfortably inside the svchost shell and do their dirty work. This causes sluggish behavior, and random system error messages. But, don’t let this allow you to wreak havoc on the files – whatever you do, don’t start deleting them.

Your system will crash and even suffer irreparable damage that only a reinstall can fix if you do.

Viruses prey on svchost’s RPC (Remote Procedure Call) which is a core function of the system. This way Trojans can infiltrate critical system components.

Though, if your PC is slower these days, and you can see lots of svchost instances, this doesn’t mean you are infected. I do recommend you run your anti-virus and close any ports on your router that are not being used (ask your vendor on this). Though, it may just be a case of having services running that are not needed.

If the performance tab in task manager shows 100% CPU usage, and your fan speed is adjusting itself very rapidly, these are clear hardware signs that running processes are eating up too much memory and CPU power. Before performing these actions, create a system restore point.

So, to begin shutting down services that are not needed, right-click these and select ‘stop service’:

1. Check your system tray, how many application icons are sitting there. Your anti-virus is needed, do you need the others?

2. Go back to Services.

3. Do you need the iPod service? Are you seeing any p2p references?

4. The Application layer Gateway Service which connects to Internet Sharing and the Windows firewall can be safely disabled.

5. To round this list off: Windows Error Reporting Service, Cryptographic Services, Shell Hardware Detection, ReadyBoost (on Vista), Remote Access Connection (only needed for dial-up users or VPN), Network List Service (if you don’t mind losing the network icon showing the connection is working).

This is a good start towards controlling svchost.exe as far as helping ease the burden on your processor and memory resources is concerned.