{"id":486970,"date":"2022-08-23T01:00:00","date_gmt":"2022-08-22T22:00:00","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/"},"modified":"2024-11-28T14:41:51","modified_gmt":"2024-11-28T11:41:51","slug":"what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/","title":{"rendered":"#What Is the Service Host Process (svchost.exe) and Why Are So Many Running?"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6a3d81a38025f\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a3d81a38025f\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#What_Is_the_Service_Host_Process\" >What Is the Service Host Process?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#Why_Are_There_So_Many_Service_Host_Processes_Running\" >Why Are There So Many Service Host Processes Running?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#Is_There_Anything_For_Me_To_Do_With_All_This_Information\" >Is There Anything For Me To Do With All This Information?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#Check_Related_Services_in_Task_Manager\" >Check Related Services in Task Manager<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#Check_Related_Services_Using_Process_Explorer\" >Check Related Services Using Process Explorer<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-the-service-host-process-svchost-exe-and-why-are-so-many-running\/#Is_Service_Host_Process_a_Virus\" >Is Service Host Process a Virus?<\/a><\/li><\/ul><\/nav><\/div>\n\n<p class=\"wp-block-paragraph\">If you&#8217;ve ever browsed through Task Manager, you may have wondered why there are so many Service Host processes running. You can&#8217;t kill them, and you sure didn&#8217;t start them. So, what are they?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-is-the-service-host-process\"><span class=\"ez-toc-section\" id=\"What_Is_the_Service_Host_Process\"><\/span>What Is the Service Host Process?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s the answer, according to Microsoft:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Svchost.exe is a generic host process name for services that run from dynamic-link libraries.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">But that doesn&#8217;t really help us much. Some time ago, Microsoft started changing much of the Windows functionality from relying on internal Windows services (which ran from EXE files) to using DLL files instead. From a programming perspective, this makes code more reusable and arguably easier to keep up to date. The problem is that you can&#8217;t launch a DLL file directly from Windows the same way you can an executable file. Instead, a shell that is loaded from a executable file is used to host these DLL services. And so the Service Host process (svchost.exe) was born.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"why-are-there-so-many-service-host-processes-running\"><span class=\"ez-toc-section\" id=\"Why_Are_There_So_Many_Service_Host_Processes_Running\"><\/span>Why Are There So Many Service Host Processes Running?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;ve ever taken a look at the Services section in Control Panel, you&#8217;ve probably noticed that Windows requires a lot of services. If every single service ran under a one Service Host process, a failure in one service could potentially bring down all of Windows. Instead, they are separated out.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Services are organized into logical groups that are all somewhat related, and then a single Service Host instance is created to host each group. For example, one Service Host process runs the three services related to the firewall. Another Service Host process might run all the services related to the user interface, and so on. In the image below, for example, you can see that one Service Host process runs several related network services, while another runs services related to remote procedure calls.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2017\/03\/wsh_1.png\" alt=\"\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"is-there-anything-for-me-to-do-with-all-this-information\"><span class=\"ez-toc-section\" id=\"Is_There_Anything_For_Me_To_Do_With_All_This_Information\"><\/span>Is There Anything For Me To Do With All This Information?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Honestly, not a lot. In the days of Windows XP (and previous versions), when PCs had much more limited resources and operating systems weren&#8217;t quite as fine-tuned, stopping Windows from running unnecessary services was often recommended. These days,\u00a0we don&#8217;t recommend disabling services\u00a0anymore. Modern PCs tend to be loaded with memory and high-powered processors. Add that to the fact that the way Windows services are handled in modern versions (and what services run) has been streamlined, and eliminating services you think you don&#8217;t need really doesn&#8217;t have much of an impact any more.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That said, if you notice that a particular instance of Service Host \u2014 or a related service \u2014 is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific services that are involved. That might at least give you an idea of where to start troubleshooting. There are a few ways to go about seeing exactly what services are being hosted by a particular instance of Service Host. You can check up on things within Task Manager or using a great third-party <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a> named Process Explorer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-related-services-in-task-manager\"><span class=\"ez-toc-section\" id=\"Check_Related_Services_in_Task_Manager\"><\/span>Check Related Services in Task Manager<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re using Windows 10 or Windows 11, processes are shown on the &#8220;Processes&#8221; tab of Task Manager by their full names. If a process serves as a host for multiple services, you can see those services by simply expanding the process. This makes it very easy to identify which services belong to each instance of the Service Host process.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2017\/03\/wsh_2.png\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can right-click any individual service to stop the service, view it in the &#8220;Services&#8221; Control Panel app, or even search online for information about the service.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2017\/03\/wsh_3.png\" alt=\"Right-click a Service Host process, then click &quot;Search Online&quot; to find more details.\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If you&#8217;re using Windows 7, things are a bit different. The Windows 7 Task Manager did not group processes the same way, nor did it show regular process names \u2014 it only showed all the instances of &#8220;svchost.exe&#8221; running. You had to explore a bit to determine the services related to any particular instance of &#8220;svchost.exe.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On the &#8220;Processes&#8221; tab of Task Manager in Windows 7, right-click on a particular &#8220;svchost.exe&#8221; process, and then choose the &#8220;Go to Service&#8221; option.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2008\/01\/image78.png\" alt=\"Right-click svchost.exe, then click &quot;Go to Service(s)&quot; to show more information. \"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">This will flip you over to the &#8220;Services&#8221; tab, where the services running under that &#8220;svchost.exe&#8221; process are all selected.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2008\/01\/image79.png\" alt=\"The Windows 7 Task Manager with all of the services running under \"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">You can then see the full name of each service in the &#8220;Description&#8221; column, so you can choose to disable the service if you don&#8217;t want it running or troubleshoot why it&#8217;s giving you problems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"check-related-services-using-process-explorer\"><span class=\"ez-toc-section\" id=\"Check_Related_Services_Using_Process_Explorer\"><\/span>Check Related Services Using Process Explorer<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft also provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download\u00a0<a href=\"http:\/\/technet.microsoft.com\/en-us\/sysinternals\/bb896653.aspx\" target=\"_blank\" rel=\"noreferrer noopener\">Process Explorer<\/a>\u00a0and run it \u2014 it&#8217;s a\u00a0portable app, so no need to install it. Process Explorer provides all kinds of advanced features \u2014 and we highly recommend reading our\u00a0guide to understanding Process Explorer\u00a0to learn more.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For our purposes here, though, Process Explorer groups related services under each instance of &#8220;svchost.exe.&#8221; They&#8217;re listed by their file names, but their full names are also shown in the &#8220;Description&#8221; column. You can also hover your mouse pointer over any of the &#8220;svchost.exe&#8221; processes to see a popup with all the services related to that process \u2014 even those that aren&#8217;t currently running.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2023\/10\/service-host.png\" alt=\"Process Explorer showing svchost.exe running. \"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"is-service-host-process-a-virus\"><span class=\"ez-toc-section\" id=\"Is_Service_Host_Process_a_Virus\"><\/span>Is Service Host Process a Virus?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The process itself is an official Windows component. While it&#8217;s possible that a virus has replaced the real Service Host with an executable of its own, it&#8217;s very unlikely. If you&#8217;d like to be sure, you can check out the underlying file location of the process. In Task Manager, right-click any Service Host process and choose the &#8220;Open File Location&#8221; option.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2017\/03\/wsh_4.png\" alt=\"Right-click the Service Host process, then click &quot;Open File Location&quot; to ensure that the executable is the real one. \"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">If the file is stored in your Windows\\System32 folder, then you can be fairly certain you are not dealing with a virus.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/static1.howtogeekimages.com\/wordpress\/wp-content\/uploads\/2017\/03\/wsh_5.png\" alt=\"The real svchost.exe located at &quot;C:\\Windows\\System32.&quot;\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">That said, if you still want a little more peace of mind, you can always scan for viruses using\u00a0your preferred virus scanner. Better safe than sorry!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Related article :\u00a0<a href=\"https:\/\/blog.achievable.me\/tech\/what-is-service-host-process\/\" target=\"_blank\" rel=\"noreferrer noopener\">Service Host Process<\/a><\/strong><\/p>\n\n\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span> too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/category\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.howtogeek.com\/987\/what-is-svchostexe-and-why-is-it-running\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>","protected":false},"excerpt":{"rendered":"<p>If you&#8217;ve ever browsed through Task Manager, you may have wondered why there are so many Service Host processes running. You can&#8217;t kill them, and you sure didn&#8217;t start them. So, what are they? What Is the Service Host Process? Here&#8217;s the answer, according to Microsoft: Svchost.exe is a generic host process name for services&#8230;<\/p>\n","protected":false},"author":1,"featured_media":486971,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.howtogeek.com\/wp-content\/uploads\/2017\/06\/HTG-Services-HEader.png?height=200p&trim=2,2,2,2","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-486970","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/486970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=486970"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/486970\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/486971"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=486970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=486970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=486970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}