What is the svchost.exe file used for in Windows?

Below are details on what the svchost.exe file is and how it's used in the Microsoft Windows operating system.

What is the svchost.exe file?

The term SvcHost, also known as svchost.exe or Service Host, is a process used to host one or more operating system services. The svchost.exe Microsoft Windows executable file is labeled as: Generic Host Process for Win32 Services. Svchost.exe is a required Windows file and is used to load needed DLL (dynamic-link library) files used with Microsoft Windows and Windows programs that run on your computer.

This file is located in either c:\windows\system32 or c:\winnt\system32 (depending on Windows version), and may also be in the dllcache directory.

Why do I have multiple svchost.exe processes running in Task Manager?

The operating system may run multiple instances of the SvcHost process, depending on how many services need to run. Each service run inside the SvcHost process is sharing the process, which helps to reduce the amount of resources (RAM) used on the computer. It is common to see three or four svchost.exe in the Task Manager Processes tab.

While this shared process helps reduce resource use on the computer, it can also have a few drawbacks. If any one of the services running inside the SvcHost process generates an unhandled exception error, it causes the whole process to shut down. Subsequently this can cause additional errors to occur due to the services no longer running inside that shared process. Also, because svchost.exe is a common process in the Task Manager, malware programs sometimes mask themselves by running under the same process name. Other times, a malware program may run, or inject, its service into an already running svchost.exe process. In either case, this masking action can make it difficult to detect and remove these malware programs.

Is svchost.exe a virus or trojan?

There are viruses that infect this file and may run as an SVCHOST.EXE service. If you think your computer is infected with a computer virus, we recommend you update your virus protection program and visit the Microsoft Windows update page.

If your antivirus protection software does not detect a virus or other malware, your computer is not infected and the svchost.exe file is not a virus.

SVCHOST.EXE error with 0xe03c3a68 or computer crashes with this file when opening Microsoft Internet Explorer.

Users experiencing an error with the above memory address are infected with the blaster virus.

How can I remove svchost.exe?

This file is an important Windows file and needed by Windows. Removing this file would cause Windows to no longer function. If this file is infected with a virus, your antivirus program should be able to quarantine or delete the file.

How can I view what applications svchost is handling?

To determine what is in the svchost.exe file, you need either tlist.exe if you are running Windows 2000 or tasklist.exe if you are running Windows XP. Windows users can also view what is running under svchost through Windows Defender.

Running the tlist and tasklist program

To run this program in Windows XP, click Start > Run, type command or cmd, and press Enter. From the MS-DOS prompt, type tasklist /svc and press Enter.

To run this program in Windows 2000, click Start > Run, type command or cmd, and press Enter. From the MS-DOS prompt, type tlist -s and press Enter.

* If you cannot run or locate this file on the computer, see steps below on installing this file onto your computer.

Tasklist Windows XP Installation

Windows XP Home users need to download the "tasklist.exe" file from our Windows XP downloads section.

Windows XP Professional users that cannot locate this file can expand it from the i386 directory on their Windows XP Professional CD (compact disc) or download the file from the above link. Unfortunately, the Windows XP Home CD does not contain this file.

Tlist Windows 2000 Installation

If you do not have this file, you must install the Microsoft Windows 2000 support tools. To do this, place the Windows 2000 CD into the computer and run setup.exe from \SUPPORT\TOOLS directory.

Example of what is seen in tlist and tasklist

Below is an example of how the Windows XP output of tasklist may appear.

Below is an example of what Windows 2000 would display for the svchost services. With tlist.exe or tasklist.exe, information similar to the example below is displayed.

444 svchost.exe Svcs: RpcSs
552 svchost.exe Svcs: EventSystem,Netman,NtmsSvc,RasMan,SENS,TapiSrv
792 svchost.exe Svcs: wuauserv

• See the tasklist command page for further information and examples with this command.

Viewing running processes through Windows Defender

Microsoft Windows Defender is also capable of viewing all applications and processes running including those within svchost are found through Windows Defender as explained below.

1. These steps require that Windows Defender in installed on your computer.
2. Open Windows Defender, if not already open, by clicking Start, Programs, and clicking Windows Defender.
3. Click Tools.
4. Click Software Explorer.
5. Click the down arrow next to Category and click Currently Running Programs.

Any "Microsoft Generic Host Process for Win32 Services" for Windows XP users or "Microsoft(R) Windows (R) 2000 Operating System" items listed in the list are portions of the svchost.