In software Svchost.exe
is a generic host process
name for services that run from dynamic-link libraries
(DLLs) within the Microsoft Windows operating system
At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in Windows XP
Professional (and derivatives, such as Windows Server 2003
and Windows XP Media Center Edition
) can run the following command at the system prompt to get a breakdown:
tasklist /svc /fi "imagename eq svchost.exe"
(NB: This command does not work in Windows XP Home.)
Due to being widespread among running processes, svchost.exe has long been a common disguise used by malware
to hide its presence from the user. (One of the common trojan horses
deceptively uses scvhost.exe). Users may then run tasklist
with no arguments and match the reported PIDs
with the previously shown Svchost instances. If memory usage appears abnormal, the user can look up the service names shown by their command on the internet to see if it is a known service or malware
The Svchost.exe file is located in the %SystemRoot%\System32 folder. The main registry key
involved at bootup is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
(values in this key will show the user at least a partial list of the actual processes behind instances of svchost).
The 30 April
, 2007 release of WSUS
3.0 led to reports of svchost.exe issues, including 100% CPU usage, memory hogging, and excessive laptop fan/power usage.
 See also