svchost.exe questions...

[Boomer]

 Ok fellow geeks, I have a question. This one is probably easy for most of you however, it has always bugged me not knowing.
 
 WHY. Why do I have 8 svchost.exe running in the task manager?
 
  One of them is obvious, I assume it is when I am online. The others puzzle me. Are they each running in unison on the same connection? They must be?..
 
 Is it silly to assume they were created with each new connection? For instance, you move, you get new service say, switching from Cox hi speed cable to a DSL? I know the type of connection is irreleant but, do they remain active even though you no longer use that service or am I way off track?
 
 Are they running each type of service required to get online for updates etc.? Like, say the Adobe updates, the Win updates, Office and so on and so on??
 
 Is there a way I can disable them or must I have ALL of them running all the time???
 
 Silly question but I do not understand why so many...
 
 Thanks gang!! Hope I am in the right thread BV....

[Black Viper]

svchost.exe is just that: a "Service Host" for other processes.
Under normal circumstances, you can have 4 running at the least because the services that hide under svchost.exe each require different privileged accounts... local, network, system, and user.
Additional ones may be running for a number of reasons, drivers, software, system tray icons, etc.

[couttsj]

Okay, here's the technical explanation. Some services are compiled as executable files (.exe) and are loaded as services directly. Other services are compiled as library files (.dll) are require an executable to act as a container. For this purpose, Microsoft uses SvcHost.exe. There are advantages to both, which I won't get into here.

There can be several SvcHost's running, and each host can support several related services. To view these, go to the command prompt and enter C:\>tasklist /svc. You can see that each group of services managed under a single SvcHost.exe host has a single Process ID. Each library file exposes a number of different elements or handles which can be called upon using COM (Common Object Model), and in turn instanciates handles to a number of other library functions.

Why is it done this way? Memory is allocated dynamically using something called the System Heap. To find and use any of these functions, pointers are used that are relative to the Process ID. Using SvcHost allows several libraries to be managed using a single Process ID.

Hope that wasn't too heavy.

J.A. Coutts

[DJanda]

Hope that wasn't too heavy.

Nope -- just right.  Very informative and easy to follow.