| All comments about svchost.exe: |
 Alex | Service Host Process for services that are run from DLLs |
| Tino | Microsoft Dienst |
 Frank Ulbricht | versteckte Datei von Orvell Monitoring, wenn nicht im system32 Verzeichniss. See also: Link |
| Pere Arroyo | In my computer runs a hidden version of svhost.exe, reallly is a lite version of serv-u ftp server, this serve runs on tcp port 65000 |
 God | It all depends which ones u have if it uses more memory than explorer it is a parsite if it dosn't its all gd. |
| robert | das ist eine datei für das netzwerk |
| Jay Wad | When I Try To End Process Message Appears System Shutdown In One Minute..., Save Your Work In One Minutes. |
| static | makes loads of copies of itself |
 Brian Clemens | SVCHOST.exe keeps trying to go on the internet, thankfully my firewall doesn't allow it too. |
| ich | Diese datei wird häufig als serv-u benutzt |
| Troy | Worms like MS-Blaster target a bug in svhost.exe. It sends a special packet. The packet has to be formed specially for 2K or XP and, if it sends the wrong one to your system, causes svhost to crash, which can force a reboot or make you lose copy/paste functionality. Svhost itself, though, is NOT a virus. A virus wouldn't announce itself with a nice error message stating its name. |
 Jason | Disabling unneeded services will reduce the count of these.... It is exactly what it says... loads a service dll into memory... you can block or allow external or local traffic depending on exactly what service it is running, you might not want to allow traffic for some of these, but you may want others, danger level depends on what it is loading and what access is allowed by your security software and settings See also: Link |
| Dj_Cobra | It can host a lot of viruses, the little bastard :)). It recently opened its arms for win32.Hidrag (a.k.a. win32.Jeefo). |
| DataFighter | Die svchost.exe ist ein Systemprozess. Mit ihrer Hilfe werden dll - Dateien ausgeführt. Die svchost.exe taucht öfter in Ihrem Task Manager auf? Das ist kein Fehler, der Task Manager ist nur nicht in der Lage alle Prozesse namentlich getrennt aufzuführen. |
| Radd | It is supported by Microsoft See also: Link |
 rupweb | It allows Windows Update to run in the background using BITS. See also: Link |
| Tasha | There are copycat virus' that have the same file name,even worms.I'm staring at one now that housecall found thats in the common files folder.So be carefull people. |
| XambeR | I have 5 svchost.exe (System) runing on my processes, one of them are using 25000 K i dont know why, does somebody know? and i got 2 other svchost.exe The one is Local Service and the other is Network service :S |
| | its taking 100% cpu .dont know what |
| Iordachi Adrian | Sometimes, it uses 99% of my cpu occupation, so I have to reset my computer everytime it does that. |
| petrorig | i cant copy or paste files..mouse clicking doesnt work i cannot drag file, it peaks at 100 percent of CPU usage and is locked there until restarted |
| BBY PAVEL | It will take all your CPU procent in runing future proceses installed after it's arrival |
| minämies | I have four copys of this program running at the same time and my cpu-usage is at 100% all the time,it does do something |
| | microsoft dienst |
| Michele | It's very, very annoying, I have to restart my computer every 20 minutes, it makes links stop working, and makes it impossible to do alot of stuff, is there a way to get rid of it??? |
| | svchost is required to operate your PC. Leave it alone! |
| Terry | Once again, this program is required by windows to run. If you terminate a certain instance, it WILL cause windows to shut down and restart. See the microsoft description below. See also: Link |
| dsa | It could be a harmless system file, or belong to SpyAgent key logger See also: Link |
| Raj | using this exe, some applications tries to connect to internet and due to the multiple sessions of this exe, the whole system slows down. Even switching between the windows is very slow |
| Shio | This is one of the some svc host programms. If terminated, unleash the RPC Procedure.. See also: Link |
| Alex A. | Trojans can run under this name as well as genuine versions of svchost.exe |
| | caused major problems with windows XP not loading correctly |
| Dr. Dee | MS says this is a generic server that handles interprocess communications. It can load multiple instances of itself to hand bundles of related processes. It is an ideal alias for trojans, worms, and viruses. To see what processes use it, use the "Run" button and bring up a DOS terminal and enter "tasklist /SVC." |
| Alan | I have 3 of them running. The are Local Service, Network Service, and System. I also get about 20 minutes online before the pc just shuts down. I run XP Pro on an old AMD Athalon 800, with no probs. This just started, so I suspect 2 of those are not supposed to be there. See also: Link |
| A friend | aparently it is a vital process for Windows so its better to not mess with it. However sometimes it will act strange and start consuming memory, this has only hapened to me a couple of times then I ran an antivirus and since then everything has been OK |
| Jim | While it may be Ok if in it's correct location ie under System32, be very careful if you find it located in either Program files or Program Files Common folder. If in that location it is a worm. |
| Qasim | Yes, svchost's multiple copies (wierd) on my computer keep trying to access different servers. I use Zonealarm's firewall and thanfully it blocks these attempts automatically |
| Mike | causes me grief at times, will use 95-99% of CPU resources, for up to 20 minutes after boot up. I will show up to 3 of these in my task manager, but only 1 takes the power. |
| Tribune | Svchost.exe DOES NOT need access to the internet. I would suggest that Brian run a spyware or virus program immediately! |
| | svchost uses a total of 40MB in 6 different tasks.... that's funny... 3 system, 2 network and 1 local |
| lefty_whiz | I know that my Panda blocks 400 attempts daily, and treats it as spyware. |
| Jonathan | It causes your to computer to kind of crash since it is using 100% CPU |
| Brian | used 100% of CPU: 2 on system: McAfee got rid of the nasty second one |
| fi | mine also keeps trying to run when I connect to interent |
| G-unit | it won't let me access the internet See also: Link |
| ?Ricardo! | This is one of the most annoying (alongside ctfmon.exe) of the windows processes. Why do we need 5 of them running simultaneously? I know it doesn't use many kbs but its still annoying. |
| gzibret | it can be virus with the same name like windows system process. Be carefull at removing it. Dont remove it from registry CLSID keys. |
| | a new dial up connection can't created even existing one not open. |
| | If you more then one instances of this file running check the file folder with STM |
| kcmidnight | is a windows file to run seperate program dll through it doestend to load on the memory when a process doesnt end properly,you can end it and it will restart .if it brings up the windows critical shut down counter, goto to :start/run and type shutdown -a and this will kill the counter. |
| velid_lav | I have 5-6 svchost.exe files, They are using too much memory |
| cri-kee | I have the Gaobot worm, I can't get rid of it, and I think svchost.exe is also involved... :( did anyone find a solution?! |
| MJN | it is relationated with the virus troj_istzone.h or .b it blocks the Internet conection there is also a version called svchostes.exe but this one is not as dangerous as svchost |
| vibin | when i close the svchost system will shut down |
| Iain | I'm using XP Pro/SP2. svchost is constantly accessing the internet. If I stop it with my firewall, my own email program cannot pick up email and MS IE works very much slower, if at all. |
| dtg | check security log in event viewer of administrative tools from control panel.most logs should have no events.mine has authentication projects and logon processes.Not Good. |
| jayfox | This describes Svchost.exe and its functions. Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs). |
| Opfer | svchost.exe war ein virus auf meinem pc , in C:\WINDOWS ( Jeefo.A ) , ...Start - rechtsklick arbeitsplatz´ Verwalten - Dienste und anwendungen - dienste ..und dort den dienst "Power manager" deaktivieren, das ist der Übeltäter..ist das mal deaktiviert,verbreitet er sich nicht weiter auf dem pc... ! |
| | it has something to do with VIRUSES! it drove me nuts for 5 days,I was scanning the machine with a lot of other antiviruses and antispyware programs,and I found a lot of stuff,viruses etc. Norton detected one that avg free did not,a backdoor trojan |
| | this file is started when i start my computer and can be seen in "startup". It slow my pc and other programs that i run. Muhammad Abid |
| Anonymous | It takes up all my CPU |
| Eggs | I have 2 versions on the company laptop. One seems to be a fake. |
| Caligoiel | I recently found this file keeping my system up to 80% busy constantly. It was infected and made my system run at a snail's pace. Clearing it up with lsp fixers saved the day. |
| ugrasena | you can not download the updates!!! |
| Preator66 | it uses 26.8Mb, but it may flutuates. when i put in an external storage device (eg. CD, external HD), rundll32.exe just keeps looping itself and makes the computer super slow. But, when i close (end task) that bad svchost.exe, everything went to normal, except no sound. 3 seconds later, that bad svchost.exe run itself again... |
| | There are four of these on my comp. They combined are taking up over 34MB. My comp. is running at 100% all the time |
| Kilamanjarofakushka | constantly get an error message saying that generic host process for w32 services etc. i simply go to C:/windows dir and delete svchost.exe 35.5kb. it only last for a couple of hours before regenerating. How do you keep it off? |
| Cruiser | Norton advise me about the c:\windows\system\svchost.exe is infected by a Trojan, but I cant delete. any help? |
| Ghost | svchost.exe is a windows file, while svhost.exe may be part of a virus. |
| Tanis | Uses 100% of CPU when a Network Process is working, Am able to Shut off Process and CPU % returns to 0. Unable to tell which service is causing this networking Process to start the svchost file. |
| ivan | i have personally had svchost in every possible place on the computer. on many ocassions its permisions were bloked, which makes the game so much more interesting |
| Tweak | i get a physical memory dump ??? ne one can help plz i got 6 SIX copies of this thing running i go to end process and itr shutsdown my cpu |
| Kitsune_Baka | I have 6 instances running, the one making me suspicious is the one taking up 22,800 K. What do I do about this? Why is my CPU usage at 100% this is bothersome! |
| | Nervt, weil sie viele Systemrecourcen in ansspruch nimmt |
| serge | system process. no danger if you have a safe system |
| cyberblob | Resource's waster ! Do we have-to live with this one ? ;-)P |
| Sharvil | it's a vital part of windows and creates flaws in the security. its an essential but very dangerous file. |
| M | This is a useless website that provides a place for people to voice their comments, whether useful or harmful. |
| zonealarm | holy crap when i installed zone alarm... everytime i try to play my games or turn on any programs my computer crashes ... i also keep gettin w32....viruses. andi couldnt figure out where they were comming from. |
| si fi | harmless see support.microsoft.com |
| Spyra | I just ended task on the one that took 99% cpu and puter running fine for the moment |
| Dave B. | Eats up resource and provides open door to various unwanted ap.'s and cpu drainers. Needs to be reworked to include less CPU calling. |
| Prophet | This should be the Windows RPC service. It is also required by javascript and vbscript, so if you remove it, webpages and folder views will look strange and not work. Unfortunately there are several viruses, worms and trojans that either disguise themselfs as this file or actually use a security hole (RPC+DCOM) in the real microsoft file to take over control of it remotely. (the MSBLASTER worm is an example) Make sure you have the latest security patches from MS. (Why the hell did they make RPC a required system component anyway!?) |
| Chris | Every 5-10 minutes Norton Internet security keeps telling me that a low risk program (svchost.exe) is attempting to access the internet. I have tried many times to have norton allow, configure, deny access and still get the same alerts! |
| | it's supposed to be in the system32 directory, I have a copy in the windows directory which is 124k, the one in the system32 folder is 12.5k, I |
| Tiggerboyee | People be Careful. Go to start, run, type: "tasklist/svc" and see where these process are running from...with a little investigation you will find out which ones are not in the system32 file in windows. |
| tomas berrum | its what your video card runs under and its not dangerous if your running windows xp and close it your computer will look like windows 98 |
| Scott | It runs fine on my computer but I block it from the net anyway |
| Geester 314 | I think there's ONE good one and the rest are crappy viruses or the like. I'm havin truble w/ this one---I got the one minute b/s message too. |
| U.P. | infiziert massenweise .exe dateien |
| iamevl | check it isnt scvhost.exe as this is a trojan. svchost.exe is a microsoft program and is not a trojan/virus but can be attacked by other trojans. you will usually have as many as 5 running at the same time-this is normal. i recommend using norton with all updates. ad-aware adwatch and if you still have problems find a forum and post your hijack this log someone will help you. they are good like that! |
| | I just blocked an incoming attempt from an ip originating in china which tried to connect to all adapters using some port |
| yoon | it's running 5 times in my windows taskmanager. :S 3 times system local service and networkservice. (win server '03) |
| Ian | Don't know if it links somehow with CISVC, but ever since disabling "Indexing" this 100%CPU issue dissappeared for me. |
| | generic host process speaking shortly. Any way if you it is somewhere else except /system32 delete it. If you got problem, run win in safe mode, then delete. Dont worry. |
| Thomas | Es will nach Verbindungen zu anderen Computern lauschen und auf meinen MSN Messenger zugreifen. Ob ich es blocke oder nicht, mir ist noch keine Veränderung aufgefallen. |
| Alex Raptor | if ur cpu is running at 100% it could be a trojan or a worm try the link google and typ on search windows trace remover is svchost.exe running 4 different times thats oke its part of the os but the trojan or worm is using that system to hack ur pc or is already downloading files!! See also: Link |
| Delwin | May be a virus if file is present somewhere else than system32 folder See also: Link |
| James Balletta | XP gives more info if you type "tasklist /SVC" at command prompt See also: Link |
| @Damski | A strange and annoying M$oft program, yet another reason to go Linux.....I keep it blocked for internet access, yet sometimes I find that Mozilla Firefox cannot connect to any sites unless I allow svchost.exe internet access. I try always to block it's access See also: Link |
| laughing | run cmd and go tasklist /svc and you'll see all the apps this "service" is running |
| BrainScanMedia.com | This file is used for networking and communications! if removed or blocked by a firewall then there is no more internet connection and nothing will work. This program is very dangerous. It allows any DLL including AOL AIM and other programs to access its communication ports. My firewall has been picking up incoming connections on ports I don't even use and that would be considered spyware or virus. MS better get their act together with security or else they will have more lawsuits on their hands from companies being broken into due to a faulting communications program. We have no control! See also: Link |
| Boris Beckham | svchost.exe is a brilliant execuatable that prevents your computer form being inundated with corrupt files and internet bugs. It does this by utilizing existing 32 bit DLL's and Norton antivurus code |
| Kevin Wilson | What a little pest this thing is. First of all, is it scvhost.exe or is it svchost.exe? I've had a LOT of problems with this little file. Basically, scvhost.exe keeps causing 2 pests to recur on my machine. I can remove these pests using Pest Patrol, but they just keep reappearing, esp on windows startup. So I disabled the scvhost.exe under the Startup tab in the system config utility (msconfig) and this seems to have done the trick. |
| OGK - spAzo | It Seems pretty Necasary (excuse spelling). Pisses me off though because i have about six running and gamers are very nosy about whats using their RAM |
| NewsLetter | I delited all SVCHOST.EXE's and now on windows start up it asks me for it in ..\windows\svchost.exe I cant find it anywhere O.o |
| bendzins | svchost.exe takes 99%-100% of CU usage...it is a virus...visit See also: Link |
| Marzwar | If you get the RPC System Shutdown...do Start - Run - and type "shutdown -a" (for Windows XP) to end that process...although..it is a "needed" component for windows to run..so maybe you should leave it there? I dunno but it keeps multiplying and making my pc slow as hell... |
| loghman | its so dangerouse. all of my program that I compile in delphi has this virus.I say it again! it's dangerious!!! |
| Kilian | Nimmt unerklärlicherweise zwischen 60 und 90 % meiner Systemrecourcen in Anspruch und macht meinen PC daher super langsam!!! |
| andrew | svchost.exe when running 100% , it means you are in danger of being exploited at that moment. try to restart ur pc.. but only a matter of time your pc will experience svchost.exe 100% again. internet is full of hackers and worms. better have antivirus running when experience 100% of svchost. very common got trojan in ur pc already. this svchost.exe is very vunerable to exploit and attack. it is very lousy product when dealing with internet. |
| andrew | these file can be deny access to internet. must be deny, else your pc will got 100% load (you are being exploited, there are files being x'fered into ur pc under your nose) . if you force shut it down using 3rd party application, then your pc might not function properly, like what they said, auto shutdown in 1 mins (use cmd , type in shutdown -a to cancel that auto 1 mins shut down), or you might experience file explorer can't do copy , move... right mouse click got problem...etc.. weird sort of problem, at least the person who tried to exploit you failed. you still can continue to use interne |
| andrei | used by the OS as multiple processes. never had any problems with it. |
| Volod | Super place for trojans |
| Tarek | It slow the computer in a way you can't work, it corrupt exe files |
| Gasur | Critical System Process - LOL Jay Wad - you can avoid the automatic shutdown when that message appears. Simply type shutdown /a in the run box and the autoshutdown process will stop. Usually you'll find that you no longer have sound (or other capabilities). Svchost will run for MANY programmes, if you keep your sys clean with AV and Antispyware/Antitrojan scans, then you've nothing to fear. |
| Erika | my virus scan finds and removes some svchost-caused trojan at least once a week and at most a few times a day. What's the cure? On-Access Scan mode. With a good firewall and a virus scan running simultaneously, this should not be a problem. Do not mess with svchost, as you may damage your computer or force it to shut down. svchost itself is not the problem, it's the virii, trojans, worms, etc. that mimic its name you need to worry about. |
| Craig | svchost.exe is sort of like rundll.exe except is for running some services instead of running DLL's. See also: Link |
| Barb | It is a Windows file, but is annoying in that you can have multiple instances of it running and sucking up RAM resources. Don't try to end the process or you could end up shutting down your computer |
| Alan | I have 7 of these running on my computer..One uses more memory than explorer..Virus scans find nothing though...I only have one of this file in my computer when i search. |
| Rao | there are four files of the same name SCVHOST.EXE and they shoot up the CPU usage to 100%.This makes normal offline working also horribly slow. Added to this is the RPC error system shut down in 60 seconds. While spyware guys have their reasons, it is better if they realized that many of us use the computers for earning our bread working on the system (doing taks like editing and typing data) . So Please stop this cynical and sadistic kind of programmes. |
| sw | svchost isnt dangerous at all...but viruses take advantage of it. do not mess with the prog itself, if you are havin problems then try to find worms i.e. |
| | It takes up all my CPU.... |
| | there is a virus but the name is diffrent: scvhost c before v |
| KiLLa | Takes up alot of memory! |
| AWAIS | very important file for windows |
| Bob the man | it makes my internet all solw and pausy and msn wont sign in |
| Paradox | I have tons open, but just three copies, one in sys32, the update, and a "prefetch" file |
| John Moody | If it is scvhost or spoolsrv32 or spoolsrv.exe then it's the AGOBOT VIRUS removal is easy |
| Mashira | There's a normal file and one with the same name, but is a worm. It keeps coming back and sucks all your CPU power |
| Tom | I find the one run by "network service" starts using up all of the processor power, slowing down the internet or stopping it sometimes. |
| Prometheus | Easy to contract, even with some virus & Firewall protection, Hard to remove! Ony clue your infected is the svchost.exe running CPU cycles up to 100%. |
| dt | the message appearing that your computer is going to shutdown in one minute is due to a virus infection .the name of the virus is sasser worm . microsoft has released the patch for it and it can be obtained from its home site |
| | I'm reading that this can run in multiple instances, it's running seven seperate times in my task manager and when I ran a search for tis exe It only comes up in two places: c:\windows\system32 and c:\windows\servicepackfiles\i386 ...something aint rite here! |
| Starlite | All I know is it slowed my computer down and my spyware identified it as malware. My computer techy deleted it from multiple locations in the drive and in the directory. I hope this works. It renamed itself in my windows temp folder every time I restarted the computer. |
| Wobbledoggy | Dependent on it's location, it's either a genuine part of the operating system (ie it's in c:\windows\System32 folder) - otherwise it should be deleted. I recommend that the registry editor is used to search for references to any other instances of this file, and those references deleted. Leave the genuine file alone, though! |
| Goyo | The real thing is a critical OS piece that may legitimately need to perform an Internet request on your behalf. It is also a common name for malware to try to masquerade. If you have problems with this file, shut down, take a few deep breaths, when the PC is about ready to load Windows again, start tapping F* to boot in safe mode without networking. Search for all files named 'svchost' and delete any outside system32. Shut down and do a normal boot. |
| Lars89 | This file is not dangerous if signed by microsoft corporation. but there are copies out there that may be a viruse. Everytime I boot up my cpu is at top (97-100%) and its only one that are hogging, its svchost.exe. I have stopped it but it keeps starting up in every bootup. For the time, I just have to spend 70 seconds (takes long time with 100% cpu to get up the task manager) to stop it from taskmanager! I do not like this process and want to KILL it! but, no way to do that! |
| Randy Lahey | I have three versions of svchost.exe (system) running in task manager and one of them is always above 35,000kb and each time I end the process it comes back. I just ran Symantec Virus scan and it says I have 6 detected viruses all of which are in svchost.exe(system)... |
| Pete | svchost.exe is harmless. It's just used for hosting programs / information. If you have a virus that appears to be svchost.exe, it is most likely a virus using the name svchost.exe. It does make copies of it self, however it only did this when I pushed my PC to the limits of memory and hosting. |
| Sphinx | It tends to get infected pretty regular in my experience. Another badly designed file. |
| Wizord | Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. |
| manvir | system file, which once infected with spyware will slow down ur computer. U cant stop this thro. task mnger. Cos it restarts itself again and again . |
| John | I too was having the 100% cpu usage problem whenever I started up IE. My problem also may have been linked to indexing. I switched 'DNS Client' to manual using the XP component services manager and now I have no problem. I suspect the CPU usage thing may be more a software than malware problem--potential XP service pack 2 glitches. |
| Joe Koe | Its a secure file you can trust See also: Link |
| Afeek | If svchost takes up 100% of cpu it is a virus. If you click see also: Link it will ask you if you want to download the software for this virus. See also: Link |
| Afeek | Get removal tool at this link http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html |
| Mr Duckk | c:\windows\system32\SVCHOST.EXE is a VERY important file required for the proper operation of your Windows. Some of the links already pasted will give you details on why it is so critical. Now if you have a file with the same name 'SVCHOST.EXE' in a DIFFERENT FOLDER, any other folder apart from system32, THEN and ONLY THEN could it be a cause for concern. So just run a file search on the file on all drives including all system and hidden folders, and if you find any instances of this file in any folder other than windows\system32, then delete it immidiately. |
| | i don't much about this file but i agree that it affects your CPU usage. I tried to disable one of them since i was running a couple, and it shut down my computer... |
| | if it gets on to your internet files it doesnt' let you to go on some web sits |
| Ville N | About 100% memusage:It is most likely the rpc worm. If you didn't have a service pack installed, your system would've bootd automatically, but because of your service pack installation, this msblast worm will just reserve 99-100% of one of your svchost.exe. You have to go and apply a patch KB823980 (msblast). You can google it e.g. "index of" msblast - 1.2MB file called WindowsXP-KB823980-x86-ENU.exe for xp at least should do the trick. If you are patient, you could go find it from the mazes of microsoft.com too. There is also a virus called scvchost.exe in addition to those already mentioned |
| | the file isnt bad, its just that MS. Blast has the same names in different directories... i stuck with that virus i dont know what do to, i formatted my comp about 5 times... and its still there, i didnt even connect to the internet and i saw the Svchost.exe on task manager, I do end process or end process tree and i it shows the "shutdown |
| | i have two of them running on my pc when searched i get only one |
| mick from australia | i have 5 or 6 on my cpu... it doesnt slow it down at all! i have an AMD athlon 2400+ and this process never slows it down the slightest, my computer used to be slow... but i cleaned up all the spyware and it sped up alot... also most spy ware programs dont pick up all the spyware... make yourself a list of all your running processes then investigate the folders they are in and their signatures which usually give you alot of hints as to what should be running and what shouldnt. my computer runs at about 0-4%. and regularly check the processes that are running to make sure you dont have anymore. |
| Brown | i deleted it svchost, but in need. how do i get it back |
| jon domico | it needs to be on my computer |
| kikoku | If your system is slow it is not because of svchost. It is because you have spy/ad ware, you are trying to runn to many apps at once or because your system just plane sucks. The majority of the people here say to leave svchost alone, so... JUST LEAVE IT ALONE. |
| b0b | 7 times in my task manager, 4 times system (cca. 35M of memory), 2 times network (cca 7M of memory) and once local host (6M)... |
| Chris | alright, ive got 4 going, and my pc is suing 3 % of its usage percentage, therefore svchost.exe is a safe file |
| Evert | Uses 100% of CPU and blocks other pending operations. When I stop this svchost.exe my processor occupation goes straight down to normal level and my PC works normal again. |
| | if your runing XP and svchost.exe is in c:\windows\system32\svchost.exe leave it alone, but if your on any other OS make sure you delete it might be a IRC backdoor used to scan/upload to other peoples pc. |
| sean Yee | using 97% of CPU time.. |
| Bomvelt | No danger. See Microsoft & Symantec. |
| Shatadal Mandal | Very dangerous exe takes whole of CPU can't delete or diasble makes the performance of m/c almost zero. Guranteed its a virus |
| Anastasia | As "God" said, "...if it uses more memory than explorer it is a parsite if it dosn't its all gd." -- my svchost.exe uses about 14,000K while explorer uses 9,000 -- should I be worried? and if it is a parasite, what do I do? is it still necessary then for the system to run? also, it tries to access the internet... |
| Rainay | I have 2 of them in my System Network Process and 1 in my Network and 1 in my Local Process. Which ones can I safely delete? |
| Mistah | I have 6 of them running all the time on windows XP when i close them they make my computer look like windows 98 an its horrible. Not a problem with CPU usage, highest is 7.938k |
| Martin | If it needs all your CPU usage, then go into the Taskmanager, right click it and end it. Then the PC will shutdown in 60 sec. To stop that, you need to press start, run write cmd. Then a Dos window appears and you can write shutdown. Then it will stop and you can go on. The link below is in german! See also: Link |
| Marcus | Normally safe but can represent a disguised parasite. To prevent shutdown after ending this process, in CMD prompt run 'shutdown -a' |
| Si UK | It stands for Services Host. I have 3 instances of this file running, 1 is in Local Service and 2 are in Network Service. But as I know what it is I will share it with those of you who are getting worried. The process in Local Service Is my System, The other 2 in Network Service are my other 2 systems which are networked therefore 3 systems on a network 3 Services Host Processes. 1 svchost per networked user. See, not that difficult. As always, if in doubt close it, but you WILL lose network access and your system may become unstable |
| moses | Die Datei benötigt über 25000kb, wenn ich versuche sie zu deaktivieren erscheint eine Warnung das sich der Computer in 1 Minute abshalten wird. Ich kann keine neuen Datien Installieren und die CPU Auslastung steigt manchmal auf 100%. |
| matze | Service Host Datei die man Braucht um DLL's zu starten. Gefährlich wenn ausserhalb des WIndows\system32 Verzeichnisses |
| Julio | OS Part See also: Link |
| Davin | Everytime I start my computer, appears a message that says "svchost has generated errors and will be closed by windows" I was opening the task manager to stop it but now I can´t open the task manager |
| Nida | This file really fadeup me, cuz its slow down my system speed, and some time it irriates me too much when its disable my copy paste option ,and all the time i have to restart my system |
| Neko | It hosts multiple services, and it seems to fork multiple copies of itself to handle those services... ok so far nothing wrong with that. But now I've seen a weird 'jerkiness' problem when playing movies or games, and one of those svchost.exe processes jumps to 100% cpu momentarily... it is also using a lot more memory than the others. I havent yet discovered if this is a virus installed as a service, or just some badly written service that got installed as part of some other junk.... |
| Hell | svchost lstet die cpu zu über 90% aus und bremst daher mein system ungemein aus und es lässt sich nicht deaktivieren da Windows sonst innerhalb von einer Minute herunterfährt ich habe bisher kein Programm gefunden durch das sich dieses Problem beheben lies |
| Ben | Stop complaining about symptoms and start looking for causes. svchost.exe cannot be deleted. use task manager and show the PID, then use tasklist/svc to identify which services are using the PID in question. My 100% usage was being caused by my DNS Cache complaining about using a large hosts file. I disabled the DNS client service and the problem is gone with no side effects. This was nothing to do with svchost.exe rather the service that svchost.exe was called to use. |
| Pi | It is not spyware or a virus if it is in Windows/System 32. Don't block it! If you block it, some programs might not work (including Mozila Firefox). I don't know why it used 100%of the CPU because it didn't on my computer. I will respond again if I find out. It is not bad if there is more than one running. For XP, follow the link for more info. See also: Link |
| | This is taking up 100% CPU memory at times and you couldn't really tell between the fakies and the real. A real headache! Have formatted my PC twice! |
| Been affected | These processes uses alot of memory and it has it's reasons.It usally causes high percentage CPU and ends with a crash. you can try and delete etc, but i suggest you get an expert you can cause more problems. |
| Max | Every time i start my computer this file takes all the memories and makes my PC slow |
| Lonteo | This file is dangerous because it links to others exe files so that if you delete it, it will not allow others programs to start; and when you shut down your computer under windows XP, it shows you an alert message saying that an error occured while trying to shut down your computer because of svchost that is still open. Last week I got a huge virus attack an I accuse that file to have its own responsibility of that. |
| Bruno | attempts to connect to a hacker site. My firewall did let it happen. |
| l0d1z | It sucks my cpu 100% but srangely i can still write this, anyway i hate that it is so easy to take advantage of and I am having a real problem taking care of it arrg! |
| The Bad Guy | 5 or 6 instances of this proces tunning, slowing down my system. If i want to shut down the proces, system will shutdown in 60 sek. - shutdown -a then it stops but i can't close all instances |
| | I run Norton Internet Security 2004 on my machine and yes that TCPSVC thing is trying to listen to 4 ports. That started since i went to XP SP2, but then I turned on XP firewall too and that thing is trting no more to connect. I run Norton as well. |
| Vlad | It is used to operat different network processes for Win32 , so this is a necessary system process , although it is a multi-process ,and eats a bit of virtual memory too ...So leave these processes operating , but if you have any suspicions on `em - scan `em with some adware\Spyware tools ...ANd don`t try to manually shut `em down ! It will interrupt different network processes (depending on what processes are the svchosts up to in this moment) ... |
| *+*dj_mc*+* | it takes up a lot of free memory in your ram |
| Denreb | Wird wohl auch benutzt für automatische Windows-Updates wenn diese Funktion im Windows-Sicherheitscenter (Systemsteuerung) aktiviert ist. Dies ist wohl eher unprolematisch. Ggf. kann automatisches Update deaktiviert werden und regelmäßig manuell gestartet werden falls die automatische Internetkommunikation verhindert werden soll. |
| K34 | The Windows Update use it and need internet access. See also: Link |
| Jeepy | It Helped me understand a lots of procces on my computer and now everything is clear |
| kindlyss | windows process, no dangerous |
| mygale | Incredible, there are people saying a program which takes 100% CPU is normal and harmles! Go Linux. and see the difference. |
| Matt | I have 6 instances of it running on my task list, 3 of which are User Name "SYSTEM," 2 of which are User Name "NETWORK SERVICE," and one which is User Name "LOCAL SERVICE." |
| GiGaBaNE | My sysyem seems to vary between 4 and 6 instances of svchost.exe running. as i write this i am only running web and antivirus and mine suck up 40mb ram but mine use NO cpu unless i do something like open an explorer page which takes about 2%. (not sure of cpu usage at boot time as i have a swift pc and its over pretty quick) im sure its "essential" but i would rather have a full processes list which i can tune on an individual basis not this, 6 instances with several services running under each :( |
| Loloy D | The timestamp and size of legal copies of svchost.exe is as follows: 2001/08/23 11:00 PM for XP SP1 and 2004/08/04 12:56 AM for XP SP2. In its property pages, it should list "Generic Host Process for Win32 Services" as its description. Other than that then it's a virus. Check if you have other 'illegal' or 'invalid' copies of svchost.exe from your system then destroy them or rename them safely in safe mode. |
| jacob | i know that it is a normal window process that is hijacked or something. EVERYONE KNOWS THIS IF YOU READ THE STUFF ABOVE. what i want to know is HOW DO YOU FIX IT? i've run mcafee, adaware, spybot, avg antivirus, and none of them fix this problem. is there a way to stop it? please help schranz_addict@yahoo.com |
| Raouf DenkDas | What if svchost.exe is located @ ServicePackFiles/i386??? 'Cause I'm looking out 4 the cause which makes my PC shut down when my game.exes grow upon 100.000 K - like GTA-VC, Vietcong, FarCry, Anstoss 4 and so on. Really annoying, my AntiVir can't find a virus, but it shuts down frequently. |
| Salman | my system got slow very much. I noticed that svchost task tasking total system resources regulary and sytem becoming very slow when that is happening. Network cable unplug and and plug in back doent wok on my pc. I ran symatics welch.exe, but coldnt find any sort of worms or viruses |
| ConcreteMonkey | Rated 2 as the original is not dangerous at all. If you think you have a virus that is disguising itself as svchost.exe, then double check it's source directory. If not in c:\windows\System32\ then stop the process and run a virus checker. Run more than one ind to be sure. |
| Jamie McGlynn | It is a generic process for enabling dynamic-link libararies, I am not sure but ending any of these processes will result in an AUTOMATIC RESTART in 60 seconds. If you notice anything named this under the user SYSTEm or NT AUTHORITY, DO NOT END IT. See also: Link |
| Marko | I think that svchost.exe is a virus even if he is stacioned in windows 32.He slows the speed of my internet to 1.1 kb/s.Please give me an advice what to do.Greetings from Serbia and Montenegro |
| | I think, this is a spy for microsoft too. And when you lock from internet, you can't use the internet. So you must enable to this exe to access the internet. I think this is very dangerous. |
| CY | Why the hell is it always trying to access the net? if i let my firewall permit it, "windows messenger" popup ads start appearing on my screen. Are there some spyware imbedded? |
| Hans | It is open more than 3 times. Try to close it, close the wrong the computer shuts down, shi* windos, but try "shutdown -a" it helps, greetings from germany |
| Cruoris | It's an integral WinXP system service. There may be multiple instances running and it is used to manage other services loaded in the operating ststem See also: Link |
| el rumano | this file has the routines for dcom connections and is verrz dangerous becouse anybody can connect to your commputer on the dcom port |
| Madhu | when i worked on my friend system i saw this message "system will shutdown in one minute" I installed the patches then it disappear |
| Mystic-Danny | I have too many instances running of this file on my notebook, right now 7 !! Some of them use to much of my system resources. |
| PowerUser | block it in your firewall andeverything will work fine. Yes its a windows system tool and a damm microsoft spyware. |
| Joma | It can be dangerous. Download a security task manager and that will help clear u some problems |
| Gooterz | How big are your svchost.exe files because if it has been affected it would change size |
| raj | sdbot trojan / virus is causing 100% CPU utilization and paste facility disabled and See also: Link |
| | necessary for normal functioning if you suspect it is a virus do a virus scan |
| cheers | frisst mir 100% cpuleistung! und ich hab einen 3.6Ghz, dat is net normal! |
| lin chu chin | There is not a clear explanation of what it is, so it's dangerous |
| Gunjan | System doesn't boots and takes all resources and CPU gets hanged |
| Jowell | it causes my pc to shut down, im losing business coz of this.. |
| Siim | Keeras täiega sitta, üks neist. |
| Gingis | It makes computer run very hard |
| DeDiCaCeX | svchost its not dangerous and i have a pentium 2 350 mhz and 256 meg of ram and my cpu its at 100% sorry guys the scvhost its not a virus so if you want to reduce it put a antivirus like panda and download xoftspy , adware registry repair , registry mechanic ,pc onpoint ,,system mechanic and much more can help and so you can disable some many thing on msconfig and the services.msc for reduce cpu and ram and if you dont know what disabled download the blackviper so take of what you do its at your own risk you can break your pc so i hope of what i said its helping you all thx and welcome see |
| farstrider | The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging.Note: In other cases, svchost.exe is a virus, spyware, trojan or worm! |
| Mattue | It is required by Windows to run...however there could be another programme with the same name that causes trouble. I'm not sure when I checked I found two of them one under LOCAL SERVICE and the other under SYSTEM and they don't use much memory so I guees some people have been going to some bad sites or just have stupid people sending them email...I had a computer without protection for a year and had no security trouble, so I guess you're all doing something wrong |
| Bruce | First off, I'd prefer if they coded their operating systems with a lil more care. I mean, why shouldn't I be able to kill off -any- process and prevent it from running? I can bloody well kill the kernel in decent operating systems. Furthermore, I gots an infection, windows/svchost.exe (should be in sys 32) and I can't put a stop to it pernament even using microsoft spyware. I use windows only for gaming, but still. Bloody stupid operating system. |
| Null | If SVCHost is using too much memory and/or cpu resources, you can deselect some services that are practically useless in "Services" under "Administrative Tools" which in most cases is available in the "Start Menu" Read descriptions, and use your descression as to whether you ddem the process unneeded. Some services such as "alert" and "messenger" are commonly used by adware and are, in my experience, never used otherwise. |
| Terry E. | I found SVCHOST.EXE-2D5FBD18.PF located in C:\WINDOWS\Prefetch (28kb), Type: PF File, dated 8/13/2005 (my local date). I deleted it, and it's sitting in my recycle bin. Does anyone know if this particular file is legitimate or illegitimate (meaning safe and normal or unsafe and abnornal) for my computer. I'm running Win XP sp2 Ver.5.01. I'd appreciate any info/assistance on this one. Thanks in advance. |
| Doom | All of you blaming SVCHOST.EXE dont understand that its a event handler for windows! You're basically saying 'its my computers fault that i got infected with a virus'. If you terminate your SVCHOST, you've basically shot your computer in the foot. and its not going to run anywhere after that. Having odd SVCHOST behavior is a symptom of a problem somewhere else, so keep on looking. |
| carib | I have 6 svchosts in my task mangr. 3 say SYSTEM, takes up 2,200K, 22,600K, 2,200K. One's under LOCAL SERVICE. 1,350K. Two are under NETWORK SERVICE. Uses 1,300K. Is ther a chance that theres a bad one in there? is hte 22,000K legit? also i cant get hte tasklist/svc thing to run. what am i doing wrong? -- processor takes about 10-30% of mem power. wats up? |
| Molobolo | Someone Help me out, If you have any info email me at molobolo@gmail.com plz, I have 5 of these running, 3 are under 2 kb, and 1 is just under 12kb, 3 are system, 1 is network service, and 1 is local service, i also got this keylogger that keeps coming back, could one of those be involved? The key logger is called E-servillion *something like that* |
| chorney | When my internet connection through DSL times out and I can't get on the internet I run netstat from the cmd.exe to see the connections then I check my processes running in the task manager and end all svchost.exe occurences. It will send me a RPC shutdown timed at 60s I type the line shutdown -a at the cmd prompt at have happy internet sailings:) |
| Michael | I know that if I its is C:\ WINNT\SYSTEM32 and I know this thing is very tricky for example I tried to rename it and it let me do it and then I tried to delete it and it also worked but after I tried to empty recycle been it removed but the file just poped up again in system 32 folder so its really a cracker in your system I don't know what to doe |
| Erik | A remote administrator program called: BEAST (2.06 or something like that) and a trojan called ACEBOT use scvhost.exe to exploit bugs in a computer in order to gain control over it. there tell tale signs are the high cpu usage, and Dr. Watson program running. just google any problom you have to find a way to fix it... See also: Link |
| Jayel | Congratulations Mygale on completely missing the point of this article. To clarify; svchost is only a dangerous CPU and memory hog if you have a virus or trojan that is posing as svchost (or conceivably some other major problem with your installation), *otherwise* it is resource-friendly, normal, and harmless. |
| SyndroM-666 | naja... ´das ist wohl die verletzlichste Datei im Windows. Wenn die infiziert wird habt ihr ein riesen Problem(Mein ganzes System war im Eimer) Doch jetzt hab ich Norton Internet Secutity, geniales Programm - AntiVirus und Firewall in einem. Jez hab ich auch weniger mit Viren zu kämpfen! - Sehr zu empfehlen! |
| Hank | Dieses Programm verbindet sich automatisch mit zwei MicrosoftServern in Redmont,die IPs gibts gleich dazu 1. 64.4.23.221:80 die zweite ist eine SSL-Verbindung 207.46.253.147:443, also es sieht für mich danach aus als ob es Spyware a la Windows ist-keine Ahnung welche Daten da übertragen werden |
| fm0210 | I think that when svchost is allowed to be an internet server(default option in ZoneAlarm) can be dangerous, I got 4 viruses and spyware, but blocking that option in Zonealarm, my mozilla and IE didn't work, in Zonealarm I selected manually "allow Mozilla internet server", now it works. |
| Flavius | Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs). Necessary system file; no problem if it has access to the internet. BUT, there should only be one file, and must be located in C:\Windows\System32. Otherwise, it is malicious. |
| Vhailor | a virus uses Svchost for it's own (unknown) purposes, normally you have 4 instances of svchost running udner process manager, ending the process does not help at all, it simply hangs your computer until you hit the restart button. Run an updated antivirus scan to get rid of it |
| Jcw87 | svchost.exe is normally a critical system file. if its causing problems, do a virus scan AND MAKE SURE YOU HAVE RECENT DEFENITIONS! if you have outdated defenitions your scanner may not pick up on it. if you still have problems, get an expert to come to your house. |
| Nick | svchost.exe is a windows componenet. Trojans target this file and put themselves into it, or name themselves after it. Common problems include mouse-clicking problems and high CPU usage. Use an anti-virus scan to find the problem, then delete the sucker. |
| Gartenkralle | Ein Programm, welches durchaus in mehreren Instanzen laufen kann. Sollte das Programm abstürzen, beeinträchtigt das die Funktionalität aber nicht weiter. Das Programm ist eine originäre Windows-Datei und stammt nicht von einem Fremdanbieter. |
| Jack | Be afraid. Trojans hide themselves in the scvhost file, so when you boot your machine the virus is always launched, and you cannot shutdown the proccess. Run Norton and problem solved, but it is still a pain and should be watched |
| Sturm | Its a resource hog yes but if its only in the right directory its completely harmless even though its a system hog if your playing a non online game simple unjack the internet it will bring its usage down |
| Alfred | Eine Systemdatei welche zahlreiche Unterprozesse steuert. Harmlos, telefoniert nicht nach Hause, ist wichtig. Bei onlineverbindungen wird sie ebenfalls gebraucht, Zugriff bei Firewallmeldung erlauben. |
| Waxxie | I have 6 copies running, most using a small amount of ram Only one use arround 45 mb of memory and it anoying. All copies have one or 2 processes running. One has 12 of them I think. Pretty weird. |
| Sciader | Got this problem with this file jumping in task manager from 0% - 90%,up and down a couple of days now. but it got fixed when i updated windows update a couple of times... with the custum update... |
| Roid3.0 | in this moment stolen all my Ram!!!! svchost.exe 27.995Kb arrrg!!!!! another four instances are stolen more ram (3mb per process aprox) in total more than 39 Mb of ram |
| Silwer | To stop system shutdown after closing svchost.exe , open the command line and type, shutdown -a and press enter. Shutdown will stop immediately. |
| BHASKAR | create while cannecting net work and uses 100% of cpu, we can't work on line, even thoug the discountinued the network connection steel the file uses 100% cpu |
| Kain | well its not dangerous but it can be i had like 5 of them running and i was getting reboots n sht haha....and i had a wohle bunch and it was this name of it |
| | this is a microsoft file that will consume a lot of bandwidth, but can get on the net safely. I use netlimiter PRO to make sure it doesn't take up too much |
| cisse | This file actually stops your ass from being hacked by the "blasterworm" virus . By shutting svchost.exe down, you are just inviting people to hack you. |
| HauMichTot | Recht viele Prozesse gleichzeitig offen (7Stück), aber Lags habe ich trotzdem nicht...Es soll jedoch auch svchost-Fakes geben, in der Viren dirn sind |
| Death by sin | try using ( /run/shutdown -a ) to stop rpc procedure of 60 second then oppen up your firewall block all in and out traffic from ports 135 , 445 |
| ishouldgowithLINUX | "incredible" Indeed Seems mygale nailed this one. And by the way if there is this much to be said Dont phreak with this file!! :) See also: Link |
| santosh patra | it runs as soon as winxp starts up.i am encoutering several disturbaces related to this virus.system often shuts down |
| Otto | ich habe so meine bedenken bei dieser Datei , diese ist bei mir in vier verschiedene Windowsunterortner vorhanden |
| archi | it is takin up all my cpu resources whenever i cnct. makes everythin very slow. hv 4 instances runnin right now. |
| Manuel | Scheint ne fucking Menge an Traffic zu verursachen. Bei mir warens 7-10kb pro Sekunde im Upload |
| Anthony | Safe BUT some Litmus backdoors rename themselves svchost and imbeds itself in your registry. |
| Xanadu | Ocupa toda mi ram, hay q utilizar detector de spyware para eliminar los svchost malignos |
| Chicago Geek | Tasklist /SVC is not working for me on XP Home ..... DTS..... http://www.jobs.co.in |
| Vikkythegreat | Not much, for further information, visit, www.google.com or the link below See also: Link |
| SEVENOFNINE | Wichtige Netzwerk-Datei, die pro Netzwerkkarte einmal gestartet wird |
| vijay tiwari | if tihs file not in windows/system32 then its dangerous |
| Edward | amazing. people still crow about linux. Try BSD! |
| DesertICE | important for windows OS.... |
| | not dangerous.. let it be |
| Lulu | This is extremely dangerous because it hides itself as a integral file that should be there. But it's actually a modified copy so it's very difficult to diagnose. It also has a lag time, can take up to a week to appear after your computer is affected. People at work should be especially careful, I got it after my coworker (who's profile was infected) logged onto my computer. |
| rosana | Considered not dangerous because it's from Microsoft, but as you can read above, it can be infected by spyware or viruses. Right now I have 6 of them, not taking up all my CPU but some games don't start anymore (and they did before). 3 are SYSTEM (5k,9k,21k), 2 are Network (3k,4k) and 1 is Local (4k). It's frustrating as no virus scanner I've used so far can find anything... I consider this annoying because it’s not clear which svchost I can end, without it making my pc unstable. I can do nothing on my PC and yet it will still run 6 svchost processes, even when I disable my network card. |
| edoors | Diese Datei ist sofern nicht im %WINDOWS%\System32 Ordner vorhanden ein multipler laufender Prozess, der sowohl gefährliche Viren alsauch Trojaner und Hintertüren für Hacker und Spione beinhalten kann. |
| Riskot | Frisst memory und lastet die cpu voll aus! Bremst meinen rechner total!! (Trotz 3,5 Ghz und 2048 Mb Ram) |
| Astral Computing | Part of the windows system, but called by MANY viruses/worms. Usually under 10MB in the task manager, anything larger than 10MB, I end manually on systems with suspious files. |
| Kah Hoong | im just know is regarding DLL it make my pc hust.. |
| | Normaly this File is Fine, But I'm Infecited burning 100% CPU and lagging out my PC |
| goutham | 100% cpu usage, cut/copy/paste doesn't work, Hyperlinks in a web page doen't work and lot hell of problems |
| Ispita | I see many instances of this file running, though that is natural and the Lsass behaves pecularly |
| Ahmet Özgen | It adds my network connections another gateway which I cannot delete .Only by Zonealarm, I must deny some internet connection demands. |
| BD-Bernd | In meiner Firewall sind extrem viele Aktionen mit die Datei verbunden, was ich nicht für normal halte.... |
| Azazel | its taking 100 % of cpu when i run microsoft explorer |
| Alan | consuming up to 100% CPU time, extremely difficult to establish true cause |
| PitStop | Microsoft Antispyware (Beta1) System Explorers module shows a lot of the svbchost loop back to 127.0.0.1 from all kinds of spyware such as adclick adserver etc etc. |
| Apurba Roy | It takes about 92% of CPU usage and does not allow other programme to start until the computer is restarted. it starts working when cpmputer is commected to net. |
| Praveer Sri | This is taking up 100% CPU memory at times and you couldn't really tell between the fakies and the real. A real headache! Have formatted my PC thrice! |
| mono | mein fujitsu handy drive geht nicht an dank svchost.exe. der rechner ist sehr langsam geworden firewalls blockieren den internet explorer. werde wohl oder über den pc wieder in auslieferungszustand bringen. |
| moosa | this is a virus if it is taking up 100% of your cpu to remoce it, disconnect all of your internet activities and go offlien and search for svchost and delete everything that is not in the folder system32 |
| Stephan | McAfee findet "New Malware.h" Trojaner in dieser Datei |
| | To see where the process is running from, open Command Prompt and type tasklist /svc See also: Link |
| gk_ | it is a generic windows xp file that can be used by spy/mal ware |
| Rad Had | If you want to know exactly what his process is running/started, go to control panel- administrative tools- computer management- service and applications- services Look at the automatic processes that are started. Click on each one and bring up the properties, it will show you the process its using on automatic startup such as svchost.exe and the extension it runs with it such as the -k option. Most are normal and needed for the OS to function properly, some are not. Such as the IR Port- this can be safely turned off here or in another location. The OS needs 3 or 4 of these to run by default |
| Andysails | open taskman view selectcolumns then select all columns. Next find the svchost running with 1028 VMsize - DON"T stop this one (needed by windows). Safely stop all others. If I can figure out how to prevent the re-startable svchost I'll let you know. Excellent link below... See also: Link |
| Alfredo | I found a virus inside this file. the virus was Backdoor.Ranky See also: Link |
| Jojan John | It is necessary to run windows as well as it may show slowdown ur pc if it is a worm. To distinguish this, when u feel ur pc is slow much, check the task manager for ur cpu performance and if the cpu uses 100%, think that one of ur svchost.exe contains a worm. so just delete that particular big sized file. it can be ok. the other related processes will be ok |
| Adrien | There seems to be a lot of confusion about SVCHOST.EXE. I'd like to clear this up a bit. SVCHOST is part of Windows. SVCHOST is like a valet. All it does is run code. In some cases that code is standard, Microsoft code, some cases not. It can run anything, including viruses. Often it runs important system services. Chances are, you will have between 3 and 5 instances of this process running on a standard installation of XP or 2000. That could be healthy, or not. The process in itself is harmless, but it can be used for harmful purposes. Investigate further with virus and firewall software. |
| DYNAMiTE | svchost is needed to establish various network connections, the 2 lowest PID are os critical. The others you can kill but with risk that the program using the network connections will malfunction. There are trojans related to it but most likely you had what I had... a large hosts file (C:\WINDOWS\System32\drivers\etc\hosts.) Check whether you have a file above let's say 10 Kb. Hope this helps |
| Jackit | Part of Windows that can be used by virus attackers. |
| Biohazard | It seems that SVCHOST.EXE is harmless and does not get infected in anyway. However it has a loophole which causes attackers to copy and run files on your local harddrive aswell as cause the 100% cpu load. Again, it doesnt seem as the file is infected or harmful, it simply is a gate to get spyware on your machine. To fix the problem, install the official microsoft fix that closes the loophole. See also: Link |
| Khurram Butt | This is part of Windows |
| Dustspell | Impossible to work within a system without this exe , if you try to terminate the exe , the system will shutdown , but it consumes a lot of memory, but with the basic reason that operates the main programs |
| Sakatoya | Hey!!! SVCHOST.EXE comes with your XP OS period! It's necessary to run safely...leave it alone. A Clean XP OS has 5 or 6 SXCHOST.EXE processes at first boot. AGain...leave it be! |
| Computer Engineer | Windows uses this to run groups of services (which is why there can be multiple instances). If kill an instance that is running a critical service, you'll probably have to shutdown your computer. Some viruses install themselves as services, which is why it is sometime mistaken as a virus. If you have windows xp, type 'msconfig' in the 'Start Run' box, and try disabling some of the non-microsoft services. |
| | This file, as a part of the windows operating sysyem, is not at all a security issue to your PC. This process does however like to open several instences of itself and may consume unnessecary resources. I would not reccomend that you try to end this process as you will cause a mandotory shutdown of windows. This does not always happen with each instance of the process but it is impossable to differencitate between the ones that will cause the PC to shut down in Task Manager. There are several worms that run under the same process name. So watch Out! See also: Link Link |
| Kavin Amuthan | This is a important windows services running program. There is actually only one copy in C:\Windows\System32\ . There maybe upto 7 svchost running . This is normal .CAUTION: 1)search for svhost.exe in C:\ , if there is more than one files (leave the files in C:\windows\prefetch and C:\windows\dllcache , they are backup files. ) , then there may be trojans residing. 2) if thereis a trojan , the svchost maybe occupying nearly 100% memory,topping ur cpu too. 3) If there are files like scvhost.exe(sCv instead of sVc , do a search with input "s**host" ) there is a trojan. otherwise, Fine |
| GRT1 | I've Got 5 of Them Thay Lag THe PC Heaps when im on the ADSL Network but when i disable the the network connection thay don't lag the pc |
| Somethief | Uses lots of CPU |
| alf | No clue, but never uses CPU in my case. HOWEVER: I seem to have 3 of them running side by side, so can't rule out any trojans etc. My computer hangs five times a day, but for now chosen to listen to those saying "harmless Windows utility"........ |
| DJ Twilight | I also have seen this seemingly be the cause of my CPU being at 100%~ and I think it may be because of a Dr. Watson file .... something that loaded with a winamp download. |
| Linux-User | Bei mir definitiv ein Virus. Ich verstehe nur nicht wieso um alles in der Welt es noch immer keine Lösung gibt. Ich komm nicht aus der Windows-Welt. Privat und geschäftlich nur Linux, aber wenn ich diese Posts lese wird mir schlecht. Wie oft muss hier noch jemand klarstellen, dass es wohl infizierte Versionen gibt damit drei Zeilen weiter irgendein DEPP wieder schreibt, dass sie harmlos sei. Sowas hab ich noch NIE in einem Linux / Mac / Solaris oder sonstwas-Forum gelesen. Und so viele Betroffene und keine Lösung. Schämt euch WINDOWS-User See also: Link |
| aristocrat. | This file is using 38000k memory on my computer, and even using security task manager, svc.host doesnt appear anywhere, only on the Task manager, but it doesnt tell me where it's located,help... |
| Qit@mi | WICHTIG! Schreibweise. (Check the spelling!) svchost.exe = Systemprozess , scvhost.exe = Virus , svchosts.exe = Virus. See also: Link |
| drew | not dangerous its a windows thing |
| Josh | I have several svchost.exe's running on my computer and everytime i try to open a page on the net or right click on a text file my computer freezes up for about 2 minutes. I also have a "nsvchost.exe" running and it looks very suspicious. Does anyone know about this file and how to stop it? |
| beat maker | i have 6 of these running in task manager is that good? |
| Noman Shaukat | This process sucks my whole memory, Microsoft should do checks to make it memory affordable. |
| World of Beer | I had this virus for 2 days. Then I just ran Microsoft Antispyware, it found it, deleted it, restarted, and wallah! NP ( it cannot be deleted manually) |
| jason | If you are having problems than your anti-virus is crap. Goto Avast.com and download the for home edition, it is free and tons better than all the big name programs. Just make sure you register it! See also: Link |
| | virus C:\Program Files\Common Files\microsoft Shared\Web Folders |
| Sunardi | Service Host Process for services that are run from DLLs , it needs more attantion , coz it also can be a virus |
| LordArsonist | it took a lot of cpu power but i searched for it and found 3 of them. deleted everything but the one in the system32 folder. works perfekt |
| Adul | I have got 6 processes, and one takes to 100% of CPU usage. I can not close it. |
| | Windows Systemdatei. Wird aber gerne von Schädlingen "benutzt" |
| | There seems to be several of them. The one that uses the greatest ammount of memory seems to be used for music. If the process is killed Windows Media Player will not function (sounds still work.) Another one will shut down the computer after 60 seconds if the process is killed. |
| WichoMX | Svchost.exe Its an MICROSOFT file, is not dangerous, If you end this process, it will shutdown your pc (because this process controls the other processes) svHOST.exe may be a virus. You can have multiple instances of svchost.exe. See also: Link |
| Xellx | -- I have found a fix for this 100% cpu useage problem! -- I Write it down in a small website in german and english! Visit -- See also: Link |
| Em | This file is harmless. It can however be easily mistaken for other well known virus files such as svshost.exe or svhost.exe, but the files under the name of svchost.exe are perfectly clean files. |
| Bminhas | uses 100 % when a virus parasite uses name of genuine looking svchost.exe of the system |
| Sabi | don;t allow it to acces internet |
| kal | nothing but I have 6 instances of it running at all times |
| reggaeboy | Just fixed my svchost 100% pulsating problem !!!! I tried everything, then turned off Microsoft Windows Autoupdate. Immediately my usage went to 0% and stayed there !!! It works..... |
| | It can be both a harmless program that allows your system to run (if you end process in your task manager it will shut down your computer) and also a virus/spyware that will utilize your resources and make it go to 100% thus slowing your computer massively. In your Windows Task Manager, if you have multiple then be suspicious because one of those svchost.exe files can be your problem. I had 4 running. 3 should be max. I found which one was using up the most resources (around 15k) and killed it. |
| Ravi | Plz Tell Me How t o remove svchost.exe its eating100% cpu and somtimes Pc Atomaticully restart. |
| | the one that takes up the most ram does connect to the net and sends info to someone for some reason... |
| Pc Advisor | For certain if you are running an Unregestered copy of Windows XP this will Eventually be a problem for your PC. It actually is a critical system file that cannot be turned off,but can easily be exploited Easily by Hackers ,Trojans and maybe even Microsoft. From my Expierence it will take your PC to the Microsoft Website without your permission if you are not running a Firewall to Disallow it. The Microsoft Programmers are Brilliant but this is clearly a Huge Security Weakness In Windows.I recommend a Firewall and disallowing acess to the Internet. |
| Krishna murthy | dont ever mess with it |
| Nitin | it slowdown the sys |
| Janne | Virus or system process. As virus it hides it self under this name! It can do what ever the programmer wanted it to do! As virus it is mostly running under some user name. If you find svchost.exe that is too young for your system (see creation date) rename it and delete it! |
| Morten | Have several svchost running and im supposed to have them. (no infection) but lately one of the are using quite a lot of process memory. Any ideas boys and girls? |
| | Not dangerous, but it kills my ram and CPU. I mean I am running a stock dell..it's already bad enough. CURSE YOU MICROSOFT! |
| Harm | die Datei bringt bis zu 70 % CPU Auslastung und verlangsamt nur den PC. Problem ist beim Neustart, die Datei kommt immer wieder; da werde ich wohl etwas hartnäckiger vor gehen müssen. Ein Heilmittel habe ich aber noch nicht gefunden. |
| | It can be dangerous, is linked with the W32 blaster worm. in normal conditions it isnt dangerous. theres a patch to stop it being hacked by the W32 blaster worm |
| pilot | I am running 5 svchosts.exe programs CPU is at 100% usage,.. it is a virus,.. I am posting from second PC,.. the other is trashed. |
| I. C. Weiner | Ok now I am weee!!! Todd it.... |
| Bob | svchost - windows component. Integral to the system. Trojans get in and call themselves scvhost in most cases, or they just hide in the actual svchost. Causes mouse-clicking problems etc. AVG Free gets rid of it straight away on a scan. |
| AngelSL | Its...Windows service host. mine crashed but it didnt make windows restart/shutdown |
| Haden | Most svchost.exe's are around 14KBs and are all in the C:/Windows/system32 folder. I had running out in the open in the C:/Windows folder and not the System32. This one also appeared in my Processes List in all caps, "SVCHOST.EXE" and was running under my User instead of System, Local, or Network |
| Mark | Uses 100% of CPU and blocks other pending operations. When I stop this svchost.exe my processor occupation goes straight down to normal level and my PC works normal again. If you can, under "Computer Management" "Services and Applications" "Services" disable "DNS Client" reboot and should be good to go. |
| shoryuken | everytime i open pc , 5 svchosts pop up in task manager . i can kill first three , but last two cause system shutdown . it must be a trojan and malaware , erase from pc |
| Zeno | shared host process for XP services (To find out what services are running under the svchost process open a command window(run cmd) and type "tasklist /svc" without quotes. Use this in conjunction with task manager & service PID to make sure one instance is not a virus |
| CGC | I've got like 6 of them running. When i search i find just one file in c:\windows\system32....Is it just one file runnign multiple times? Or are 5 of them hidden? |
| HOUSI | Es nimmt 99% CPU Auslastung und sendet immer daten anFremde Computer |
| T-roy | the more entries into the Task Manage you get the better your computer is running. They're like vitamins for your desktop man. Enjoy :) |
| billy | Integral for windows of the NT versions to run |
| simon | bastad doesnt allow me to copy files. This is the second time i got this bastad - last time - i had to completely reboot my pc! |
| blib | Unbelievable. svchost.exe is simply the process that manages .dll's. My system has 6 instances running. Thats the way it's supposed to be. As you add software that contain .dll's you'll inevitibly get more instances of svchost.exe running. If svchost.exe starts working at 100% it is not the fault of this harmless essential program. It is the fault of the .dll that has been loaded into it. Run virus/antispyware scans and if that fails start uninstalling recent software that you've added to your machine. |
| David98 | I think that the 4 "SVC Hosts" running on my HardDrve takes "RAM" away, especially for playing "Microsoft Flight Simulator 2004" |
| Prakash | PART OF WINDOWS OS |
| Dan | i have 6 svchost open, all from system 32, but one in my service pack (same for CSRSS), is that a problem? |
| | system |
| fgg | sehr gefährlich |
| Lio | i´m sure only what this archive is in my compter and the nod32 tell me that, and tell me what it is with oder name like A345679.exe or some like that. |
| Miss Dipsy | The file itself is rarely dangerous (although it is always possible that a virus will masquerade as any common file). It is normal to have more than one svchost process running. However if it is using very large amounts of CPU, it may indicate a problem with an unrelated service, since svchost's purpose is running .dlls. DON'T just end the process, as it may cause your computer to crash!!! |
| ramesh kumar rameshk240 | my windows xp taskmanager high prossesing |
| killercrouse | this file is crap it is both dangerous and not all u have to do is find what it is runing i have four runing and i have no problems |
| Niki | Sie greift immer wieder auf das Internet zu. Sendet sie vielleicht meine (geheimen) Daten ? Sperre ich sie in der Firewall, dann geht das Internet nicht mehr. |
| Cyndershade | i believe that this is a terrible thing even if so it is necessary, what has happened to me is 17 copies of this satanic program run and each one clones itself as well as explorer. this seems to me like a terrible problem... |
| Upthemtn | svchost.exe is the DLL server used by local state and federal agencies to montor all of our browsing habits. It loads files thru RPC's and will re-load or crash system if removed. |
| Sheem | i m getting this error and they are about 3/4 files in my task managers processes |
| Raven | If i remember right, Sasser worm acts the same way. Shuts down windows within a minute. Well, my internet connection and windows works fine, even if I set this svchost.exe as denied with my firewall. |
| Charlie Chan | After doing a Google search on it, I know that the svhost.exe in the System32 folder is a part of the OS. I do not use a network at home and therefore I use ZoneAlarm to block its access to the internet. It appears that a program can hook into it and misuse it. So in my home enviroment, it is a security risk. In a networked computing enviroment, it is necessary. However, it most likely should not need access to the internet unless being used by the Windows Auto Updater. |
| AbadBoy | If is in C:\windows\svchost.exe is a virus! (how to remove it? it always start again after detele.apears there). if it is in C:\windows\ssytem32\svchost.exe is ok. cause is a part of windows! See also: Link |
| ajoy mehra | its a file that lods services ok chech for more details u can see itv in system 32 svchost and the prosses in task manager See also: Link |
| Florin | I have a svchost.exe masked virus that I close when I start the computer using CTRL ALT DEL because my CPU usage in 100%. After closing it, CPU usage goas to 10%!! Can I get some help in getting rid of it? See also: Link |
| pip | you can run "C:\ tasklist /svc" (Win XP Pro) to determine what services are using each svchost.exe image |
| | Do you run any antivirus program or even firewall, most of them has autoUpdate features and usualy you're keeping them on? Even Windows has an AutoUpdate. svchost is just the envinoirment for dynamic link libraries, and it uses some kind of stacking system - when one svchost process exceeds normal memory usage other dll's load in different svchost instance. The thing is that when registeried, all dlls use reasonably small amounts of data but with time (windows startup) they try to do some operations in one time (check for auto updates) and this event causes svchost to extend in memory... |
| Tragic Vision | its integral to the system so don't touch it, if you see it and its not in the System32 folder thats a virus and that can be easily removed |
| Crackhead | Necessary sys file, but is used for exploitation! PS - Stay away from "Winamp TV", and be careful of Winamp plug-ins!!! |
| HX | I have six of these running and so far, no bad effects, Even so, I have blocked it from accessing the Internet, and my dial-up connection runs a bit faster as a result. |
| dude | its a killer. its using all 4mb of my internet connection constantly. i am using firewall and spyware removal program but still nothing seems to work. if i block this file from accessing internet then no other program will access internet. in my office i ve a great network and this file never accesses internet there. i have this problem only at my place. |
| Crackhead | Hey gang, If you have probs w/ this, look on this list for "GOYO' and take his advice! Worked for me! I´m on XP Pro SP2 w/ Athlon1300 Goyo, U da Man!!!!!! Also, go into ur firewall & block "svchost.exe" from outgoing transmissions!!! |
| Un español en Nueva York | It's a normal program that works with Windows xp |
| A | I have 6 svchost.exe programs running in task manager, and for some reason I have to disable the one using the largest amount of memory or else when I connect to the internet my computer self distructs and shuts down. But when i do close it down sound drivers fail so no sounds work. This is very annoying and only started recently. I dont' know what is going on with it. |
| Sreenivas | it will restart the system automatically without bootin fully |
| Maur | Do not, I repeat, do NOT terminate svchost.exe from processes list. You need it for many other background services. The application is responsible for launchig most services in Services.msc and you should never interfere with any instances of svchost.exe or services.exe you might see listed in Task Manager. Instead use services.msc in a command prompt to start or stop a service or choose whether or not a service is started automatically when Windows starts. |
| Tommy J | The instance of, "trojan, bearing name of svchost.exe", on my computer was blocking my Task Manager form even coming up. i am supposing to stop me from terminating it from doing what ever it was doing to my computer. i experienced no other dilemma with this one. of course it had not been fully executed i feel, norton antivirus (definitions as of 4/16/06) caught it in action and took it out. now the task manager works fine. got the same problem do a scan with norton with the latest definitions. |
| nitin | it doesnt take so much of memory, but still i think 5 of them should not run simuntaniously, does any body have a clue why it happaning |
| tehjapkid | well... seems to take a freaking wtf kind of memory of 29792 k... no really wtf? not taking any cpu though, so is it really a problem? |
| George | Vital to MOS |
| oh my god its jackie chan | although it is a process of windows, it can also be a very big pain in the neck if you have it in any other folder. |
| Lou K | It keep showing up as a virus under AVG scans as ??chost.exe AVG says it deletes it but shows up after every scan. |
| devo | The people who complain about it using 20Meg of their memory have it easy. It grows to over 200MB on my system... But it's busy - there's lots going on. The real svchost.exe is OK & needed. |
| Windoof-User | svchos.exe ist ja auch ein reiner Windows-Prozess, und ist demnach nicht normal in Linux etc. vorhanden. Normalerweise ist die Datei harmlos, aber ein Virus kann sich ja beliebig nennen, also auch svchost.exe. Demnach kann man nie ausschließen, dass es sich nicht doch um einen Trojaner o.ä. handelt. |
| www.atcbox.com | It is actually using lots of CPU (I have 512mb ram) and the file uses 60%, so that slows down my computer... :S It could be a virus (@the same name as the standard windows service-executable) So it could be a virus or it is just a build-in windows executable... Just use a virusscan!!! See also: Link |
| | Viele benutzen sie um Drittanbiersoftware zu verdecken. Zum beispiel Hacks,Trainer oder Spiel veränderliche Programme da Scans sie nicht aufspüren. |
| richie | Most are in my WINDOWS/system32 file, but one is in my "System32" file. Could this "System32"file be a bug or something? |
| Emo-Ness | I have 5 of them on my computer. Three are in the system folder. And two others in two completley diffrent folders I'm pretty sure that they should not be there. But then again some people said we should have at least 5 of them. Im pretty much confused at the moment. |
| KrisWald | It IS needed, dont delete or try to remove it, it is used for windows to operate efficiently, However you DONT need it to talk over the internet dont allow it to connect if u dont want to, but if ur a gamer and want to host games you will probably find that you need it, as for viruses get a good anti virus :P its snot a virus its just a tool :P kinda like a door... well you need a door in your house... it lets you get in and out right? but it also lets bad ppl in :( but u still need the door dont ya? :P dont delete it. |
| dizny | not that big of a deal unless it has mass cpu usage often |
| open source | It's actually a system file, that even should not be removed. However, if it's using %98 of your cpu, that means it's infected. One detail: if you terminate svchost.exe, your computer crashes. But if you terminate the infected svchost.exe, computer turns to normal. |
| ALXN | I Run Computer Associates.Firewall; Set it up so it asks me to confirm every web access condition. So, when I initiate a web access; if CA jumps-up and says SVCHOST is trying to access the web; in a certain profile; I know it is OK, because I just got done starting that access profile; and. SVCHOST is carrying that request to the web. So I click ALLOW. But, if I get a CA alert when I haven't initiated a web request, then something is trying to use SVCHOST. I will click the DENY button and CA will not permit the web access. |
| | This file is critical to the operation of Windows. If you terminate the wrong one, an auto-restart countdown will begin. To cancel this, go to Start: Run: and enter "shutdown -a" (without the quotation marks) then press enter. The auto-restart will end, and you will know not to terminate this one. All other instances may be terminated, however this may have an undesired effect on your computer until next reboot. |
| Thomas K. | Also ich bewerte dieses Hintergrundprogramm als gefährlich, da es unnötig ist. Ich habe es vernichtet und bin dennoch online und kann ohne Fehlermeldungen mit Win XP arbeiten. Ursprünglich wurde mir dieses SVChost auch niemals als vertrauenswürdiges oder dringenst nötiges Programm mitgeteilt. Ich gebe dem Linux-User zu 100% Recht, denn Microsoft Anwender werden nach Strich und Faden missbraucht, gebraucht und verbraucht. Da nützen auch keine angeblichen Updates nicht's, die nichtssagende und vor allem altertümliche Sicherheitslücken zu schließen versuchen. WIN-XP-SP2 ist das Risiko! |
| laptop? | u guys must have some crappy comps ? i have 5 of these running an no probs.... |
| cmonyow | When i close it, my system bootsup immediatly...but i need to start the windows audio service myself |
| | go to run, then type cmd, copy and paste this " Tasklist /svc ", and you can see whats running under svchost.exe, i found atleast 3-4 suspected virus programs, not a hundred 100% if all those were viruses See also: Link |
| jessis | Part Of Windows XP |
| der meister | Diese Datei ist definitiv harmlos, da sie gebraucht wird. Wenn man diese Datei aus dem Prozessmanager oder so raussschmeisst, dann stürzt das System meistens ab... |
| Chip | svchost isnt dangerous to any degree, this file is supported by microsoft. the only way this file could possibly be harmful would be if a virus has attached itself to the file. but if thats the case the virus was already in ur computer, not straight off of svchost. ;) See also: Link |
| Snake Solid | Its dangerous depending on what its used for. Right now i notice 2 or 3 svchost.exe's on my process list. Some are used for running your internet connection o |
