What Is Svchost.exe Process On My Windows PC? Is Service Host Process A Virus?

by islam ahmed

ut of the many system processes that run on Windows, one that crept me a lot in the past is the svchost.exe process in Task Manager. I still remember constantly worrying why is the internet slow because some unknown data kept downloading all the time. I was almost convinced that some malware was living on the system. It was later that I realized some Windows process was using the bandwidth. It was svchost.exe. So, let’s discuss what is this process in some detail.

A major milestone in the development of Windows came with the release of Windows NT 3.1. Microsoft started optimizing Windows to reduce the consumption of system resources. The Service Host (SvcHost) process was introduced with Windows 2000 along the similar lines.

What is the svchost.exe process?

SvcHost is a generic host process designed to cater the needs of multiple Windows services at once, rather than giving each service its own process which would increase the burden on the system. This service host process allows different services to share resources on the system including the CPU, RAM, hard drive, and other components. These services are linked to the SvcHost process with the help of DLLs (Dynamically-linked libraries).

In the past, Windows services used EXE files, but now, DLLs are used as an alternative. These files contain code that can be used by multiple programs and services. Thus, a common DLL file can be used by different services, and it’s easier to make changes to the code. However, the Service Host process still runs off an EXE file that’s located in the System32 folder in the Windows system drive.

SvcHost process can run in more than one instance where it hosts different kinds of services like Windows Update, Task Scheduler, SuperFetch, BITS, etc. Just take a look at the Processes tab in the Task Manager to see the different instances hosting one or more services. To get more information, go to the Details tab where it shows the process ID, memory consumption, status, etc., about the Svchost process instances.

What’s the need for multiple Svchost instances?

We can understand the working of SvcHost process running in Task Manager with the help of an example. Imagine you’re at a buffet dinner party full of hundreds of people. Now, one way is to let all the hungry bellies (Windows services) take the food themselves. But this would only result in chaos. The other way is to appoint a server (Service Host) who can provide food to the people.

In simple words, this is how SvcHost works. Not only the server could handle the situation efficiently, but the food can also be prevented from getting wasted.

Now, assume that the buffet is multi-cuisine. Some people might eat Chinese and some would like to grab burritos. So, we can have different servers (multiple instances) for serving different cuisines to the people.

If there is only one guy, it would be difficult to manage the situation where different people ask for different dishes. Some may even get angry at the server for causing delay. The same goes for the services connected to the SvcHost process.

If one of the services gets corrupt, it will affect the process and all other services related to it. It could result in unwanted consequences like the blue screen of death. That’s why there are multiple Svchost instances.

How to check services running under Svchost process in Windows 10?

There are two ways you can do that. One of them is already mentioned above. You can open the Task Manager to see the list of Service Host processes running in Windows 10 under the Windows Processes heading.

To know the list of connected services, expand any svchost process instance. Right-click the service host instance and click Go to Details to know more.

How to view Svchost services using the command line

In Windows command prompt, you can use the tasklist tool to fetch the list of all the running services running under SvcHost.exe. Use the following command:

tasklist /svc /FI “imagename eq svchost.exe”

It shows the list of all svchost.exe process instances along with their process ID and associated Windows service.

Is SvcHost Process a virus?

Apparently, it’s not a virus. Not until Microsoft has a change of heart or some rogue malware masquerades itself as the Service Host process. It won’t be surprising if latter is the case. The least you can do to spot a Svchost virus is open Task Manager and do some digging.

Under the Processes tab, right-click the suspicious Svchost process and click Open File Location. Now, you can check if you are taken to a system location that’s not normal (not located in the System32 folder).

If everything seems fine and you’re still worrying you can do a full scan of your system using Windows Defender or some third-party antivirus software.

Svchost.exe (netsvcs) is eating my internet data

As I told you earlier, one of the biggest concerns of mine was netsvcs process; it’s a subprocess of Service Host responsible for various tasks in Windows. It’s used by a number of Windows services like Windows Update and BITS. People usually see unknown bandwidth usage on their machine even when it’s idle. This is because BITS is using the bandwidth to download system updates.

You can stop BITS services by going to Task Manager > Services > Right-click Background Intelligent Transfer Service (BITS). Now, click Stop. Doing this will stop the download.

Alternatively, you open Resource Monitor > Network tab. Here, right-click svchost.exe(netsvcs) and click End Process Tree.

Important: Although it’s not recommended that you should stop a svchost process, I have done it sometimes and observed an immediate drop in the bandwidth usage. But you should know what you’re doing.

Svchost.exe is consuming my memory: what to do?

Some users have also reported memory leak problems like 100% CPU usage on their PCs. Due to some reason, the Svchost process starts gobbling memory on the machine to the point that it starts to slow down. You can spot such svchost.exe instances in the Details tab, look for high usage in the Memory column for a service.

Right-click the process and click Go to Service(s). There it’ll highlight the related services causing the memory leak.

So, this was a brief piece about what is svchost.exe process and some related issues. If you have something to add, please drop your thoughts in the comments below.