Information and help with Windows svchost.exe

Updated: 01/24/2018 by Computer Hope

What is the svchost.exe file?

Windows svchost.exe fileThe term SvcHost, also known as svchost.exe or Service Host, is a process used to host one or more operating system services. The svchost.exe Microsoft Windows executable file is labeled as: Generic Host Process for Win32 Services. Svchost.exe is a required Windows file and is used to load needed DLL files that are used with Microsoft Windows and Windows programs that run on your computer.

This file is located in either the c:\windows\system32 or c:\winnt\system32 directories depending on your version of Windows and may also be located in the dllcache directory if present.

Why do I have multiple svchost.exe processes running in Task Manager?

The operating system may run multiple instances of the SvcHost process, depending on how many services need to run. Each service that is run inside the SvcHost process is sharing the process, which helps to reduce the amount of resources (RAM) used up on the computer. It is common to see three or four svchost.exe in the Task Manager Processes tab.

While this shared process can help reduce resource use on the computer, it can also have a few drawbacks. If any one of the services running inside the SvcHost process generates an unhandled exception error, it causes the whole process to shut down. Subsequently this can cause additional errors to occur due to the services no longer running inside that shared process. Also, because svchost.exe is a common process in the Task Manager, malware programs sometimes mask themselves by running under the same process name. Other times, a malware program may run, or inject, its service into an already running svchost.exe process. In either case, this masking action can make it difficult to detect and remove these malware programs.

Is svchost.exe a virus or trojan?

There are viruses that can infect this file and may run as an SVCHOST.EXE service. If you think your computer is infected with a computer virus, we recommend you update your virus protection program and visit the Microsoft Windows update page.

If your antivirus protection software does not detect a virus or other malware, your computer is not infected and the svchost.exe file is not a virus.

SVCHOST.EXE error with 0xe03c3a68 or computer crashes with this file when opening Microsoft Internet Explorer.

Users experiencing an error with the above memory address are infected with the blaster virus.

How can I remove svchost.exe?

This file is an important Windows file and needed by Windows. Removing this file would cause Windows to no longer function. If this file is infected with a virus, your antivirus program should be able to quarantine or delete the file.

How can I view what applications svchost is handling?

To determine what are in the svchost.exe file, you need either tlist.exe if you are running Windows 2000 or tasklist.exe if you are running Windows XP. Windows users can also view what is running under svchost through Windows Defender.

Running the tlist and tasklist program

Windows XP users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tasklist /svc and press enter.

Windows 2000 users can run this program by clicking Start, Run, and type command or cmd and press enter. From the MS-DOS prompt, type tlist -s and press enter.

* If you cannot run or locate this file on the computer, see steps below on installing this file onto your computer.

Tasklist Windows XP Installation

Windows XP Home users need to download the "tasklist.exe" file from our Windows XP downloads section.

Windows XP Professional users that cannot locate this file can expand it from the i386 directory on their Windows XP Professional CD or download the file from the above link. Unfortunately, the Windows XP Home CD does not contain this file.

Tlist Windows 2000 Installation

If you do not have this file, you will need to install the Microsoft Windows 2000 support tools. To do this, place the Windows 2000 CD into the computer and run setup.exe from \SUPPORT\TOOLS directory.

Example of what is seen in tlist and tasklist

Below is an example of how the Windows XP output of tasklist may appear.

Image Name PID Session Name Session# Mem Usage
=============== ======  ========== ======== =========
cmd.exe 6076 Console 0 132 K
notepad.exe 1152 Console 0 2,660 K
firefox.exe 5868 Console 0 397,008 K
SecureCRT.EXE 4288 Console 0 10,968 K
thunderbird.exe 1812 Console 0 54,572 K
notepad.exe 532 Console 0 1,584 K
perl.exe 1528 Console 0 48,936 K

Below is an example of what Windows 2000 would display for the svchost services. With tlist.exe or tasklist.exe you should see information similar to the example below.

444 svchost.exe Svcs: RpcSs
552 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
792 svchost.exe Svcs: wuauserv

  • See the tasklist command page for further information and examples with this command.

Viewing running processes through Windows Defender

Microsoft Windows Defender is also capable of viewing all applications and processes running including those within svchost can be found through Windows Defender as explained below.

  1. These steps require that you have Windows Defender installed on your computer.
  2. Open Windows Defender if not already open by clicking Start, Programs, and clicking Windows Defender.
  3. Click Tools.
  4. Click Software Explorer.
  5. Click the down arrow next to Category and click Currently Running Programs.

Any "Microsoft Generic Host Process for Win32 Services" for Windows XP users or "Microsoft(R) Windows (R) 2000 Operating System" items listed in the list are portions of the svchost.

Additional information