What is svchost.exe in the Windows 11/10 operating system? Why do I see multiple instances of svchost.exe processes running in my Task Manager? How do I find out basic information, like the name and description for each svchost process? Why is svchost.exe constantly running? Why does my svchost show high Disk or CPU usage? This article will attempt to answer these questions.
What is svchost.exe in Windows 11/10
Svchost stands for Service Host. It is a .exe executable operating system critical file that is located in the System32 folder. When Windows starts up, it checks the Windows Registry and makes a list of Services or groups of Services that it has to load.
The Service Host (svchost.exe) is a shared-service process that serves as a shell for loading services from DLL files.
You therefore see multiple svchost.exe processes running at the same time. This grouping of services also assists in better control and debugging should the need arise. Services run in svchost are implemented as dynamically linked libraries or dll files.
The svchost.exe process runs with the following parameters or flags:
- When svchost.exe uses the -k flag, a request will be made to the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - When svchost.exe uses the -p flag, it enforces different policies: DynamicCodePolicy, BinarySignaturePolicy & ExtensionPolicy
- When svchost.exe uses the -s flag, this will tell the “svchost.exe” process to load only the service specified by the flag from the selected group.
Multiple instances of svchost.exe processes
You can see all these svchost.exe groups under the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost
To view the list of services that are running in Svchost, open an instance of the command prompt, type Tasklist /SVC and hit Enter.
svchost.exe high CPU or Disk usage on Windows 11/10
Many times svchost.exe may show high resource utilization. Although it is difficult to isolate the service responsible for this, since many services are associated with this process, the built-in Resource Monitor or SysInternals Process Explorer will help you in that direction.
To see which svchost is associated with which single or multiple Service, right-click on the svchost.exe and select Go to Service(s).
In the Services tab, you can now see the associated services highlighted.
But this does not give you much information. If you need to know more details, like the name and description for each svchost process, you can download and use the freeware portable app Svchost Viewer.
This tool gives you some basic information like the name and description of the services with a particular svchost process. It gives you information like:
- Process ID
- Amount of data written or read
- Name of Service, Service type, Start mode, Status
- Whether the service can be paused or stopped
- A brief description of the Service.
It also lets you stop or pause selected services where possible and even access the Service Manager directly.
For instance, Windows Defender is, at times, known to make CPU usage shoot up. Open Windows Defender Security Center > Firewall & Network protection > Disable Firewall for all Networks. Then click on Restore settings and see if that helps.
Read: Service Host: Diagnostic Policy Service 100% Disk Usage.
If you want to reduce the number of svchost processes, the only way to do it is to reduce the number of services that start up automatically. If you want to disable services you may want to check out our Windows Services Tweaker. But I advise that you do so, only if you know what you are doing.
How do I know svchost is infected?
Some malware can masquerade as genuine files to trick antivirus software. Svchost.exe is an authentic file in the Windows operating system. If you want to know whether svchost is infected or a genuine file, you can check its signature. Genuine files are signed by their manufacturers. Open Task Manager and go to the Details tab. Right-click on svchost.exe and click Open file location. Now, right-click on the svchost.exe file and select Properties. After that, select the Digital Signatures tab. There you can see the signer’s name. Alternatively, you can scan svchost.exe with Windows Defender or your third-party antivirus.
Want to know about these processes?
Shellexperiencehost.exe | RuntimeBroker.exe | TrustedInstaller.exe | Host Process for Windows Tasks | JUCheck.exe.
