Using Task Manager to identify a process that’s taking more than its fair share of CPU or memory resources is a start, but what happens when you can’t identify the specific process causing the problem? That’s likely to occur if a system service starts to spin out of control. In that case, you’ll see the excess resources attributed to a generic process (usually Svchost.exe), with no indication of which service is actually responsible.
Service Host (Svchost.exe) is a core piece of Windows XP code that collects a number of lower-level system-critical services and runs them in a common environment. By gathering multiple functions together, this arrangement reduces boot time and system overhead and eliminates the need to run dozens of separate low-level services.
Because different groups of services have different requirements in terms of system access and security, Windows XP creates a number of different groups. To see a list of which services are associated with each Svchost instance, click Start, click Run, type cmd in the Open box, and press Enter. In the Command Prompt window, type tasklist /svc /fi “imagename eq svchost.exe” (including the quotation marks).
(Note that the Tasklist command is only available with Windows XP Professional. If you have XP Home Edition, you can download the file from here.)
After you gather the names of services running in the context of a Svchost instance, you can do further research to see which one is causing your performance problem.
For more details on how to use the Tasklist command, type tasklist /? at a command prompt.
Ed Bott 
Your blog is very interesting and informative. I look forward to reading your blog every day.
The funny thing is that right now Ed’s blog is on autopilot, posting a tip per day for the next two or three weeks while Ed is in Italy on vacation. The blog is even better when Ed is “in the house.”
Ken
Has anyone else gotten the following error after using this command – tasklist /svc /fi imagename eq svchost.exe
ERROR: Invalid Argument/Option – ‘eq’.
Type “TASKLIST /?” for usage.
I am using XP Pro.
Gerry, I have received that message before. I was able to resolve it by (I think) disabling the Laplink service. It was an odd error, though.
I get that error message when I copy the command from the web text above and paste it at the cmd prompt, but when I type it manually, no error. Try typing ‘tasklist /svc’ (without quotes) first to verify, then add the /fi option.
the copied dbl qoutes get fooed because the double qoutes are the fancy open, and fancy close dbl qoute chars , not the open-or-close straight dbl qout char ” see an html entity table of char.
i have a process that tasklist cant find. i used ‘fport’ (a utility i got from download.com) to identify which processes are using which ports (using their PID). however, it lists one process which does not appear in Task Manager and does not appear using tasklist. what could be going on?
I tryed this but I got an error, even with “tasklist /?” :
“ERROR: interface not registered” (translated from italian “ERRORE: interfaccia non registrata”).
When I press CTRL +ALT +DEL I only get The Green icon in the task bar
How dfo I change that?
I’m having a problem using TASKLIST… It worked before and now I get ERROR: Not found.
I have numerous machines that require TASKLIST to work as my scripts verify if the application is running before it starts it again.
Any thoughts?
i want to use this tasklist to know that a process is running or not. let us say java.exe is the process. how can i do this. my exact req’t is to get true if process is running otherwise false. can i?