Svchost.exe

Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concern to NT designers because creating Windows processes takes more time and consumes more memory than in other operating systems, e.g. in the Unix family. However, if one of the services causes an unhandled exception, the entire process may crash. In addition, identifying component services can be more difficult for end users. Problems with various hosted services, particularly with Windows Update, get reported by users (and headlined by the press) as involving svchost. The svchost process was introduced in Windows 2000, although the underlying support for shared service processes has existed since Windows NT 3.1. Its executable image, %SystemRoot%\System32\Svchost.exe or %SystemRoot%\SysWOW64\Svchost.exe (for 32-bit services running on 64-bit systems) runs in multiple instances, each hosting one or more services. Services running in SvcHost are implemented as dynamically-linked libraries (DLLs). Each service's registry key must have a value named ServiceDll under the Parameters subkey, pointing to the respective service's DLL file.