What is svchost.exe And Why Is It Running?
You are no doubt reading this article because you are wondering why on earth there are nearly a dozen processes running with the name svchost.exe. You can't kill them, and you don't remember starting them… so what are they?
So What Is It?
According to Microsoft: "svchost.exe is a generic host process name for services that run from dynamic-link libraries". Could we have that in english please?
Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can't launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.
Why Are There So Many svchost.exes Running?
If you've ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.
So What Can I Do About It?
You can trim down unneeded services by disabling or stopping the services that don't absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.
The biggest problem is identifying what services are being run on a particular svchost.exe instance… we'll cover that below.
If you are curious what we're talking about, just open up Task Manager and check the "Show processes from all users" box:
Checking From the Command Line (Vista or XP Pro)
If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.
tasklist /SVC
The problem with using the command line method is that you don't necessarily know what these cryptic names refer to.
Checking in Task Manager in Vista
You can right-click on a particular svchost.exe process, and then choose the "Go to Service" option.
This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:
The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don't want it running.
Using Process Explorer in Vista or XP
You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.
Hovering your mouse over one of the processes will show you a popup list of all the services:
Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.
Disabling Services
Open up Services from the administrative tools section of Control Panel, or type services.msc into the start menu search or run box.
Find the service in the list that you'd like to disable, and either double-click on it or right-click and choose Properties.
Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.
You could also use the command prompt to disable the service if you choose. In this command "trkwks" is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you'll notice you can find it there as well.
sc config trkwks start= disabled
Hopefully this helps somebody!
I always wondered what this was and why so many were running. Thanks very much for the clear and excellent explanation!
Thanks for this! Like Rich said above, I've always wondered too!
Is there anywhere to get a list of the "common" windows processes that shouldn't be shut off; ie core windows services? That would help with making sure the mistakes are kept to a small minimum…
Much thanks!
Jon,
I'm working on building a guide to all the windows services, but I'm not done yet. (lots of work involved).
In the meantime, you should check out Black Viper's guide, which is really top notch: http://www.blackviper.com/WinVista/servicecfg.htm
You should note that there's no "perfect" configuration for everybody… depending on what applications you are running you may or may not need a certain service.
Thanks again for the quick response! I totally agree with you with the "one config to bind them all" scenario never happening {no matter how much some might want it!
}
I will check the Black Viper guide when I get home tonight!
Cheers,
Jon
This is very useful and helpful. Thank you Geek for taking the time to put it together. WHS
Thanks for this excellent guide, it is hands down the best explanation of these svchost.exe processes I've read anywhere (I don't know why everyone always feels the need to be so cryptic about everything). Clear, concise, perfect. Thanks!
Thank you for this simple explanation. I work with .dll and .exe programs daily but am new to the field. This not only cleared things up for windows but explains why the programs I create need a .dll file to run.
Excellent information on svchost.exe. This simple, clear explanation clears all my doubts regarding svchost.exe. Thank u very much.
What command are we supposed to enter in win2k?
tasklist /svc gives an message "'tasklist' is not recognized as an internal or external command,
operable program or batch file.".
Thanks for the tips. I'm wondering what is this before.
Thank you so much for this awesome guide. Really very useful.
I would like to add one thing! If the service name is "scvhost.exe" then its a virus. Also if Username of "svchost.exe" service entry is other than "System", "Local Service" and "Network Service", then its a virus.
I'll wait for your service guide.
THanks for the info! It's really nice! I wondering how to do it in Windows XP. I can't ge the "go to services" menu on right click, can you guide it on XP ?
Thanks for the post. I have stopped most of the unwanted services for the time being.
Best,
Lawk Salih
You answered the question I was tired of asking around and eventually forgot about it. If I have any more question about computers, i'll know where to come first next time.
Thanks!
Thanks.
All the info contained in this article was konown to me, it is the combination you propose that is valueable!
Great article Jon! I've always wondered what all those svchost.exe's were.
Excellent, Thanks for explaining this!
Great article
very easy to understand
Thank you for the great explanation of something I have always wondered about.
tasklist is not included with XP home, only XP Pro
And how do I go ahead doing this for non vista and non XP systems?
Thanks alot for this info, I have always wondered what svc processes are up to. @peter, thanks for the links…
This only works in Pro, you should indicate that. Most people that need this article will be running Home so its pretty irrelevant. Nice try though
quite good post…but i think disabling services related to svchost.exe could prove a loss in some functionality…but its ok if someone knows about the service completely before disabling.
Great article. Thanks!
Ahhhhh thanks for this complete and easy to understand explanation.
I guess I can have some sleep finally!
Thank you very much for the explanation.
Finally a good night sleep for us all!
Kudos
-You've given a better explanation than searching on google a week could!
gosh, thanks for the info. At last , I know what is svchost all about.
I always tweak my services sometime even crash my laptop.
what would be the must turn off service for vista?
Thank you for this!
Very informative. Thank you for all that you do.
Great article. I use another free program to do this on windows. It allows me to do service profiles…so I can switch from my developer profile to my gamer profile. Instantly clearing up resources. Even gives a graphical view of the services and their memory footprint.
It amazing the kinds of crappy services you find on your system. Ipod service.. wth I don't even have an ipod. Google Toolbar service - runs even when IE isnt open. Adobe Updater… the thing doesnt update until you open one of their apps anyway. I could go on… just check out the program. Its wicked.
Service Studio
www.mindswarm.com
Thanks to Dan for telling me about it.
Wow!, It's a great article. This site rocks man! I was always wondering what is this service all about but never actully try to dig it more.
Thanks for sharing.
I have answer to that…..its called LINUX and it has penguin on the cover.
tasklist /SVC | more
show all list
Great article
awesome.
What happens if you just have a regular home edition of XP.. I tried doing the cmd prompt with Tasklist/svc but it didn't work.
To Dave: tasklist /svc works only with XP pro…….
Hi good evening..
I need Help.. theres a problem in my PC when I restart my computer I doesn’t restart..or it wont execute when I click “restart� and I just restart it manually……some of my friends told me its because of the Virus called “svchost.exe� does it possible…..can this be true….plssss Help me…
Great article, thanks!
Thanks a lot for the information.
why would I always have multiple msexe.exe running in my Task Manager on my XP home edition? Whenever I want to install a new program or uninstall a program I get an error message that another install is in progress. I have to shut off all instances of the msexe.exe then quickly hit the run (install) before they start baack up..What is up with that? I had AVG. now switched to NortonAV and I have a Spyware detector and Registry cleaner and I still have the same problem. Any advice?
Thank You!
Chris
Awesome explaination on the svchost.exe
very nice info bro. This is the real thing newbies should know.
very detailed.
keep it up. i m blogging it.
Parth.
Thanks, well explained info.
thank you for wour always excellent info, from Spain.
I sugest one topic: how it works, and how to reduce the amount of memory that consumes "iexplore.exe" ( in my case 56.956 K)
Thanks again
hi
i am wondering if there is a guide on how to settle this problem for pc running on XP? thanks
This was exactly what I was looking for. Thanks.
Good stuff……
Thanks for the info! The only problem that I had (I'm not totally computer illiterate but I'm not a programmer), and this sounds stupid, but when you check the "show processes for all users box", what do you do then? I clicked the box and then nothing happened, the box was just checked. Sorry if this is a dumb question.
Hey Guys really gr8 info about SVCHOST.EXE.
Peter thanks for the link provided..
great job. Thanks a lot for the usefull and well-arranged informations.
Fantastic INFO! Thank you!
Great Article Jon!!! You really made all of us to tacit "svchost.exe� in a very proficient mode.
I have XP Home and tasklist /svc gives a message "'tasklist' is not recognized as an internal or external command,
operable program or batch file.".
I had a few of svchost.exe running under user "SYSTEM". But then i had 2 svchost.exe running under my user name which is audi, i knew this was something else because its under my user name and not under the system's and in additional i was trying to find the source of web blocking program whiched blocked me from entering some web sites such as youtube.com, it even blocked me off from using firefox and not to mention disabling the function to see hidden files.. So i searched for svchost.exe using the search tool in the "start", and i find its location here: C:\Documents and Settings\Audi\Local Settings\Temp\MicrosoftPowerPoint.
it mention something like "autohotkey" and its icon is a "H" letter in a green box.
This confirms me that its some kinda bug. I've erased it completely, but it still shows up everytime i turn on my pc, tryied tracing it again and showed no results. Its useless trying to use anti-spyware/addware or even an anti virus. Its a bug in disguise under the name of svchost.exe to prevent detection. So how can i get this program/thing off my pc for good? any idea people? tq.
I don't have any svchosts running, I think its stopping my "windows update" from working.
Amazing! I have 13 svchost programs running at the moment. I know that some viruses pretend to be svchost, but I didn't know how to check what each of the svchost programs were doing. You have helped me a lot. Thanks!
Another great tool for examining what is happening under Windows is What's Running?. It's free and available here: http://www.whatsrunning.net
thanks to whoever wrote this article… it helped me gain a lot of info bout svchost…. i thought it was a virus…
How can I thank you ?
God bless you.
Great, well written article - Thanks!
the explanation is so critically important. Millions of thanks!
svchost essential for Windows. Had the 100% CPU problem after having unintentionally left my firewall off. Fixed the whole problem by 1) activating Firewall, running full virus scan 2) cleaning out all unecessary files, 3) download Windows Service Pack 2, KB 884020, Windows Security update for XP KB941644, and Windows Defender, 4) ran a scan with Windows Defender, 5) wiping hard drive with Ace Utilities (other programs do this), 6) Dowloaded CCleaner from CCleaner.com (free software), 7) and then defrag. CPU is normal. Tip turn off realtime for Windows Defender and run scan once a week
Thanks to you and now thanks to HP. That's some good geeking!
KO
Great article. Thanks!
So thats what it is!!! Sweet!! Thanks for the info!!
Excellent description — thanks! I had been killing off one of these that was hogging the CPU — and feeling that I was "living dangerously". Now I can go back and find out what is actually happening behind the scenes.
Yep brilliant sorts it all out for me! thanks mate
@diya
What command are we supposed to enter in win2k?
@Pavan
And how do I go ahead doing this for non vista and non XP systems?
tasklist /SVC is tlist -s in Windows 2000 Pro. You already have it in the support folder on your Windows 2000 disc. For more information,
http://support.microsoft.com/kb/250320
For help, tlist /? works as expected. I extracted tlist.exe to \WINNT\system32.
Will leave it to The Geek to tell us if it's completely identical in function, or just very close …
Brilliant - thank you.
You should write manuals for Microsoft !
B
I'm still having a bit of trouble, What do you do if you don't have the ability to look at the services list, and right-clicking doesn't bring up the same capabilities?
@Brady
You would have to tell us, first, what operating system are you using?
Clear and concise…great job The Geek! Finally an article in English (not it Cryptic) about this…
That was a real help man. thanx
awesome article
Godbless u
You guys r rocking. Once again geek's team has prooved that each one of you is making sure to raise computer literacy across the world by providing such an informative article. Keep up the good work
On Jan 25th this was posted:
Peter
Thank you so much for this awesome guide. Really very useful.
I would like to add one thing! If the service name is "scvhost.exe" then its a virus. Also if Username of "svchost.exe" service entry is other than "System", "Local Service" and "Network Service", then its a virus.
I'll wait for your service guide.
My comment:
Is any of the above correct?
@Bill Snow
Often viruses and spyware will disguise themselves as legitimate services by either using the same name, or similar names with spelling errors. You should run a scan to be sure.
Thanks for the quick response. I have run several spy ware and virus scans that show none but I have svchost.exe that run at startup as well as random times during the day that essentially prevent me from working.
Can you give me instructions as to how to find out what these are doing and who started them. It has been suggested that they may be a Trojan or spy ware or worse. Some use Hugh memory and 100% CPU for 3 to 10 minutes. others run for hours.
Bill Snow:
Try using Malwarebytes' Anti-Malware program. It is recommended by C|Net and free. It cleaned up quite a bit on my computer. My son had accidently downloaded the Trojan.Vundo.
I just want to say thanks for having this sight! I have printed out what the instructions for what I needed and it is truly easy to understand. Just want to say THANK YOU. Nothing in life is free when they advertise it on line, but yours is free and more helpfull without wanting more of my money. THANKS GOD BLESS
Thanks for the info!
Great advice Geek. I bet most of us at some time or another have wondered what these processes are,
It's great to have advice in plain english
You should write a book I'd but it.
Thanks for the info…there's alot of misinformation out there on the scvhost.exe issue
Hey Geek … Do you have any resources you could recommend to understand which systems are mandatory and which ones are optional?
Thanks for your time
I've just installed some security software, scvhost keeps coming up and requesting I block it, is this normal? Does it cause a problem if I click yes to block? I'm no way technical - so I haven't a clue, I only installed it to search for spyware - is this part of it??
Mindboggling. Great stuff: Will make the beginner think they might actually understand some of it one day!
Thanks bro, it is vey useful informatin for me
Thanks for a great explanation. svchost mystery finally explained!
Thank you
I'm really impressed. Even though I knew about these stuff before, I never expect someone to demonstrate the whole process with us end-users in mind. Many thanks!
very clear & concise explaination of svchost.exe … I have reduced mine down to 3 in Windows XP PRO and thanks to this article I know which services these 3 svchosts are running, thanks!
Too good explaination.
I was wondering for so long and now i know the answer.
Thanks for such a great explanation. The way you explain is really great.
Windows offers "tons" of services, many of which the average user doesn't
need. What services can safely be disabled and not inhibit the PC from
functioning for basic usage and internet connectivity? Is there a better description of what each service performs beyond what Windows provides?
that helps a lot. do you recommend any specific services to shut down?
Timely info (since one instance of svchost was using 99% of CPU).
Am running Windows XP SP2 and do not see the "Services" tab on
Task Manager. Instead, will install Process Explorer use it the
next time svchost starts hogging CPU. Many, Many Thanks for this!
Excellent explanation! I too was curious about the multiple instances running when my AutoCAD application stopped running.
thumbs up!!
it helped me
thank you for making that tech talk simple for us lowly computer uses.
this instructions are very simple, easy to understand.
the only problem is that my task manager does not have the same tabs as the example.
my system does not have the services tab. HELP!!!!!!
as we say in hawaii, MAHALO (THANK YOU)!!
Don't disable services using Task Manager,
In VISTA click the start button, type "services.msc" in the search box without quotes, and hit enter, this opens the services window.
In XP click the start button, click the run button, type "services.msc" in the run box without quotes, and hit enter, does the same thing.
In the services window double click on the service you want to enable or disable, and you better know what your doing because you can make Windows un-bootable if you disable the wrong service!
Wow, that's lots of super helpful info,
thanks a lot
i always wondered what are those processes and today i know what are they
i sometimes thought of terminating those processes but….couldnt do it….
thanks alot
Very informative. Thank you for all that you do
thanks for a good explanation
Thanks so much for the write-up. It tipped me off to use Process Explorer utility and troubleshoot HP's printer service which was hogging 50% of my cpu performance. Now the temperature of my laptop is dropping, the fan is getting quieter and the constricted blood vessels in my head are starting to release… ahhhhh
Excellent information - thank you very much.
Thanks, I always wondered about that. The confusing thing is that there can be multiple copies running at the same time. Now I understand why.
This was a remarkably clear and concise description. Well done
I don't often leave comments, but your explanation went a long way in explaining this to me. Thanks a lot!!
How can I tell what services too end? I dont want to end one thats imprtant.
The one service you should leave completely alone is "Remote Procedure Call (RPC)" if you disable this service it could make your machine unbootable. Leave it on automatic always.
Other services can be disabled but you need to know what your doing, some services are interdependent so disabling one service may actually disable others at the same time.
For the low down on what is safe to disable see Black Viper's recommendations … you could start by using his "safe" settings.
for Windows XP SP3
http://www.blackviper.com/WinXP/servicecfg.htm
for Windows VISTA SP1
http://www.blackviper.com/WinVista/servicecfg.htm
fantastic, i was always wondering about svchosts.Now i m cleared.
!!thanx!!
Thanks. I've notice quite a few Malware programs create this process.
Thanks this helped me alot. My cpu was pegged at 99% thanks to this I was able to identify it and shut it down.
Very helpful article! I'm often mystified by the things I see in the Task Manager — including the ever-present svchost entries. This article not only explained the svchost process; it provided additional resources (both GUI and CLI) that greatly aid in understanding what my PC is doing under the hood. Thank you so much for the great info! (And keep writing!!)
Sincerely,
Aphobos
I hope this helps those that have a different OS but to see the services tab and all running you can go to start menu, click on run and type msconfig and there you can make changes and see everything this topic is about..
Done well, thanks for the article!
One of the most impressive articles I have ever come across.
Thanks a million.
Great article, helps a lot. Can anyone tell me why when I boot up one of my Svchost.exe files is using around 95% of my CPU?
I have a gateway mx3417. I started to use T mobile gc89 air card with a duel-systemsadapters The system was slow. windows would time out often then warning screen would appear. and basicalllly crash the laptop. I have origional recovery disk. I want to reformat entire hard drive. and start from fresh but it wont work
Well done. This was a lot of help for me as far as a starting point. Keep up the good work.
Liam,
Go to http://www.howtogeek.com/howto.....t-running/ and read the whole section and then download "Process Explorer". Process explorer will show you which Srvhost is doing the hogging Then mousing over that process will reveal what it it running.
Good explanation on the details, really helped us a lot!
Really very nice article.. please provide exact doc for xp.
OMG i finally understand why they run now.. i got so worried because they used up banwidth that i was about to terminate them with out knowing what they do..FEW…u saved me
Thankyou soo much…. I was wondering abt this svchost.exe and now I got the right answer. I saw that my bandwidth is being used for something else and just googled and found your site… it is really useful yaar…
Thanks
Thanks a lot to your mother who have given birth you, intellignet one!!
really, thanks for making things clear and for providing a very helpful explanation. now i will not have to ahh mmmm ?????? when somebody asks me about it.
very good explanation, thnk you!!!
Thanks a lot for your help.
With your help I managed to cancel the service that used over 80% of my CPU for the past few weeks.
Why disable this and that in Windows, isn't "excessive disabling of processes" another name for not being able to afford sufficient resources (RAM, CPU, HDD, etc.) to run this O/S? Windows is how it is - period! I understand a lot of users are mad and misguided about the way Microsoft develops software but let's face it…you all want it. Yeah it's designed for more than what you'll probably need but I call that forward thinking. Better to be safe than sorry, especially for those who are not technically inclined. And for those who are…switch to an open source O/S and quit complaining; also, stop trying to force Microsoft to be what YOU think it should be. Why don't you buy a MAC if you want bare basic stability? I'm no Microsoft groupie or fan-boy but let's grow up a little here.
Thank you so much for making it so clear!
Cheers man! Great stuff!
nice find…………… thanks
Hi, How-to Geek;
You did an OUTSTANDING job explaining the process…!!!
Keep up the good work.
Cheers…
Fantastic article. I always saw svchost.exe and knew it was related to DLLs but never knew about Windows' "Go to Service(s)" feature. Thanks for the great info!
Thanks for clearing this up for me. Although, I have an antivirus/Firewall program called ZoneAlarm. I get alerts to let SvcHost.exe connect to the indernet, i say yes and a "Red Zone" alert comes up asking me to alowa program that may track what i do on my computer or Track my keystorkes?
are all SVChost things good?
@Neb: Yes assuming it's C:\Windows\system32\svchost.exe. Some malware tries to fake it putting one in C:\Windows or elsewhere.
This is an excellent explanation. Good Job.
You the man (or woman)! I have been soooooo interrupted by 100% takeovers of my system resources. And I have been totally ineffectual in turning off various processes from my task manager. Will go the next step from you and the black viper to figure out what is hogging the chipset.
You know, I hate to say this, but I tend to agree with the writer who said this is Windows. If we don't like it, maybe it's time to go Mac. (This is a hard thing for me. Been with Dos since the most early 80's.)
Great Info, dude, like seriously. Nice of you to put this together! Thanks like a whole bunch!
Wait till I tell all my friends about this. I'm gonna sound smart. Thanks for the article!
You solved my problem I has having a difficulty
I've noticed that installed programs may use svchost.exe to run. This causes a problem when setting rules in a firewall to block programs from the internet but still allow the program to run.
Maybe I'm missing something here but when my firewall pops up asking me to allow svchost.exe because I just opened adobe reader or some other program how am I supposed to block adobe from updateing or connecting to the internet whithout blocking svchost.exe.
Windows should not be trying to establish a connection to the internet anyway unless I tell it to. I think this has some to do with the problems MS has with anti-trust laws in other countries but we just let them do what they want here in the land of the free.
Checked out Black viper, answered a lot of questions but why oh why such eye demanding colours on their website it really hurt to look at for more than a few minutes at a tme
On the Black Viper website you can choose what color you see when you view the wedpage. Look at the top left corner of the main page, there is an option to view the site in black or white. Also, if you look in the "Notes for a Happier Computer and User" section the last item has a link to a page telling you how to change the view settings in your browser to change the look of the website.
Somehow I still have an uncomfortable feeling. My puter got into a loop; it would restart, then once windows came up then I got the "Dos Type" window with "svchost" in the title bar and nothing inside of the cell. Then it restarts (on it's own) and goes through the same process, over and over and over.
@CaptRon: That is not normal. Either your svchost got messed up or you have some malware that is pretending to be svchost.
If you post your issue on the forums we can try to help you figure out what the problem is.
Kaspersky gave me this: Running process C:\windows\system32\svchost.exe: detected modification of riskware 'Mass-mailer software'.
System is super slow. Ran Malware Bytes but couldn't get it. Pushing the Kaspersky definition updater right now. Any ideas? Or has anyone seen this problem before??
How do I know if one of these is my employer monitoring me?
the user name on svchost.exe shows up numerous times with a user name as myself, one for SYSTEM, one says LOCAL SERVICE, one is NETWORK SERVICE, is there a way to determine if I am being monitored? Thanks
Thanks for this info. as it was really helpful in deciding how to fix a svchost.exe that was utilizing all of my memory and growing fast.
Thanks for the info. I do a have question in my mind. I do not have a Services tab in the Task Manager. How can I map svchost.exe to the services running on my mac using the command prompt? There are many SVChosts running in the tasklist. Local Service and Network service are the two other User Names that are displayed in the TaskManager>Processes. I do understand the Network Service. What is Local Sevrice? Does that mean I am monitored or is it any SVChost launched by any hacker to access password and other sensitive information? Please let me know.
I would like to thank you for taking the time to convey this information in terms that were CLEAR and EASY to understand! To say that you were helpful would be an understatement. THANK YOU:)
Thanks for the well written explaination
Thanx for the info man !!
It's useful!!
Excellent article. Simple and very clearly articulated. It clarified my doubts I had on svchost process. Thanks for posting this.
Thanks! I had a vague idea what svchost was, but this helped. And I'm really glad to learn how you can tell what services are running under it.
I just found your website through Lifehacker, and I've already bookmarked it.
My Norton has identified a Low Risk Program Alert in that "A remote system is attempting to access svchost on your computer. This program has been modified since it was last used."
It shows the path as C:\WINDOWS\system32\ and asks me what I want to do?
Always allow (recommended),
Allow this instance,
block whis instance,
block always or
manually create a firewall rule.
How can I tell if this is a legitimate svchost addition or a masquereding virus? Thanks.
Thank you Very much for that information
Just like the hundreds out there I ALWAYS WONDERED THAT
Thanks, my computer was running approximately 21 svchost.exe's and thanks to you I trimmed it down to 6. Thank you again