What is svchost.exe?

Since 2005, file.net has researched facts about Windows processes and files, analyzed user experiences, and examined files using its own analysis tools. Around 10,000 users rely on it every day.

Svchost.exe file information

The process known as Host Process for Windows Services or Generic Host Process for Win32 Services or TJprojMain or winrscmde or Win or SvcHost Service Host or Mnr or ServerSocket MFC Application

belongs to software Microsoft Windows Operating System or Background Intelligent Transfer Service or Project1 or Windows Audio or Cryptographic Services or Windows Audio Endpoint Builder or Application Experience or DHCP Client or Computer Browser or Application Information or Human Interface Device Access or Win or DCOM Server Process Launcher or Network Connections

by Microsoft (www.microsoft.com) or TEPDT or Advanced Systems International SAC or Intel (www.intel.com) or SFX Cabinet Self-Extractor or Murray Hurps Software Pty or Xuiickeeo or j39RH04Ky.

Description: The original svchost.exe from Microsoft is an important part of Windows, but often causes problems. Svchost.exe is located in the C:\Windows\System32 folder. Known file sizes on Windows 10/11/7 are 14,336 bytes (33% of all occurrences), 20,992 bytes and 66 more variants.  
It is a Windows core system file. The program is not visible. The svchost.exe file is a trustworthy file from Microsoft. Therefore the technical security rating is 6% dangerous; however you should also read the user reviews.

Recommended: Identify svchost.exe related errors

Viruses with the same file name

Is svchost.exe a virus? No, it is not. The true svchost.exe file is a safe Microsoft Windows system process, called "Host Process". However, writers of malware programs, such as viruses, worms, and Trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. BKDR_FYNLOS.SMIA or TROJ_SPNR.07EA11 (detected by TrendMicro), and Trojan.Gen or Trojan Horse (detected by Symantec).
To ensure that no rogue svchost.exe is running on your PC, click here to run a Free Virus Scan.

How to recognize suspicious variants?

• If svchost.exe is located in a subfolder of the user's profile folder, the security rating is 81% dangerous. The file size is 3,580,520 bytes (10% of all occurrences), 3,772,520 bytes and 226 more variants. The file is not a Windows system file. There is no information about the author of the file. The program is not visible. Svchost.exe is able to monitor applications and record keyboard and mouse inputs.
• If svchost.exe is located in a subfolder of C:\Windows, the security rating is 64% dangerous. The file size is 1,563,136 bytes (9% of all occurrences), 20,992 bytes and 278 more variants. The program is not visible. Svchost.exe is not a Windows core file. The svchost.exe file is a file with no information about its developer. The svchost.exe file is located in the Windows folder, but it is not a Windows core file. Svchost.exe is able to monitor applications and record keyboard and mouse inputs.
• If svchost.exe is located in the C:\Windows folder, the security rating is 57% dangerous. The file size is 36,352 bytes (21% of all occurrences), 20,480 bytes and 58 more variants.
• If svchost.exe is located in a subfolder of "C:\Program Files", the security rating is 74% dangerous. The file size is 376,832 bytes (3% of all occurrences), 382,464 bytes and 87 more variants.
• If svchost.exe is located in the Windows folder for temporary files, the security rating is 72% dangerous. The file size is 409,088 bytes (24% of all occurrences), 24,064 bytes and 26 more variants.
• If svchost.exe is located in a subfolder of C:\Windows\System32, the security rating is 56% dangerous. The file size is 1,169,224 bytes (6% of all occurrences), 13,179,660 bytes and 27 more variants.
• If svchost.exe is located in a subfolder of C:\, the security rating is 62% dangerous. The file size is 841,728 bytes (14% of all occurrences), 32,768 bytes and 16 more variants.
• If svchost.exe is located in a subfolder of Windows folder for temporary files, the security rating is 72% dangerous. The file size is 2,602,993 bytes (14% of all occurrences), 172,032 bytes and 11 more variants.
• If svchost.exe is located in the user's profile folder, the security rating is 78% dangerous. The file size is 71,168 bytes (28% of all occurrences), 90,112 bytes and 4 more variants.
• If svchost.exe is located in the C:\Windows\System32\drivers folder, the security rating is 74% dangerous. The file size is 221,696 bytes (14% of all occurrences), 294,835 bytes and 5 more variants.
• If svchost.exe is located in a subfolder of the user's "Documents" folder, the security rating is 72% dangerous. The file size is 314,045 bytes (50% of all occurrences), 674,304 bytes or 5,747,712 bytes.
• If svchost.exe is located in the "C:\Program Files" folder, the security rating is 64% dangerous. The file size is 90,112 bytes.
• If svchost.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 56% dangerous. The file size is 91,648 bytes.
• If svchost.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 52% dangerous. The file size is 26,624 bytes.
• If svchost.exe is located in the user's "Documents" folder, the security rating is 100% dangerous. The file size is 689,664 bytes.
• If svchost.exe is located in the "C:\Program Files\Common Files" folder, the security rating is 56% dangerous. The file size is 110,592 bytes.

External information from Paul Collins:
There are different files with the same name:

• "CashToolbar" definitely not required. CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "France" definitely not required. Added by the MIMAIL.L WORM!. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "microsoft" definitely not required. Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Monitoring Service" definitely not required. Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Network Service" definitely not required. CoolWebSearch parasite related. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "NvClipRsv" definitely not required. Added by the DUMARU-AK WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Online Service" definitely not required. Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "PowerManager" definitely not required. Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Host " definitely not required. Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Host Driver" definitely not required. Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Process" definitely not required. Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Setup experation" definitely not required. Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process, which NOT appear in Msconfig/Startup!
• "Srv32Win" can run at start up. Realtime-Spy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
• "SSL" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "SVCHOST" definitely not required. System1060 homepage hi-jacker. Found in a Windows\System1060 directory. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "svchost" definitely not required. Added by the MORB WORM or TARNO TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Svchost" definitely not required. Added by the MOXE-A WORM! This is not the valid svchost.exe as described here
• "System Host Service" definitely not required. Added the the CONE.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "System Manager" definitely not required. Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "System Update2" definitely not required. Added by the AUTOTROJ-C TROJAN!
• "SystemReg" definitely not required. Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Task Monitoring Service" definitely not required. Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "tjstartup" definitely not required. Added by the CURDEAL TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Windows Service Host" definitely not required. Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Windows Services Host" definitely not required. Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "WindowsUpdate" definitely not required. Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "xor" definitely not required. Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Zone Labs Client Ex" definitely not required. Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "zztp" definitely not required. Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!

Important: Some malware disguises itself as svchost.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the svchost.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.