Technical Zone

What is svchost.exe And Why Is It Running?

You are no doubt reading this article because you are wondering why on earth there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, and you don’t remember starting them… so what are they?

So What Is It?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.

So What Can I Do About It?

You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.

The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.

If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box:

Checking From the Command Line (Vista or XP Pro)

If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.

tasklist /SVC

The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.

Checking in Task Manager in Vista

You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.

This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:

The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don’t want it running.

Using Process Explorer in Vista or XP

You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.

Hovering your mouse over one of the processes will show you a popup list of all the services:

Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.

Disabling Services

Open up Services from the administrative tools section of Control Panel, or type services.msc into the start menu search or run box.

Find the service in the list that you’d like to disable, and either double-click on it or right-click and choose Properties.

Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.

You could also use the command prompt to disable the service if you choose. In this command “trkwks” is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you’ll notice you can find it there as well.

sc config trkwks start= disabled

Hopefully this helps somebody!

Cheers!!!!!

How to Faster Defragmentation in Windows XP

A simple way to speed up a defrag operation in Microsoft Windows XP is to restart the system before you launch the Defrag application. This allows the operating system to clear out the swap/paging file (may require a change in configuration for ultimate effect) and to reset it to the default size. This lets Defrag focus strictly on the necessary data on the hard disk, without having to stop and manage a huge swap file loaded with unneeded data.

Another approach to speeding up a defrag operation in Windows XP is to configure it to occur immediately upon startup. You can do so easily with a simple registry edit.

Note: Editing the Windows Registry is not without risk. Please save yourself some aggravation and back up your Windows Registry before you do any editing.

With the disclaimer out of the way, follow these steps to start a defrag operation immediately upon startup:

* Launch the Registry Editor (Regedit.exe)
* Go to:

HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\ CurrentVersion\RunOnce

* Right-click the RunOncesubkey and select New | String Value
* Name the value Defrag and press [Enter] twice
* Type Defrag.exe c: /f in the Value Data text box, and click OK
* Close the Registry Editor and restart Windows

The defrag operation will begin when you type in your password and press [Enter]. (Keep in mind that values added to the RunOnce key are removed immediately after the command has been run.)

=================================================

How to Recover Windows Vista Password

Please take note that this handy tip is intended to recover/regain a forgotten Vista Administrator password. It is not intended to illegally hacking into a Vista system that’s not owning by users who refer this guide!! It is also intended to inform Vista users about the method by which anyone can access their private accounts by cracking passwords….Thus anyone can hack into administrator account and bypass guest user restrictions…. Lets start… Steps to hack Windows Vista Administrator account password:

1. Reboot the
Windows Vista and boot up with
Windows Vista installation DVD. Crack
Windows Vista logon account password in minute with the
Windows Vista installation DVD. Click on the Repair Your Computer option, bring up Command Prompt to open Local Users and Groups management in MMC.

2. While the
Windows Vista installation interface pops up, click the Repair You Computer link at the bottom-left corner.

3. Next, the System Recovery Options dialog box appears. There are few options that related to repairing
Windows Vista, looks like Recovery Console in Windows XP:

Startup Repair options is used to automatically fix problems that are preventing
Windows Vista from starting.

System Restore to restore
Windows Vista setting to an earlier point in time.

Windows Complete PC Restore to restore
Windows Vista from a full system backup.

Windows Memory Diagnostic Tool could be the first Microsoft memory tester toolkit that bundled with Windows setup media.

Command Prompt is the target
option of this Vista hacking guide. Click on this
option now.

4. In the
Windows Vista Command Prompt, type mmc.exe and press ENTER key to bring up the Microsoft Management Console.

5. Click on the File menu, select Add / Remove Snap-in
option, locate and select the Local Users and Groups on the left panel, and click Add button to add it to the right panel.

6. Now, the Choose Target Machine dialog box pop up. Keep the default setting by clicking the Finish button – that means using the Local Users and Groups snap-in to manage this local computer, and not another computer in network.

7. Click OK button and return to MMC windows . Under the Root Console in left panel, double-click Local Users and Group that was added earlier. Click on User folder, locate and right-click the target Vista logon account that found in the right panel.

Select the Set Password from the right-click menu to set a new password / reset old password.

================================================================================
Registry editing disable by administrator

Go to Run –> gpedit.msc
In the left hand menu, go to User Config –> Administrative Templated –> System.
Now In the right hand pane, select “Prevent access to registry editing tools”. It will probably be not configured or enabled. If it’s enabled, disable it and if it’s not configured, first enable it, apply settings and then disable it. Most probably the settings have been applied instantly. If not, then run gpupdate in command prompt to apply the group policies

I got this tweak while surfing the internet. Go to Start –> Run, copy and paste the follow in the Run box and press OK.

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

The effects are usually instant. If not then you should see the results after restarting your computer.

Good Luck