GT Explains: What is the Svchost.exe Process and Why Are So Many of it Running?

Ads by Google

When you open up Windows Task Manager, there are some processes which you will instantly recognize. Then there will be some of which you will have no clue. The Svchost.exe process is perhaps the most common in the list and perhaps the one that’s difficult to track down. Let’s look into the cause and effect of this process that seems to be crowding out so many of the others.

Svchost.exe is NOT a malware

That’s usually the first worry when you can’t decipher what it’s all about. But it is definitely not a virus, though sometimes malware try to cloak themselves as one and attack a machine. Svchost.exe is a Microsoft Service Host Process. Microsoft says it is a generic host process name for services that run from dynamic-link libraries.

In simpler words, svchost.exe is a system file that enables Windows to launch other programs. Many of Windows processes are run via DLL (Dynamic Linked Library) files. But DLLs cannot start and run on their own. The Windows operating system needs an executable program that can act as a bridge to launch these DLLs. The svchost.exe file is that ‘bridge’

To handle all the different DLL run processes svchost.exe creates multiple instances of itself. Thus, Windows resources are better utilized as a number of DLL services run as a group under a  single svchost file.

But Why Do We See So Many of Them?

It is quite logical actually considering that svchost.exe is such a critical component of Windows. If every process ran under one svchost.exe, a failure might lead to a system wide crash. So, every service is separated out with a logical instance of svchost.exe running it.

Each instance of svchost.exe is a ‘host’ for the DLLs that are running the different services on Windows. For e.g. one svchost.exe process might be running network services, another could be handling your desktop themes.

Identifying the Processes

Ads by Google

Which services are running under which particular svchost.exe process is useful if you are looking for some peace of mind and also to optimize your system resources by disabling the ones that aren’t needed. There are two easy ways to identify svchost processes.

1. Use the command line:  Open the Run box from Start and type in CMD to bring up the command terminal. Type in tasklist /SVC at the prompt. You can see all the dynamic libraries that svchost.exe is running.

The problem with this method is that the processes still aren’t in plain, easily understandable English. For that let’s turn to the second method.

2. Using Process Explorer: Process Explorer is a nice little utility that you can run straight from the ZIP file. Run the standalone program and then you can highlight individual processes and see exactly what each process is doing. You can mouse-over each process to look into the details.

We hope this article has managed to demystify the svchost.exe process and helped you have a better grasp of it.

If you want to add information and share things you know about svchost.exe process in Windows, you are welcome to jump in with your ideas in the comments.

Before You Go...

Just wanted to let you know that we've launched a special course for Microsoft Excel users, called ExcelJump where we'll add great content on Excel. Make sure you check it out and subscribe. It's worth much more than the price we're offering it for.

Get Guiding Tech articles delivered to your inbox.

Also get a free ebook when you subscribe.

We will never share your address. Unsubscribe at any time.

  • SeaShellsAlways

    I have just discovered this site and I love it. It’s like going to school with a personal teacher. Keep up the great work. You are great. Also, it is in plainly written so the average person can understand what they have just read. THAT IS A GOOD TEACHER. YEA FOR YOU. Elizabeth

    • Abhijeet Mukherjee

      Glad you liked it so much Elizabeth. :)

  • Andrew Tucker

    If you find out that one svchost.exe file is using an inordinate amount of RAM (ie 95,000 kilobytes) you can just end task it and, if it is essential, it will reboot itself using much less RAM. If you are worried that one of them might be a disguise for malware or viruses, just click “Image Name” up at the top of the list of processes to sort them alphabetically by name. Scroll down to find the svchost.exe group and look at how much memory each is using. They should all be in a range of 3,000 to 6,000 kilobytes, anything that is well outside the range would be suspicious.