What Is Svchost.exe?

Definition of svchost.exe and how to delete svchost.exe viruses

Screenshot of several svchost.exe processes in Task Manager
Svchost.exe Processes (Windows 10).

The svchost.exe (Service Host) file is an important system process provided by Microsoft in Windows operating systems. Under normal circumstances, the svchost file is not a virus but a critical component for a number of Windows services.

The purpose for svchost.exe is to, as the name would imply, host services. Windows uses svchost.exe to group together services that need access to the same DLLs so that they can run in one process, helping to reduce their demand for system resources.

Because Windows uses the Service Host process for so many tasks, it’s common to see increased RAM usage of svchost.exe in Task Manager. You'll also see many different instances of svchost.exe running in Task Manager because Windows groups similar services together, such as network related services.

Given that svchost.exe is such a critical component in Windows, you shouldn't delete it or quarantine it unless you’ve verified that the svchost.exe file you’re dealing with is unnecessary or malicious. There can be only two folders where the real svchost.exe is stored, making it easy to spot a fake.

Which Software Use Svchost.exe?

The svchost.exe process starts when Windows starts, and then checks the HKLM hive of the registry (under SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost) for services it should load into memory.

Svchost.exe can be seen running in Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, and Windows 2000.

Note: Beginning with Windows 10 Creator Update (version 1703), for systems that are running more than 3.5 GB of RAM, every service runs its own instance of svchost. If less than 3.5 GB of RAM is available, services are grouped into shared svchost.exe processes just like in previous versions of Windows.

A few examples of Windows services that use svchost.exe include:

  • Windows Update
  • Background Tasks Infrastructure Service
  • Plug and Play
  • World Wide Web Publishing Service
  • Bluetooth Support Service
  • Windows Firewall
  • Task Scheduler
  • DHCP Client
  • Windows Audio
  • Superfetch
  • Network Connections
  • Remote Procedure Call (RPC)

Is Svchost.exe a Virus?

Not usually, but it doesn’t hurt to check, especially if you have no idea why svchost.exe is taking up all the memory on your computer.

The first step in identifying whether svchost.exe is a virus is determining which services each svchost.exe instance is hosting. Since you probably have multiple svchost.exe instances running in Task Manager, you have to dive a little deeper to see what each process is actually doing before deciding whether to delete the svchost process or disable the service running inside.

Once you know what services are running within svchost.exe, you can see if they’re real and necessary or if malware is pretending to be svchost.exe.

If you have Windows 10 or Windows 8, you can “open” each svchost.exe file from Task Manager.

Screenshot showing how to see services running inside svchost.exe
Viewing Svchost.exe Services in Task Manager (Windows 10).
  1. Open Task Manager.
  2. Select the Processes tab.
  3. Scroll down to the Windows processes section and locate a Service Host: <service name> entry.
  4. Tap-and-hold or right-click the entry and click Open file location.
    1. If the location that opens is anything other than either of the following paths, which are where Windows stores authentic copies of svchost.exe, you might have a virus: %SystemRoot%\System32\svchost.exe or %SystemRoot%\SysWOW64\svchost.exe.
    2. Note: The second path is where 32-bit services running on a 64-bit machine are located. Not all computers have that folder.
  5. Select the arrow to the left of the entry to expand it.
    1. Located directly under the svchost.exe instance is every service it’s hosting.

For other versions of Windows like Windows 7, you can also use Task Manager to see all the services used by svchost.exe but it isn’t as clearly laid out as it is in newer Windows versions. You can do that by right-clicking an svchost.exe instance in the Processes tab, choosing Go to Services, and then reading through the list of highlighted services in the Services tab.

Another option is to use the tasklist command in Command Prompt to spit out a list of all the services used by all the svchost.exe instances.

Screenshot of the tasklist /svc command in Windows 7
'tasklist /svc' Command Prompt Command (Windows 7).
  1. Open Command Prompt.
  2. Enter the following command:
    tasklist /svc | find “svchost.exe”
    1. Tip: Another option you have here is to use a redirection operator to export the results of the command to a text file which might be easier to read.

If you don’t identify something in the list, it doesn’t necessarily mean that you have a virus. It could just be a service you don’t recognize but is vital to the essential operations of Windows. In fact, there are probably dozens of “virus looking” services that are completely safe.

If you’re hesitant about anything you see, do a search online. You can do that in Windows 10 or 8 through Task Manager, by right-clicking the service and choosing Search online. For Windows 7, Vista, or XP, note the service in Command Prompt and type it into Google.

To shut down a service running in svchost.exe, see the two sets of instructions at the bottom of this page.

Why Is Svchost.exe Using So Much Memory?

Screenshot of svchost.exe instances in in Task Manager that are using lots of memory
Svchost.exe Memory Usage in Task Manager (Windows 10).

Like any process, svchost.exe requires memory and processor power to run. It’s completely normal to see increased memory usage of svchost.exe, especially during times when one of the services using Service Host is being used.

A big reason for svchost.exe to use lots of memory (and even bandwidth) is if there’s something accessing the internet, in which case “svchost.exe netsvcs” might be running. This could happen if Windows Update is working to download and install patches and other updates. Other services that are used under svchost.exe netsvcs include BITS (Background Intelligent Transfer Service), Schedule (Task Scheduler), Themes, and iphlpsvc (IP Helper).

Something you can do to stop the svchost process from sucking away so much memory or some other system resource, is to stop the services that are to blame. For example, if svchost.exe is slowing down your computer because of Windows Update, stop downloading/installing updates or disable the service entirely. Or maybe Disk Defragmenter is defragmenting your hard drive, in which case Service Host will use more memory for that task.

However, svchost.exe shouldn’t, under normal situations, be hogging all the system memory. If svchost.exe is using upwards of 90–100 percent of the RAM, you might be dealing with a malicious, non-genuine copy of svchost.exe. If you think that’s what’s happening, keep reading to learn how to delete svchost.exe viruses.

How to Shut Down an Svchost.exe Service

What most people probably want to do with the svchost process is delete or disable a service running inside svchost.exe because it’s using too much memory. However, even if you want to delete svchost.exe because it’s a virus, follow these instructions anyway because it'll be helpful for the service to be disabled before trying to delete it.

Note: For Windows 7 and older versions of Windows, it’s easier to use Process Explorer. Right-click the svchost.exe file and click Kill Process.

Screenshot showing how to stop a service in Windows 10 Task Manager
Stopping a Running Service in Task Manager (Windows 10).
  1. Open Task Manager.
  2. Identify the service you want to disable.
    1. To do this in Windows 10 or 8, expand the Service Host: <service name> entry.
  3. Right-click the Task Manager entry for the service you want to shut down, and click Stop.
    1. Windows will immediately stop that service. Any system resources it was using will be freed for other services and applications.
    2. If the service won’t stop because the program is running, exit it. If you can’t, you might be left having to uninstall the software.
    3. Tip: If you don’t see the option to stop the service, make sure you’re selecting the service itself and not the “Service Host” line.
Screenshot showing how to disable a Windows 10 service
Disabling a Service From Starting (Windows 10).

You can verify that it’s been shut down, or permanently disable it, by locating the same service in the Services program (search for services.msc from the Start menu). To stop it from running again, double-click the service from the list and change the Startup type to Disabled.

How to Remove an Svchost.exe Virus

You can’t delete the real svchost.exe file from your computer because it’s too integral and important of a process, but you can remove fake ones. If you have an svchost.exe file that’s located anywhere but in the %SystemRoot%\System32\ or %SystemRoot%\SysWOW64\ folder, it’s 100 percent safe to delete.

For example, if your Downloads folder contains a Service Host file, or there’s one on your Desktop or on a flash drive, it’s obvious that Windows is not using that file for important service hosting purposes, in which case you can remove it.

However, svchost.exe viruses are probably not as easy to delete as regular files. Follow these steps to remove the virus:

  1. Right-click the svchost.exe process in Task Manager and click Open file location.
    1. We won’t do anything with that window just yet, so keep it open.
    2. Note: Remember that if the folder that opens is one of the System folders mentioned above, your svchost.exe file is clean and should not be deleted. However, take special care to read the file name; if it’s spelled even one letter off of svchost.exe, you’re definitely not dealing with the legitimate file used by Windows.
  2. Right-click the same svchost.exe process and click End task.
    1. If that doesn’t work, open Process Explorer and right-click the svchost.exe file, and then click Kill Process to shut it down.
  3. If there are services nested in the svchost.exe file, open them in Task Manager like explained above, and stop each of them.
  4. Open the folder from Step 1 and try deleting the svchost.exe file like you would any other file, by right-clicking it and choosing Delete.
    1. If you can’t, install LockHunter and tell it to delete the file on the next reboot.
  5. Install Malwarebytes or some other spyware removal tool, and perform a full system scan to delete the svchost process.
    1. Reboot your computer if something was found.
    2. Note: If the svchost.exe virus won’t let you install a program on your computer, download a portable virus scanner to a flash drive and scan from there.
  1. Use a full antivirus program to scan for viruses. There are plenty of options in these lists of Windows AV programs and Mac AV programs.
    1. Tip: It’s a great idea to have one of these always-on virus scanners anyway, even if a different virus scanner was able to delete the svchost.exe file.
  2. Use a free bootable antivirus program to scan your computer before Windows starts up.
    1. These are helpful when the other scanners fail because the svchost.exe virus can’t run unless Windows is running, and a bootable AV tool runs outside of Windows.