What is svchost.exe And Why Is It Running?
You are no doubt reading this article because you are wondering why on earth there are nearly a dozen processes running with the name svchost.exe. You can’t kill them, and you don’t remember starting them… so what are they?
So What Is It?
According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?
Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.
Why Are There So Many svchost.exes Running?
If you’ve ever taken a look at the Services section in control panel you might notice that there are a Lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on.
So What Can I Do About It?
You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.
The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.
If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box:
Checking From the Command Line (Vista or XP Pro)
If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.
tasklist /SVC
The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.
Checking in Task Manager in Vista
You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.
This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:
The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don’t want it running.
Using Process Explorer in Vista or XP
You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.
Hovering your mouse over one of the processes will show you a popup list of all the services:
Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.
Disabling Services
Open up Services from the administrative tools section of Control Panel, or type services.msc into the start menu search or run box.
Find the service in the list that you’d like to disable, and either double-click on it or right-click and choose Properties.
Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.
You could also use the command prompt to disable the service if you choose. In this command “trkwks” is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you’ll notice you can find it there as well.
sc config trkwks start= disabled
Hopefully this helps somebody!
Daily Email Updates
You can get our how-to articles in your inbox each day for free. Just enter your name and email below:
| Similar Articles | Featured Wiki Articles |
| Latest Software Reviews | Quick Linux Tips |
| Geek Arcade | Popular Forum Threads |
I always wondered what this was and why so many were running. Thanks very much for the clear and excellent explanation!
Thanks for this! Like Rich said above, I’ve always wondered too!
Is there anywhere to get a list of the “common” windows processes that shouldn’t be shut off; ie core windows services? That would help with making sure the mistakes are kept to a small minimum…
Much thanks!
Jon,
I’m working on building a guide to all the windows services, but I’m not done yet. (lots of work involved).
In the meantime, you should check out Black Viper’s guide, which is really top notch: http://www.blackviper.com/WinVista/servicecfg.htm
You should note that there’s no “perfect” configuration for everybody… depending on what applications you are running you may or may not need a certain service.
Thanks again for the quick response! I totally agree with you with the “one config to bind them all” scenario never happening {no matter how much some might want it!
}
I will check the Black Viper guide when I get home tonight!
Cheers,
Jon
This is very useful and helpful. Thank you Geek for taking the time to put it together. WHS
Thanks for this excellent guide, it is hands down the best explanation of these svchost.exe processes I’ve read anywhere (I don’t know why everyone always feels the need to be so cryptic about everything). Clear, concise, perfect. Thanks!
Thank you for this simple explanation. I work with .dll and .exe programs daily but am new to the field. This not only cleared things up for windows but explains why the programs I create need a .dll file to run.
Excellent information on svchost.exe. This simple, clear explanation clears all my doubts regarding svchost.exe. Thank u very much.
What command are we supposed to enter in win2k?
tasklist /svc gives an message “‘tasklist’ is not recognized as an internal or external command,
operable program or batch file.”.
Thanks for the tips. I’m wondering what is this before.
Thank you so much for this awesome guide. Really very useful.
I would like to add one thing! If the service name is “scvhost.exe” then its a virus. Also if Username of “svchost.exe” service entry is other than “System”, “Local Service” and “Network Service”, then its a virus.
I’ll wait for your service guide.
THanks for the info! It’s really nice! I wondering how to do it in Windows XP. I can’t ge the “go to services” menu on right click, can you guide it on XP ?
Thanks for the post. I have stopped most of the unwanted services for the time being.
Best,
Lawk Salih
You answered the question I was tired of asking around and eventually forgot about it. If I have any more question about computers, i’ll know where to come first next time.
Thanks!
Thanks.
All the info contained in this article was konown to me, it is the combination you propose that is valueable!
Great article Jon! I’ve always wondered what all those svchost.exe’s were.
Excellent, Thanks for explaining this!
Great article
very easy to understand
Thank you for the great explanation of something I have always wondered about.
tasklist is not included with XP home, only XP Pro
And how do I go ahead doing this for non vista and non XP systems?
Thanks alot for this info, I have always wondered what svc processes are up to. @peter, thanks for the links…
This only works in Pro, you should indicate that. Most people that need this article will be running Home so its pretty irrelevant. Nice try though
quite good post…but i think disabling services related to svchost.exe could prove a loss in some functionality…but its ok if someone knows about the service completely before disabling.
Great article. Thanks!
Ahhhhh thanks for this complete and easy to understand explanation.
I guess I can have some sleep finally!
Thank you very much for the explanation.
Finally a good night sleep for us all!
Kudos
-You’ve given a better explanation than searching on google a week could!
gosh, thanks for the info. At last , I know what is svchost all about.
I always tweak my services sometime even crash my laptop.
what would be the must turn off service for vista?
Thank you for this!
Very informative. Thank you for all that you do.
Great article. I use another free program to do this on windows. It allows me to do service profiles…so I can switch from my developer profile to my gamer profile. Instantly clearing up resources. Even gives a graphical view of the services and their memory footprint.
It amazing the kinds of crappy services you find on your system. Ipod service.. wth I don’t even have an ipod. Google Toolbar service – runs even when IE isnt open. Adobe Updater… the thing doesnt update until you open one of their apps anyway. I could go on… just check out the program. Its wicked.
Service Studio
http://www.mindswarm.com
Thanks to Dan for telling me about it.
Wow!, It’s a great article. This site rocks man! I was always wondering what is this service all about but never actully try to dig it more.
Thanks for sharing.
I have answer to that…..its called LINUX and it has penguin on the cover.
tasklist /SVC | more
show all list
Great article
awesome.
What happens if you just have a regular home edition of XP.. I tried doing the cmd prompt with Tasklist/svc but it didn’t work.
To Dave: tasklist /svc works only with XP pro…….
Hi good evening..
I need Help.. theres a problem in my PC when I restart my computer I doesn’t restart..or it wont execute when I click “restart� and I just restart it manually……some of my friends told me its because of the Virus called “svchost.exe� does it possible…..can this be true….plssss Help me…
Great article, thanks!
Thanks a lot for the information.
why would I always have multiple msexe.exe running in my Task Manager on my XP home edition? Whenever I want to install a new program or uninstall a program I get an error message that another install is in progress. I have to shut off all instances of the msexe.exe then quickly hit the run (install) before they start baack up..What is up with that? I had AVG. now switched to NortonAV and I have a Spyware detector and Registry cleaner and I still have the same problem. Any advice?
Thank You!
Chris
Awesome explaination on the svchost.exe
very nice info bro. This is the real thing newbies should know.
very detailed.
keep it up. i m blogging it.
Parth.
Thanks, well explained info.
thank you for wour always excellent info, from Spain.
I sugest one topic: how it works, and how to reduce the amount of memory that consumes “iexplore.exe” ( in my case 56.956 K)
Thanks again
hi
i am wondering if there is a guide on how to settle this problem for pc running on XP? thanks
This was exactly what I was looking for. Thanks.
Good stuff……
Thanks for the info! The only problem that I had (I’m not totally computer illiterate but I’m not a programmer), and this sounds stupid, but when you check the “show processes for all users box”, what do you do then? I clicked the box and then nothing happened, the box was just checked. Sorry if this is a dumb question.
Hey Guys really gr8 info about SVCHOST.EXE.
Peter thanks for the link provided..
great job. Thanks a lot for the usefull and well-arranged informations.
Fantastic INFO! Thank you!
Great Article Jon!!! You really made all of us to tacit “svchost.exeâ€? in a very proficient mode.
I have XP Home and tasklist /svc gives a message “‘tasklist’ is not recognized as an internal or external command,
operable program or batch file.”.
I had a few of svchost.exe running under user “SYSTEM”. But then i had 2 svchost.exe running under my user name which is audi, i knew this was something else because its under my user name and not under the system’s and in additional i was trying to find the source of web blocking program whiched blocked me from entering some web sites such as youtube.com, it even blocked me off from using firefox and not to mention disabling the function to see hidden files.. So i searched for svchost.exe using the search tool in the “start”, and i find its location here: C:\Documents and Settings\Audi\Local Settings\Temp\MicrosoftPowerPoint.
it mention something like “autohotkey” and its icon is a “H” letter in a green box.
This confirms me that its some kinda bug. I’ve erased it completely, but it still shows up everytime i turn on my pc, tryied tracing it again and showed no results. Its useless trying to use anti-spyware/addware or even an anti virus. Its a bug in disguise under the name of svchost.exe to prevent detection. So how can i get this program/thing off my pc for good? any idea people? tq.
I don’t have any svchosts running, I think its stopping my “windows update” from working.
Amazing! I have 13 svchost programs running at the moment. I know that some viruses pretend to be svchost, but I didn’t know how to check what each of the svchost programs were doing. You have helped me a lot. Thanks!
Another great tool for examining what is happening under Windows is What’s Running?. It’s free and available here: http://www.whatsrunning.net
thanks to whoever wrote this article… it helped me gain a lot of info bout svchost…. i thought it was a virus…
How can I thank you ?
God bless you.
Great, well written article – Thanks!
the explanation is so critically important. Millions of thanks!
svchost essential for Windows. Had the 100% CPU problem after having unintentionally left my firewall off. Fixed the whole problem by 1) activating Firewall, running full virus scan 2) cleaning out all unecessary files, 3) download Windows Service Pack 2, KB 884020, Windows Security update for XP KB941644, and Windows Defender, 4) ran a scan with Windows Defender, 5) wiping hard drive with Ace Utilities (other programs do this), 6) Dowloaded CCleaner from CCleaner.com (free software), 7) and then defrag. CPU is normal. Tip turn off realtime for Windows Defender and run scan once a week
Thanks to you and now thanks to HP. That’s some good geeking!
KO
Great article. Thanks!
So thats what it is!!! Sweet!! Thanks for the info!!
Excellent description — thanks! I had been killing off one of these that was hogging the CPU — and feeling that I was “living dangerously”. Now I can go back and find out what is actually happening behind the scenes.
Yep brilliant sorts it all out for me! thanks mate
@diya
What command are we supposed to enter in win2k?
@Pavan
And how do I go ahead doing this for non vista and non XP systems?
tasklist /SVC is tlist -s in Windows 2000 Pro. You already have it in the support folder on your Windows 2000 disc. For more information,
http://support.microsoft.com/kb/250320
For help, tlist /? works as expected. I extracted tlist.exe to \WINNT\system32.
Will leave it to The Geek to tell us if it’s completely identical in function, or just very close …
Brilliant – thank you.
You should write manuals for Microsoft !
B
I’m still having a bit of trouble, What do you do if you don’t have the ability to look at the services list, and right-clicking doesn’t bring up the same capabilities?
@Brady
You would have to tell us, first, what operating system are you using?
Clear and concise…great job The Geek! Finally an article in English (not it Cryptic) about this…
That was a real help man. thanx
awesome article
Godbless u
You guys r rocking. Once again geek’s team has prooved that each one of you is making sure to raise computer literacy across the world by providing such an informative article. Keep up the good work
On Jan 25th this was posted:
Peter
Thank you so much for this awesome guide. Really very useful.
I would like to add one thing! If the service name is “scvhost.exe” then its a virus. Also if Username of “svchost.exe” service entry is other than “System”, “Local Service” and “Network Service”, then its a virus.
I’ll wait for your service guide.
My comment:
Is any of the above correct?
@Bill Snow
Often viruses and spyware will disguise themselves as legitimate services by either using the same name, or similar names with spelling errors. You should run a scan to be sure.
Thanks for the quick response. I have run several spy ware and virus scans that show none but I have svchost.exe that run at startup as well as random times during the day that essentially prevent me from working.
Can you give me instructions as to how to find out what these are doing and who started them. It has been suggested that they may be a Trojan or spy ware or worse. Some use Hugh memory and 100% CPU for 3 to 10 minutes. others run for hours.
Bill Snow:
Try using Malwarebytes’ Anti-Malware program. It is recommended by C|Net and free. It cleaned up quite a bit on my computer. My son had accidently downloaded the Trojan.Vundo.
I just want to say thanks for having this sight! I have printed out what the instructions for what I needed and it is truly easy to understand. Just want to say THANK YOU. Nothing in life is free when they advertise it on line, but yours is free and more helpfull without wanting more of my money. THANKS GOD BLESS
Thanks for the info!
Great advice Geek. I bet most of us at some time or another have wondered what these processes are,
It’s great to have advice in plain english
You should write a book I’d but it.
Thanks for the info…there’s alot of misinformation out there on the scvhost.exe issue
Hey Geek … Do you have any resources you could recommend to understand which systems are mandatory and which ones are optional?
Thanks for your time
I’ve just installed some security software, scvhost keeps coming up and requesting I block it, is this normal? Does it cause a problem if I click yes to block? I’m no way technical – so I haven’t a clue, I only installed it to search for spyware – is this part of it??
Mindboggling. Great stuff: Will make the beginner think they might actually understand some of it one day!
Thanks bro, it is vey useful informatin for me
Thanks for a great explanation. svchost mystery finally explained!
Thank you
I’m really impressed. Even though I knew about these stuff before, I never expect someone to demonstrate the whole process with us end-users in mind. Many thanks!
very clear & concise explaination of svchost.exe … I have reduced mine down to 3 in Windows XP PRO and thanks to this article I know which services these 3 svchosts are running, thanks!
Too good explaination.
I was wondering for so long and now i know the answer.
Thanks for such a great explanation. The way you explain is really great.
Windows offers “tons” of services, many of which the average user doesn’t
need. What services can safely be disabled and not inhibit the PC from
functioning for basic usage and internet connectivity? Is there a better description of what each service performs beyond what Windows provides?
that helps a lot. do you recommend any specific services to shut down?
Timely info (since one instance of svchost was using 99% of CPU).
Am running Windows XP SP2 and do not see the “Services” tab on
Task Manager. Instead, will install Process Explorer use it the
next time svchost starts hogging CPU. Many, Many Thanks for this!
Excellent explanation! I too was curious about the multiple instances running when my AutoCAD application stopped running.
thumbs up!!
it helped me
thank you for making that tech talk simple for us lowly computer uses.
this instructions are very simple, easy to understand.
the only problem is that my task manager does not have the same tabs as the example.
my system does not have the services tab. HELP!!!!!!
as we say in hawaii, MAHALO (THANK YOU)!!
Don’t disable services using Task Manager,
In VISTA click the start button, type “services.msc” in the search box without quotes, and hit enter, this opens the services window.
In XP click the start button, click the run button, type “services.msc” in the run box without quotes, and hit enter, does the same thing.
In the services window double click on the service you want to enable or disable, and you better know what your doing because you can make Windows un-bootable if you disable the wrong service!
Wow, that’s lots of super helpful info,
thanks a lot
i always wondered what are those processes and today i know what are they
i sometimes thought of terminating those processes but….couldnt do it….
thanks alot
Very informative. Thank you for all that you do
thanks for a good explanation
Thanks so much for the write-up. It tipped me off to use Process Explorer utility and troubleshoot HP’s printer service which was hogging 50% of my cpu performance. Now the temperature of my laptop is dropping, the fan is getting quieter and the constricted blood vessels in my head are starting to release… ahhhhh
Excellent information – thank you very much.
Thanks, I always wondered about that. The confusing thing is that there can be multiple copies running at the same time. Now I understand why.
This was a remarkably clear and concise description. Well done
I don’t often leave comments, but your explanation went a long way in explaining this to me. Thanks a lot!!
How can I tell what services too end? I dont want to end one thats imprtant.
The one service you should leave completely alone is “Remote Procedure Call (RPC)” if you disable this service it could make your machine unbootable. Leave it on automatic always.
Other services can be disabled but you need to know what your doing, some services are interdependent so disabling one service may actually disable others at the same time.
For the low down on what is safe to disable see Black Viper’s recommendations … you could start by using his “safe” settings.
for Windows XP SP3
http://www.blackviper.com/WinXP/servicecfg.htm
for Windows VISTA SP1
http://www.blackviper.com/WinVista/servicecfg.htm
fantastic, i was always wondering about svchosts.Now i m cleared.
!!thanx!!
Thanks. I’ve notice quite a few Malware programs create this process.
Thanks this helped me alot. My cpu was pegged at 99% thanks to this I was able to identify it and shut it down.
Very helpful article! I’m often mystified by the things I see in the Task Manager — including the ever-present svchost entries. This article not only explained the svchost process; it provided additional resources (both GUI and CLI) that greatly aid in understanding what my PC is doing under the hood. Thank you so much for the great info! (And keep writing!!)
Sincerely,
Aphobos
I hope this helps those that have a different OS but to see the services tab and all running you can go to start menu, click on run and type msconfig and there you can make changes and see everything this topic is about..
Done well, thanks for the article!
One of the most impressive articles I have ever come across.
Thanks a million.
Great article, helps a lot. Can anyone tell me why when I boot up one of my Svchost.exe files is using around 95% of my CPU?
I have a gateway mx3417. I started to use T mobile gc89 air card with a duel-systemsadapters The system was slow. windows would time out often then warning screen would appear. and basicalllly crash the laptop. I have origional recovery disk. I want to reformat entire hard drive. and start from fresh but it wont work
Well done. This was a lot of help for me as far as a starting point. Keep up the good work.
Liam,
Go to http://www.howtogeek.com/howto.....t-running/ and read the whole section and then download “Process Explorer”. Process explorer will show you which Srvhost is doing the hogging Then mousing over that process will reveal what it it running.
Good explanation on the details, really helped us a lot!
Really very nice article.. please provide exact doc for xp.
OMG i finally understand why they run now.. i got so worried because they used up banwidth that i was about to terminate them with out knowing what they do..FEW…u saved me
Thankyou soo much…. I was wondering abt this svchost.exe and now I got the right answer. I saw that my bandwidth is being used for something else and just googled and found your site… it is really useful yaar…
Thanks
Thanks a lot to your mother who have given birth you, intellignet one!!
really, thanks for making things clear and for providing a very helpful explanation. now i will not have to ahh mmmm ?????? when somebody asks me about it.
very good explanation, thnk you!!!
Thanks a lot for your help.
With your help I managed to cancel the service that used over 80% of my CPU for the past few weeks.
Why disable this and that in Windows, isn’t “excessive disabling of processes” another name for not being able to afford sufficient resources (RAM, CPU, HDD, etc.) to run this O/S? Windows is how it is – period! I understand a lot of users are mad and misguided about the way Microsoft develops software but let’s face it…you all want it. Yeah it’s designed for more than what you’ll probably need but I call that forward thinking. Better to be safe than sorry, especially for those who are not technically inclined. And for those who are…switch to an open source O/S and quit complaining; also, stop trying to force Microsoft to be what YOU think it should be. Why don’t you buy a MAC if you want bare basic stability? I’m no Microsoft groupie or fan-boy but let’s grow up a little here.
Thank you so much for making it so clear!
Cheers man! Great stuff!
nice find…………… thanks
Hi, How-to Geek;
You did an OUTSTANDING job explaining the process…!!!
Keep up the good work.
Cheers…
Fantastic article. I always saw svchost.exe and knew it was related to DLLs but never knew about Windows’ “Go to Service(s)” feature. Thanks for the great info!
Thanks for clearing this up for me. Although, I have an antivirus/Firewall program called ZoneAlarm. I get alerts to let SvcHost.exe connect to the indernet, i say yes and a “Red Zone” alert comes up asking me to alowa program that may track what i do on my computer or Track my keystorkes?
are all SVChost things good?
@Neb: Yes assuming it’s C:\Windows\system32\svchost.exe. Some malware tries to fake it putting one in C:\Windows or elsewhere.
This is an excellent explanation. Good Job.
You the man (or woman)! I have been soooooo interrupted by 100% takeovers of my system resources. And I have been totally ineffectual in turning off various processes from my task manager. Will go the next step from you and the black viper to figure out what is hogging the chipset.
You know, I hate to say this, but I tend to agree with the writer who said this is Windows. If we don’t like it, maybe it’s time to go Mac. (This is a hard thing for me. Been with Dos since the most early 80’s.)
Great Info, dude, like seriously. Nice of you to put this together! Thanks like a whole bunch!
Wait till I tell all my friends about this. I’m gonna sound smart. Thanks for the article!
You solved my problem I has having a difficulty
I’ve noticed that installed programs may use svchost.exe to run. This causes a problem when setting rules in a firewall to block programs from the internet but still allow the program to run.
Maybe I’m missing something here but when my firewall pops up asking me to allow svchost.exe because I just opened adobe reader or some other program how am I supposed to block adobe from updateing or connecting to the internet whithout blocking svchost.exe.
Windows should not be trying to establish a connection to the internet anyway unless I tell it to. I think this has some to do with the problems MS has with anti-trust laws in other countries but we just let them do what they want here in the land of the free.
Checked out Black viper, answered a lot of questions but why oh why such eye demanding colours on their website it really hurt to look at for more than a few minutes at a tme
On the Black Viper website you can choose what color you see when you view the wedpage. Look at the top left corner of the main page, there is an option to view the site in black or white. Also, if you look in the “Notes for a Happier Computer and User” section the last item has a link to a page telling you how to change the view settings in your browser to change the look of the website.
Somehow I still have an uncomfortable feeling. My puter got into a loop; it would restart, then once windows came up then I got the “Dos Type” window with “svchost” in the title bar and nothing inside of the cell. Then it restarts (on it’s own) and goes through the same process, over and over and over.
@CaptRon: That is not normal. Either your svchost got messed up or you have some malware that is pretending to be svchost.
If you post your issue on the forums we can try to help you figure out what the problem is.
Kaspersky gave me this: Running process C:\windows\system32\svchost.exe: detected modification of riskware ‘Mass-mailer software’.
System is super slow. Ran Malware Bytes but couldn’t get it. Pushing the Kaspersky definition updater right now. Any ideas? Or has anyone seen this problem before??
How do I know if one of these is my employer monitoring me?
the user name on svchost.exe shows up numerous times with a user name as myself, one for SYSTEM, one says LOCAL SERVICE, one is NETWORK SERVICE, is there a way to determine if I am being monitored? Thanks
Thanks for this info. as it was really helpful in deciding how to fix a svchost.exe that was utilizing all of my memory and growing fast.
Thanks for the info. I do a have question in my mind. I do not have a Services tab in the Task Manager. How can I map svchost.exe to the services running on my mac using the command prompt? There are many SVChosts running in the tasklist. Local Service and Network service are the two other User Names that are displayed in the TaskManager>Processes. I do understand the Network Service. What is Local Sevrice? Does that mean I am monitored or is it any SVChost launched by any hacker to access password and other sensitive information? Please let me know.
I would like to thank you for taking the time to convey this information in terms that were CLEAR and EASY to understand! To say that you were helpful would be an understatement. THANK YOU:)
Thanks for the well written explaination
Thanx for the info man !!
It’s useful!!
Excellent article. Simple and very clearly articulated. It clarified my doubts I had on svchost process. Thanks for posting this.
Thanks! I had a vague idea what svchost was, but this helped. And I’m really glad to learn how you can tell what services are running under it.
I just found your website through Lifehacker, and I’ve already bookmarked it.
My Norton has identified a Low Risk Program Alert in that “A remote system is attempting to access svchost on your computer. This program has been modified since it was last used.”
It shows the path as C:\WINDOWS\system32\ and asks me what I want to do?
Always allow (recommended),
Allow this instance,
block whis instance,
block always or
manually create a firewall rule.
How can I tell if this is a legitimate svchost addition or a masquereding virus? Thanks.
Thank you Very much for that information
Just like the hundreds out there I ALWAYS WONDERED THAT
Thanks, my computer was running approximately 21 svchost.exe’s and thanks to you I trimmed it down to 6. Thank you again
This is great just what I needed to help me out.
Thanks it works.
Awesome! Great explanation of how to view and disable services. This is the first time I’ve ever seen this site and I became a member because of this post. I will be spending a lot of time here. = )
thank you so much, i didn’t know what they were and tried having a battle with it, by closing them… my comp kept slowing down…
Who is the author of this????? He/she is great!!!!! That excellent article… easilly excellent…..
Running XP Pro, but it won’t let me use the ‘Tasklist /SVC’ command – does it have to be run as Admin?
Or it might be disabled, according to the error message……anyone know what service controls Tasklist on the cmd?
(I did make my initial installation account = admin, but since then XP changed it to two different users…one of which lacks Admin rights. I’m going to go try the command as Admin but figured it might be useful to mention here that on XP Pro (SP2) it doesn’t work under a regular user, even if they have full rights.)
Found it (re: above comment), so if like me you turn off annoying background things only to find you may need them later for a bit, one or more of these need to be on to use Tasklist (and no doubt a bunch of other cmd tools):
Windows Management Instrumentation
Windows Management Instrumentation Driver
WMI Performance Adapter
(it’s most likely the first one – http://www.ss64.com/nt/syntax-services.html)
*nb – if you try to turn on a service without it being enabled (eg – one or more of the above are turned off (check them in Start – Run – (then type in) “msconfig” in the Run textbox, and they’re in the Services tab)) it’ll say the service isn’t installed
Great article. Very informative & helpful!
I have six svchosts running in my task manager, but they all seem to run from different locations. Three run under the username “System,” two under “Network Service,” and one under “Local Service.” Since svchost.exe has a history of being an uninvited guest to a masquerade party (i.e. a trojan), how can I know for sure these are all integral to my system? I use XP Home Edition.
I have six svchosts running in my task manager, but they all seem to run from different locations. Three run under the username “System,” two under “Network Service,” and one under “Local Service.” Since svchost.exe has a history of being an uninvited guest to a masquerade party (i.e. a trojan), how can I know for sure these are all integral to my system? I use XP Home Edition.
@sawmaster: Those are not locations, they are hidden users that Windows creates for security purposes. SYSTEM has complete access to the computer, “Local Service” has less access to the system and no access to the network, “Network Service” is the same as “Local Service” but it has access to the network.
Also you can be fairly sure you have a good svchost when the process path is C:\Windows\system32\svchost.exe. Trojans named svchost will be in different locations. Though will the usage of rootkits even that isn’t always true because rootkits can make programs like Task Manager not show the presence of the rootkit.
As for services running under svchost that have security holes in them, your only option is to keep up with the latest news and updates on Microsoft security and security for any other programs you have installed.
You can’t predict when a security hole will appear.
Right on! Been messin’ around with DVD burning software and have been checking taskman to see CPU usage and just thought I would have a go @ finding out what the SVCHOST was. Glad I looked. Bookmarked your site. Thank you
thanks a lot man, this was very helpful and above all, easy to understand for a
non- IT person like me.
keep it up.
Thanks a lot man for the gr8 info you had intoduced for the svchost.exe.
one more thing, i am using win XP system and i had Macafee AV installed in it, couple days ago the AV start showing messages of Virus Scan Alert and the detection type is “Buffer overflow” and the application is the “SVCHOST” any idea for this
Thanks in advance
Excellent clear informative article … well done
This is very good help.
is there any way that i can know which ,exe has called which .exe or .dll.
Thanks
i downloaded mathematica from utorrent but it would not open so i tried to download a ‘bin’ driver from ‘drivermax 4.7′. i think i may have allowed a one time change but when checking mcafee,although it says i am protected, it also has 21+ entries in 9 secs of a registry type.Process: c:\windows\system32\ie4uinit.exe,Description:IE per-user initialization utility. Then 2 more entries in the next second of a registry type.Process: c:\windows\system32\rundll.exe,Description:windows host process(rundll32). then 2 more in the next concerning c:\program files\synaptics\synTPEnh.exe. this was about 5 days ago. am i safe
I called up the run screen and typed in tasklist /SVC and information came up on the command line screen but the command line screen only stayed open for about one second. Can you tell me how to keep it open long enough for me to read it? I do have Windows XP PRO.
Kevin,
Start the Command Prompt from the program list or type “CMD” from the Run box. Then type your tasklist/SRV.
Wow – you really ought to write a book or something.. this is absolutely way out the best explanation on svchost.exe i have come across – and i’ve been looking through articles on the net for over 4 months – you’ve really put this together.. well done and THANKS.. i’m going to take time out to really look at your website – and I’ve just placed it in my hall of fame bookmarks!
Lovely Explanation.
Keep up the good WORK!!!!!
Thanks for taking the time to explain and put this all together.
Like Neb who posted above, I too have an Antivirus/Firewall program called ZoneAlarm. I get alerts to let SvcHost.exe connect to the Internet, but the start port address is 0.0.0.0.0.0., which concerns me. Do you think it’s safe to allow? I’ve been denying and so far and haven’t noticed any problems with any of my programs. I can’t figure out for the life of me which one of my legitimate programs is trying to access the Internet, if any. Even after selecting the deny box the same alert box pops up again asking wanting permission; except the port address has clanged. I think this is what allows it to get around the deny setting that I previously set. Sooner or later the deny setting sticks, but it eventually comes back in a couple of days and I go through this process again. Should I just keep doing this? AV and MS Defender have never found anything threating on my system or if they have it has been removed. or so I thought.
Hello,
I have P IV machine with 3.00 ghz (pinless processor), MSi motherbaords with 512 mb DDR1 ram.
Can I upgrade my ram in 2 gb DDR2
Plz help me.
Navneet
It’s a shame so many of us have to look this up. It shows what a poor design it is and the inherent problems experienced with Windows currently.
Hello!!
I have AMD Sempron(tm) Processor 2600+
1.60 GHz, 256 MB of Ram
and windows sp-2, original anti virus Guardian (Quick heal product).
Problem is: When I log on my computer so computer does open very slowly and very late after that when I open any program so still open very late……….why?
As I know that my computer requirement too old.
Great thanks! Very helpful article!
arggghhh my cpu is at 100 i cant open internet explorer, windows updates, any files, copy and paste doesnt work, my background is missing, itunes is stuffed.
none of these type in ‘run’ solutions have worked and my computer has lost all of its networks so wont connect to inet. any more ideas!!
Dear all,
By disabling the service, would that effect the performance of the CPU or server?
Awesome explanation!!!
Keep it up!
Thanks dude. A very simplified explanation. Resolved a leak of internet usage on my home comp. And thanks for some of the links provided too.
yeah really nice explanation on svchost…
thnx to people who did effort for this
Thanks alot for the excellent explanition of svhost.
i know it now. b4 i dont know it.
Thanx 4 the explanation.U r true GEEKS! B proud of it
.
Superb blog post. Keep up the good work.
Thanks for the information, I like it, Very Much.
Great enlightenment. That was really HELPFULL. Finally I got my proper answer and learn a lot of’bout it. Thank You!
Thanks a lot! Very well explained and easy to understand. Was looking for just this!
Many thanks for this extremely useful article.
This was awesome — thank you!
Thanks Dude … I was wondering if this is what was causing my computer to run sooooo sloooowww … but it seems that it is simply that piece of crap called vista.
Hello Geek
There is little for me left to say after the many positive reactions before me. Btw..I share them all.
] You are helping a lot of seniors who try to learn and use computers in the region where I live in Holland. Thank you for that.
I work as volunteer for the elderly.
Know this! Through me…[and probably also many others
Sincerely
Henny
All of the information has been available BUT so disjointed and complex that very few could decifer it. You have put it clearly in terms that almost anyone can understand and use. Truly a work of art – thanks very much. Ahemm, ever thought of rewritng some of MS’s help articles
.
Thanks for the info. it’s very helpfull
You mentioned a guide for process, will I be able to get one? if so how and when?
Thanks again
John
I don’t regard myself as a “geek” but I am a interested party trying to work out whats going on. Just a comment, I think it’s irresponsible to just say “Find the service in the list that you would like to disable”
How many people know what each of those services do and whether if we disable a service what affect it would have on our systems? Is there somewhere, where we can find out what each service does?
Thanks for trying to help.
I agree with bergie (although I’m not sure I’d say it’s irresponsible). How DO we people who are not extremely knowledgeable about computers know if we disable something it won’t adversely impact other processes or if we can even enable it again? It really would be nice to know what would happen to our computer whenever any one or combination of proceses was disabled before we took this action (specifically, what things “only an expert” should fool with and people like us should NEVER touch). Thanks for any answers.
To find what you want go to the top of this page then scroll through the description until you get to the “Comments”. Just above under “Similar Articles ” look for “Svchost Viewer Shows Exactly What Each svchost.exe Instance is Doing”. This will let you see a description of what each process is and may help you to make a decision of what to do.
Thanx a lot for explaining wht these processes are……without this i couldnt sort out these probs in my life…..
thanks bro.. g8 wrk
maybe next time just dont forget that you are explaining relevant stuffs to a non-geek community and you will be fine. Besides if they were geeks they will probably no these stuffs, wont they?
* HISTORY * helps.
Before ~Winnt5/2000 Rundll32.exe was the interfacing “host” for .dlls.
Then it used mmc.exe. Again Micro$oftMgtConsole was the interfacing “host” for .dlls
Now I knew XP SVCHOST.exe did this.
What I did not know before Technet’s Russinovich was that ProcExp.exe & HowToGeek were so excellent! Thank you for tightening up my loose understanding!
CarlK, Columbus OH
Hi
I agree with some of the others above – I’m pretty PC savvy but not teccie enough to really work out what I can and mustn’t stop running.
I also have only one instance of svchost.exe running when I turn on my PC but it slows everything to a halt. Double clicking on it does not show me anything…
(Using XP home edition)
Process Explorer is a very powerful tool to know how svchost works. Definitely a must to have!
cool. i’ve always wondered if i could disable some xp programs from starting automatically. thanks!
Looks like it’s the info I need!.
But I do have a questions before I try all the above.
I have a PC, with Windows XP Service Pak 3. I am getting both the windox box that says there is a problem with schost.exe. Also when I boot up I get a boot failure, system halted. And the only way I can get around the latter, is to do a sofft boot. Are these two things related. Or if not what can I do about the boot failure situation. Thanks for any help
Excellent Information…..
good info..
thanks for “tasklist /SVC”
This was a huge help …
Thanks, you explained it very well…
umedmedia.com
so many people commented on this article.. but I want to say THX as well! (:
Yes I justed needed someone to put it in a simple way. Good Stuff
Thanks Geek!
Geez, I was burning up too much calories just to find out what on earth is that SVCHOST.EXE all about,
then The Geek easily cracked this one for me.
Nice one, Thank You and More Power!
Thaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaank you sooooooooooooooooooooooooo much!
Thanks a ton. Useful information explained in simple terms.
How do you get the ‘Services’ tab in the task manager? My task manager doesn’t seem to have one. Is it because I’m running XP: Home?
Thanx a lot for educating on a essential matter what every PC user must know.I am looking for this much clarity from 4 years feeling unrest.
I had a question about this program, it seems every time i start up my computer it now takes an additional 2 minutes about in the startup screen, and when it does finally start it says C:\WINDOWS\svchost.exe can not be found, or does not exist. I think maybe one of my siblings accidentally deleted it, do you know how i could go about getting this program back on my computer? or just solving the problem in general?
I have a problem starting up also (Windows XP) Get a few error messages and then it closes down!
1 message is svchost.exe – Application Error ‘The application failed to initialize properly (0xc0000142). Click on OK to terminate the application.
Not sure what to do due to the problems, please help……
Svchost can also be a target of a host of viruses, intrusion software can embed itself into a form of dll or alter an existing one when you reboot your machine then things get ugly. Such viruses auto launch because all there really is is a single exe telling what dll when to run, the moment the dll is run the dormant virus hijacks your system.
This is why anti virus is crucial people,
Enjoy
(Avast is a good one!!)
There isn’t a tasklist command available – could you please explain that ?
Dear Geek
Excellent explanation. Congrats and Thank you !
Can’t imagine a better article and explaination…Thank you!!!
I want to connect 3 monitors (alongwith keyboards and mice) to my CPU(1.5 GB RAM,160 GB HD,Ccre2 Duo Processor) so as to each one of my kids can work at a time, Could yoy please explain the way?
You might not bothered to read this at all but just wana extend my gratitude..thanks for the effort…more powers….
Its a great information.
@ Sundeep,
You are best advised to go to a good computer store and get advice from a technical person – Oh ya, its best to ask in more than one store, as the stores would always try and sell you ‘their best product’, which usually costs a lot of money.
@Geek,
Thank you for providing great answers to ‘burning’ questions
I’m running XP pro SP2, how can I get the ‘Sysinternals’ there? I mean I ALWAYS check my services and make sure nothing runs without me wanting it to. I’ve only 5 instances of svchost running on my box – I think thats pretty good, though I feel that I could do without one or two instances.
Here are the instances:
svchost.exe 768 DcomLaunch, TermService
svchost.exe 836 RpcSs
svchost.exe 876 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
ERSvc, EventSystem, helpsvc, lanmanserver,
lanmanworkstation, Netman, Nla, Schedule,
seclogon, SENS, SharedAccess,
ShellHWDetection, Themes, TrkWks, W32Time,
winmgmt, wscsvc, WZCSVC
svchost.exe 932 Dnscache
svchost.exe 960 Alerter, LmHosts, SSDPSRV, WebClient
I’m particularly interested in instance ID 836 (RpcSs).
Any thought? Thank you for your help.
Regards,
Mat
This was definitely of great help and thanks for keeping it simple and understandable!
Thanks a lot, was really really helpful for me
Good Article ,
How can we submit our own article related to other processes in this section.
Thanks
IK.
good work its very helpful for me……
Very useful article, and very good explanation !!
ahh I don’t have Vista. this makes me want it.
Very good explanation.
This is Interesting
great article. This information saved me a lot of time
Thanks
Juba
when the system starts there is a error shown SCVHOST.EXE not found .
please suggest me whether it is a virus attack or anything else and give me a solution.
tyvm for the awesome, info!!!!!
Excellent article..
Thanks for the clear explanation
Hi,
It’s really very nice and useful information. Now i cleared my doubt about svchost.exe process. Thanks for your effort.
i performed the above action but i fear that disableing it may harm it in another ways or may stops some function please reply
thanks, it is very useful.
I was wondering why when i type the tasklist /SVC it just gives me “tasklist is not recognized as an internal or external command. how do i get this to function on my computer?
how do you recognize a virus that uses an svchost.exe as a front from a real windows process?
nice information, in simple words.
thats what i needed..
thanks
Like all the above…thanks for explaining this to me… I feel better seeing all those repeats now.
This is great, I now understand all the instances, i do hope no virus will resemble the process
my computer ihave try so many anty virus ,and keep freezing some time and not responding,ihave to restart again and some time take 4 ever
Thanks so much for the information. I’ve been having things running in the background and I wondered what they were. When I found these I was kinda lost.. Not anymore..
thanks everyone
if svchost.exe not found
{
restart
}
if problem not solve
download svchost.dll from net
and follow it:
full path regsvr32 svchost
message will be dll successfully registered…………….juast apply…….
id : chandrtech@rediff.com
Its indeed a great article. I wondered many times why so many svchost.exe would be running even though I did not open any windows. geek.com did a good job putting this info all together, Great job dude!!
At last a Geek that puts it in plain english for the rest of us. Excellent article. Thanks
I appreciate this clear answer? Geek’s answer was right on the money. And I will go to viper to figure which processes I could rid.
Thank you again from all of us and will also go to viper site to check which processes I can stop.
One more thanks. It is incredible to me how extremely complex microsoft’s system have become.
I know nothing about it except it seems there is just one complex of processes overlaid onto another
and another seeming in an endless cycle. It is really great that you have put this info together so that
a human might have some [ever be it so small] chance of figuring some of this out. That is what it is
that their computer is doing in relation to what one might conceivably want their computer to do.
The task manager comes on and then goes off. It does not come on again. So how so I clean this process out?
Thank you so much! That was extremely helpful and exactly what I was looking for to help me reduce the load on my physical memory.
Thanks for the infomation it was very helpfull, there is mention of a program named Black Viper for Vista is there one for XP. Keep up the good work I like the way you give the right and relavent info without trying to sell me some reg fix or other so called Apps. well done.I will remember this site for the future.
Merci very much !
Thank you very much for giving us your time and effort. You helped me decide how to handle the warning from my Bit Defender.
Thank you very much for useful info!
Well explained and thanks for the info on Process Explorer utility.
thanks! i used to have to stop the svchost process but i investigated using process explorer and found out that 99% of the cpu was taken up by svc host – the source being a diagnostics and help program for my HP printer! make sure you install software correctly!
many thanks,
will