Runaway SVCHOST.EXE

If you're familiar with Windows Services, you know that they don't execute under their own name, but rather under a process which appears in the Taskmanager as svchost.exe.

From time to time you'll notice on that a svchost.exe process is consuming large amounts of processing time, memory etc and you may want to find out exactly which service is the culprit.

To do this, we need to pull up a command prompt, and use the command "tasklist" with some additional arguments.

Executing the command "tasklist" will give you a command prompt view of essentially what you see in the Task Manager Gui, with some additional information (namely the PID number).  Note the process identification number of the svchost.exe instance that you are interested in:

Now run the command again, with the /svc argument:

With this view, we can see exactly which services are running behind a certain PID.  So for example if PID 380 was consuming alot of resources, I could conclude that one of the services behind that process was the cause and then go investigating the individual services to see which was is causing the trouble.