What is Service Host process (svchost.exe) and why is it running so many times?

In case you are a regular Windows user, you are very likely to have spotted the task manager in your system. The task manager provides information about the computer’s performance, the running programs and processes. The most easiest way to launch the task manager is by simultaneous pressing of the buttons Ctrl+Shift+Esc.

This article is a part of our Windows explanatory series which explains different process found in Task manager like dwm.exe, dllhost.exe, rundll32.exe, Windows Modules Installer worker and more.

Now there are two tabs in the task manager that might have catch your notice – Process and Service tabs.

A windows service is a program that runs in the background while a process in simplest terms is an executing program and are shared by services.  Many a times there will be instances when a number of services will share a common process in order to reduce the resource consumption.

The designers of Windows NT operating system  came out with the idea of bundling various services into one single process to reduce computing resource consumption.

The Build up for svchost.exe

The designers of Windows NT (new technology) operating system had to take particular concern regarding for time and memory consumption while creating a process as compared to other operating systems like the UNIX family. Moreover, there were issues with the entire process getting crashed if any one service reports an exception.

This esoteric problem had been reported by the users of the operating system who faced issues while updating the OS along with other hosted services. This lead to the introduction of Service Host process (svchost) in the Windows 2000 version of the operating system.

What is Service Host process (svchost.exe) ?

File Name	svchost.exe
File Size	Variable sizes
Description	It is a generic host process for services that run from dynamic link
Location	C:\Windows\System32
Is it a virus	No. But, It can be disguised as a virus
Can be disabled	Yes. Recommended not to disable it

You might have noticed that, at times, a number of copies of svchost.exe is running in your system. Now the question is what exactly are these svchost.exe? You are likely to not decipher why these processes are running.

To make a straight confirmation, this is completely normal i.e too many copies of svchost.exe running at the same time is not an issue for your system.

To explain in one sentence , svchost.exe is being used by Windows to encapsulate other essential components of the operating system. And hence, you definitely don’t want to get rid of these files cause it could make Windows not to work properly without any one of them.

Svchost.exe can be termed as a generic host process for services that run from dynamic link libraries like rundll32.exe. The default location of svchost.exe is C:Windows/System32 .

If you are not familiar with dynamic link libraries,they are also known as the .dll files. These files are just a  big block of programming code which cannot load by itself and needs an executable file to load the codes it contains. The .dll files are getting more prominence in Windows ecosystem due to Microsoft change in approach of relying on using DLL files instead of internal Windows services.

However, the problem with these files is that they can’t be launched directly the same way an executable file is launched. Instead these files are hosted using a shell that is loaded from an executable file. This in other words is the service host process, also known as svchost.exe.

Applications hosted by Svchost

A simple command prompt can help you find the applications svchost is handling. To do that simply run the command tasklist /svc in the command prompt to get the list of the processes or applications handled by a single service host.

tasklist /SVC /FO TABLE /FI "IMAGENAME eq svchost.exe

It shows you all the services assigned to each svchost.exe process. The PID column in the middle stands for Process Identifier and is basically the unique name for each svchost.exe process.  So you can slap open the Task Manager, click the Services tab and then sort all services by the PID column.

Is svchost.exe a virus or trojan?

Svchost.exe is not at all a virus or trojan, but since it is a common program in Task Manager, there might be some malware programs which may infect this file by disguising itself as svchost.exe services. If you think your system is infected by virus that is causing problems with this services, then you might think to update your antivirus programme. However, if the antivirus program detects no such issues, your system is working good and the svchost.exe file in this case is not a virus.  

How to detect a svchost.exe virus?

As mentioned earlier, an svchost.exe is not necessarily a virus. It is infact a most important component of Windows, and Windows cannot function properly without this file. However, these are certain malwares and viruses which disguise as a svchost service and infect the computer system. If such infection happens, you might need to scan your computer. On completion of the scan if there is no suspections, the svchost.exe is fine.

However to be more precisely confirmed, you should check the location of each svchost.exe files. It should be kept in mind that the actual svchost.exe file resides in the c:\windows\system32 folder whereas the svchost.exe virus resides in c:/windows/temp folder.  

How to fix High CPU Usage of svchost.exe

High CPU usages by svchost.exe can be caused due to virus or malicious programs. You need to uninstall certain services or remove the malicious programs to fix it. The following steps can be followed to fix the high cpu usage:

1) Open the task manager.

2) Go to the details tab and right click on the svchost.exe service that is using high CPU usage, then click on Go to service(s).

3) This will take you to a window that highlights the services that run under svchost.exe process.

4) Now right click on one of the processes and click on “Stop” to stop it.

5) If you cannot find the faulty process until now, repeat the steps . if the faulty process is found, click on the “Open Services” button. This will take you to the services window. Locate the service. For example, we are using Windows Update service. Now right click on Windows Update service and click on properties.

6) Change the Startup Type to Disable, then click OK and restart your computer.

The above steps will assist you to get rid of any malicious programs that intrudes into the system and disguise as svchost.exe services.

FAQs

Conclusion

Finally, to conclude let me put gist of the entire discussion:

1. Svchost.exe is not a virus if it is living in the folder C:\Windows\System32.
2. It functions as a container for services that are logically relative.
3. Svchost.exe file is used by windows to host the dynamic linked libraries
4. You need not bother about the multiple svchost services running in your system.

If you’re having any issues in your system due to errors related to svchost.exe, this article must have served as a resourceful guide. We have tried to cover in depth about the topic, with visual backings.