Svchost.exe (Service Host) Using 100% CPU Resources in Windows – Identify Causing Services

Svchost.exe which stands for Service Host is a generic host process name for services that run from dynamic-link libraries (DLLs) on NT based Windows operating system such as Windows NT, Windows 2000, Windows Server 2003, Windows Server 2008 (R2), Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows Server 2012 (R2), Windows 10 and Windows Server 2016.

Each svchost.exe process session started can contains a group of services (that provides certain functions and features of Windows system, such as RPC Remote Procedure Call, Logical Disk Management and DHCP and etc.) in order to provide better control and easier debugging. The svchost.exe has always been the mystery for most users because many of such processes are ran at the same time, each using different amount CPU resource and memory usage.

Svchost.exe is known to be one of the main culprit the always led to various issues such as high or even 100% CPU usage, memory hogging, excessive laptop fan speed and wasting power usage. Svchost.exe itself won’t cause much damage or slow down computer response, as it’s just a ‘holder’ process for actual running services, and also malware, spywayre, adware Trojan or viruses which commonly hide behind the mask of svchost.exe, which consuming all the system resources. So when encountering a svchost.exe takes up 90% or even 100% CPU power continuously or using large amount of RAM memory, it’s useful to identify and find out what’s services that running behind a svchost.exe.

Note: Cannot see any svchost.exe in Windows? If your system is consistently hitting 100% usage but yet the total CPU usage added up from what you seen in Task Manager is much lesser (probably less than 50%), click on Show processes from all users button, and confirm the User Account Control dialog, if any. In Windows 10, click or tap on More details to expand the Task Manager. You will definitely see a lot of svchost.exe running, with probably one of them hogging high CPU resource.

When opening up Task Manager, there are plenty of svchost.exe instances and also data on running by who (System, Local Service, Network Service, etc.), however, that so much information you get about the svchost.exe session. Previously in Windows earlier than Windows Vista, users can use tasklist (for Windows XP or Windows Server 2003) or tlist (for Windows 2000) in Command Prompt to list out what is actually the services that are in charged by a particular svchost.exe based on the PID. Windows enhances this feature and makes lookup a little easier. Here’s how to identify the services behind a svchost.exe process.

1. Right click on a blank space on TaskBar and click on Task Manager to open up the Task Manager.
2. Click on Processes tab.
3. Click on Show processes from all users button.

   

   In Windows 10, you just need to expand Task Manager with “More details”.
4. Click Continue or Yes button when prompted with User Account Control dialog.
5. There will be a long list of svchost.exe shown in elevated Task Manager (In Windows 10 it’s listed as Service Host with description under “Windows Services” section).
6. Locate the svchost.exe or Service Host that you want to find out what’s the services running behind it, such as those with high CPU usage or high memory usage, right click on it, and choose Go to Service(s).

   

7. The focus tab will be switched and transferred over to the “Services” tab, with a few services been selected and highlighted. These are the services that are associated with the particular svchost.exe

   
8. Once identify the services that are possibly causing the svchost.exe to hogging system resources, carefully work out the services that you suspect may cause the issue. Once determined a suspected service, right click on it, and select Stop Service. Before you stopping any service, make sure that no other services rely on that particular services. You can click on Service… button to launch Services applet in Control Panel, and the see the properties of the service to view its dependencies. Also be warned that disabling any wrong service may destabilize Windows system.

The method to locate associated services for scvhost.exe in Windows above is already much more easier than non-Windows OS. However, if you still find the steps too troublesome, there is an even easier way. Download Process Explorer from Sysinternals (now belongs to part of Microsoft). No installation required. Just unpack and run procexp.exe, and then move and place mouse over on top of a svchost.exe process. A tooltip balloon message will pop up with information of all services running behind that svchost.exe.