What is svchost.exe
Svchost.exe is being used by Windows to encapsulate other essential components of the operating system. Svchost.exe can be termed as a generic host process for services that run from dynamic link libraries like rundll32.exe.
In case you are a regular Windows user, you are very likely to have spotted the task manager in your system. The task manager provides information about the computer’s performance, the running programs and processes. The most easiest way to launch the task manager is by simultaneous pressing of the buttons Ctrl+Shift+Esc.
This article is a part of our Windows explanatory series which explains different process found in Task manager like dwm.exe, dllhost.exe, rundll32.exe, Windows Modules Installer worker and more.
Now there are two tabs in the task manager that might have catch your notice – Process and Service tabs.
A windows service is a program that runs in the background while a process in simplest terms is an executing program and are shared by services. Many a times there will be instances when a number of services will share a common process in order to reduce the resource consumption.
The designers of Windows NT operating system came out with the idea of bundling various services into one single process to reduce computing resource consumption.
The Build up for svchost.exe
The designers of Windows NT (new technology) operating system had to take particular concern regarding for time and memory consumption while creating a process as compared to other operating systems like the UNIX family. Moreover, there were issues with the entire process getting crashed if any one service reports an exception.
This esoteric problem had been reported by the users of the operating system who faced issues while updating the OS along with other hosted services. This lead to the introduction of Service Host process (svchost) in the Windows 2000 version of the operating system.
What is Service Host process (svchost.exe) ?
| File Name | svchost.exe |
| File Size | Variable sizes |
| Description | It is a generic host process for services that run from dynamic link |
| Location | C:\Windows\System32 |
| Is it a virus | No. But, It can be disguised as a virus |
| Can be disabled | Yes. Recommended not to disable it |
You might have noticed that, at times, a number of copies of svchost.exe is running in your system. Now the question is what exactly are these svchost.exe? You are likely to not decipher why these processes are running.
To make a straight confirmation, this is completely normal i.e too many copies of svchost.exe running at the same time is not an issue for your system.
To explain in one sentence , svchost.exe is being used by Windows to encapsulate other essential components of the operating system. And hence, you definitely don’t want to get rid of these files cause it could make Windows not to work properly without any one of them.
Svchost.exe can be termed as a generic host process for services that run from dynamic link libraries like rundll32.exe. The default location of svchost.exe is C:Windows/System32 .
If you are not familiar with dynamic link libraries,they are also known as the .dll files. These files are just a big block of programming code which cannot load by itself and needs an executable file to load the codes it contains. The .dll files are getting more prominence in Windows ecosystem due to Microsoft change in approach of relying on using DLL files instead of internal Windows services.
However, the problem with these files is that they can’t be launched directly the same way an executable file is launched. Instead these files are hosted using a shell that is loaded from an executable file. This in other words is the service host process, also known as svchost.exe.
Applications hosted by Svchost
A simple command prompt can help you find the applications svchost is handling. To do that simply run the command tasklist /svc in the command prompt to get the list of the processes or applications handled by a single service host.
tasklist /SVC /FO TABLE /FI "IMAGENAME eq svchost.exe
It shows you all the services assigned to each svchost.exe process. The PID column in the middle stands for Process Identifier and is basically the unique name for each svchost.exe process. So you can slap open the Task Manager, click the Services tab and then sort all services by the PID column.
Is svchost.exe a virus or trojan?
Svchost.exe is not at all a virus or trojan, but since it is a common program in Task Manager, there might be some malware programs which may infect this file by disguising itself as svchost.exe services. If you think your system is infected by virus that is causing problems with this services, then you might think to update your antivirus programme. However, if the antivirus program detects no such issues, your system is working good and the svchost.exe file in this case is not a virus.
How to detect a svchost.exe virus?
As mentioned earlier, an svchost.exe is not necessarily a virus. It is infact a most important component of Windows, and Windows cannot function properly without this file. However, these are certain malwares and viruses which disguise as a svchost service and infect the computer system. If such infection happens, you might need to scan your computer. On completion of the scan if there is no suspections, the svchost.exe is fine.
However to be more precisely confirmed, you should check the location of each svchost.exe files. It should be kept in mind that the actual svchost.exe file resides in the c:\windows\system32 folder whereas the svchost.exe virus resides in c:/windows/temp folder.
How to fix High CPU Usage of svchost.exe
High CPU usages by svchost.exe can be caused due to virus or malicious programs. You need to uninstall certain services or remove the malicious programs to fix it. The following steps can be followed to fix the high cpu usage:
1) Open the task manager.
2) Go to the details tab and right click on the svchost.exe service that is using high CPU usage, then click on Go to service(s).
3) This will take you to a window that highlights the services that run under svchost.exe process.
4) Now right click on one of the processes and click on “Stop” to stop it.
5) If you cannot find the faulty process until now, repeat the steps . if the faulty process is found, click on the “Open Services” button. This will take you to the services window. Locate the service. For example, we are using Windows Update service. Now right click on Windows Update service and click on properties.
6) Change the Startup Type to Disable, then click OK and restart your computer.
The above steps will assist you to get rid of any malicious programs that intrudes into the system and disguise as svchost.exe services.
FAQs
1. Why there are so many service host process running in the system?
You might notice that Windows require a lots of services for proper functioning of the operating system. If all the services are bundled under one service host, there may be instances when failure of one single service may lead to malfunction of the entire system. That is why services are categorized into logical groups where each services are logically relative to each other. These individual groups are hosted by a single service host. That is the reason why you can find a number of service hosts running in your system.
2. Where is the svchost.exe file located?
This file is located in either the c:\windows\system32 or c:\winnt\system32 directories depending on your version of Windows.
3. Should I remove svchost.exe?
The svchost.exe file is an essential file of Windows and is needed by the operating system to function properly. Removing the file would cause the operating system to malfunction and hence it is recommended not to remove this file.
4. Is it unusual to have multiple svchost.exe files running in my system?
Absolutely NOT. The Windows system may require several instances of svchost.exe depending upon the number of processes that is sharing the service. At any instant of time, the OS may need to access the memory and also has to communicate through the drivers. Based upon the numbers of different related processes running on the system, there will be different svchost.exe services running simultaneously.
5. DRAWBACKS OF svchost.exe file
Though service process hosts reduce the use of resources in the system, it is not devoid of any drawbacks. To mention about the main drawback of this shared process is that if any of the services running in these shared processes raises an exception, it is likely that the entire process will shut down or crash. Moreover, it may also cause subsequent errors due to the services no longer running in the shared process. Besides this, a malware or virus may at times inject its services in an already running svchost service.
Conclusion
Finally, to conclude let me put gist of the entire discussion:
- Svchost.exe is not a virus if it is living in the folder C:\Windows\System32.
- It functions as a container for services that are logically relative.
- Svchost.exe file is used by windows to host the dynamic linked libraries
- You need not bother about the multiple svchost services running in your system.
If you’re having any issues in your system due to errors related to svchost.exe, this article must have served as a resourceful guide. We have tried to cover in depth about the topic, with visual backings.
