A. Svchost is a generic host process that hosts services run from DLLs. During development, it's customary to separate new or changing services to increase the reliability and ease of troubleshooting; thus, on a beta OS version, you see more svchost processes running than on a release version.

To find out what's inside each copy of svchost.exe, use the Resource Kit Support Tools' tlist.exe (with the -s switch). (You need to install the Support Tools from \support\tools on your product CD-ROM; they don't install by default.) Below is sample output from the tlist command:

                              C:\>tlist -s                              0 System Process                              4 System                              176 smss.exe                              208 csrss.exe Title:                              172 winlogon.exe Title: NetDDE Agent                              256 services.exe Svcs: Eventlog,PlugPlay                              268 lsass.exe Svcs: Netlogon,PolicyAgent,ProtectedStorage,SamSs                              320 svchost.exe Svcs: RpcSs                              420 svchost.exe Svcs: AudioSrv,Browser,CryptSvc,Dhcp,dmserver,                              EventSystem,FastUserSwitchingCompatibilityServices,helpsvc,HidServ,                              lanmanserver,lanmanworkstation,Netman,Nla,Schedule,seclogon,SENS,                              ShellHWDetection,TermService,ThemeService,TrkWks,uploadmgr,W32Time,                              WmdmPmSp,wuauser                              480 svchost.exe Svcs: Dnscache                              500 svchost.exe Svcs: LmHosts,Messenger,RemoteRegistry,SSDPSRV,WebClient                              544 spoolsv.exe Svcs: Spooler                              660 DKService.exe Svcs: Diskeeper                              800 svchost.exe Svcs: winmgmt                              1092 explorer.exe Title: Program Manager                              1244 ctfmon.exe Title:                              900 ISATRAY.EXE Title: IsaTray                              1344 NAVAPW32.EXE Title: Norton AntiVirus Auto-Protect                              1212 FRONTPG.EXE Title: Microsoft FrontPage - D:\asp                               www.ntfaq.com\NTFAQ\5apr2001.htm                              428 NAVAPSVC.EXE Svcs: NAV Auto-Protect                              1376 ALERTSVC.EXE Svcs: NAV Alert                              1372 PowerDVD.exe Title: PowerDVD                              444 OUTLOOK.EXE Title: Tasks - Microsoft Outlook                              1268 msmsgs.exe Title:                              1436 MDM.EXE Title: OleMainThreadWndName                              632 WINWORD.EXE Title: DDE Server Window                              1404 IEXPLORE.EXE Title: Q250320 - Description of Svchost.exe -                               Microsoft Internet Explorer                              1348 cmd.exe Title: E:\WINDOWS\System32\cmd.exe - tlist -s                              1428 tlist.exe                              

Many services, drivers, and modules load at system startup and are essential to system operation. Even though they show up in Task Manager, they're still critical.

The svchosts are defined in the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost.