When I was a starting IT professional, I was always wary of the mysterious svchost.exe process. Somehow it always shows up in the task manager with several instances that to me looks like a virus. Also, svchost.exe would eat up 100% of my CPU, which made me even more suspicious.
As it turns out, Svchost.exe and services.exe are responsible for launching the processes associated with the behind-the-scenes programs.
According to Microsoft, the svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of svchost.exe can run at the same time.
Each svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where svchost.exe is started. This grouping of services allows for better control and easier debugging.
You can use the TaskList utility (tasklist.exe) to see which services are handled by any given instance of svchost.exe. Just run cmd.exe then enter this command: tasklist /svc
A closer look will show you you the running services under the services column:
From the screenshot above we can easily see which services are grouped by Windows. As an alternative, if you are not comfortable with command line, you can use the Services tab in the Task Manager to display all services:
The processes with similar PIDs are grouped services:
To control which services to turn-on or off, go to the Control Panel > Administrative tools then choose Services.
The services window will open showing you all registered services on your computer. Notice that some services are started (runnning) and some are not.
You may select an individual service to either start or stop.
Ben Carigtan shows you how it’s done!
Thanks alot bcarigtan, really useful subject.