How to remove an svchost error

Click to Run a Free Scan for svchost.exe related errors

Svchost.exe file information

The process known as Generic Host Process for Win32 Services or Host Process for Windows Services or winrscmde or AutoHotkey or BindFile Microsoft or mIRC or CCProxy Microsoft MFC Application or Windows Host Process

belongs to software Microsoft Windows Operating System or AutoHotkey or GT.exe or BindFile or mIRC or Remote Access Auto Connection Manager or guangao or Generic Host Process for Win32 Services

by Microsoft (www.microsoft.com) or Home or mIRC Co. (www.mirc.com) or MS User or TODO: lQøST or Clickteam or All or VolkS.

Description: svchost.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 14,336 bytes (84% of all occurrences), 12,800 bytes and 31 more variants.  
It is a Windows system file. The program has no visible window. The file is a trustworthy file from Microsoft. The application listens for or sends data on open ports to a LAN or the Internet. Therefore the technical security rating is 9% dangerous, however also read the users reviews.

Recommended: Identify svchost.exe related errors

Viruses with the same file name

Is svchost.exe a virus? No, it is not. The true svchost.exe file is a safe Microsoft Windows system process, called "Generic Host Process". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. IRC.Backdoor.Trojan or Trojan.Gen (detected by Symantec), and Trojan-Downloader.Win32.VB.bsa or P2P-Worm.Win32.Palevo.andm (detected by Kaspersky).
To ensure that no rogue svchost.exe is running on your PC, click here to run a Free Malware Scan.

How to recognize suspicious variants? If svchost.exe is located in the folder C:\Windows, the security rating is 69% dangerous. The file size is 36,352 bytes (13% of all occurrences), 70,207 bytes and 242 more variants. Svchost.exe is not a Windows system file. The program is not visible. File svchost.exe is located in the Windows folder, but it is not a Windows core file. It is a file without information about the developer of this file. svchost.exe is able to record inputs, monitor applications, hide itself and manipulate other programs.

If svchost.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 66% dangerous. The file size is 233,472 bytes (40% of all occurrences), 106,496 bytes and 194 more variants. File svchost.exe is not a Windows system file. There is no description of the program. The program is not visible. The process is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, C:\Windows\win.ini, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad). svchost.exe is able to monitor applications.

If svchost.exe is located in a subfolder of C:\Windows, the security rating is 71% dangerous. The file size is 20,992 bytes (5% of all occurrences), 37,888 bytes and 228 more variants.

If svchost.exe is located in a subfolder of C:\Windows\System32, the security rating is 73% dangerous. The file size is 32,768 bytes (5% of all occurrences), 86,016 bytes and 155 more variants.

If svchost.exe is located in a subfolder of "C:\Program Files", the security rating is 61% dangerous. The file size is 497,664 bytes (11% of all occurrences), 493,568 bytes and 146 more variants.

If svchost.exe is located in the folder C:\Windows\System32\drivers, the security rating is 88% dangerous. The file size is 30,720 bytes (9% of all occurrences), 34,304 bytes and 71 more variants.

If svchost.exe is located in a subfolder of C:\, the security rating is 63% dangerous. The file size is 183,808 bytes (21% of all occurrences), 239,104 bytes and 43 more variants.

If svchost.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 59% dangerous. The file size is 1,429,504 bytes (10% of all occurrences), 397,824 bytes and 31 more variants.

If svchost.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 79% dangerous. The file size is 244,868 bytes (20% of all occurrences), 177,421 bytes and 13 more variants.

If svchost.exe is located in the folder "C:\Program Files\Common Files", the security rating is 61% dangerous. The file size is 17,920 bytes (35% of all occurrences), 155,648 bytes and 10 more variants.

If svchost.exe is located in the Windows Temp folder, the security rating is 58% dangerous. The file size is 102,400 bytes (13% of all occurrences), 106,496 bytes and 14 more variants.

If svchost.exe is located in C:\, the security rating is 52% dangerous. The file size is 2,090,179 bytes (16% of all occurrences), 415,232 bytes and 10 more variants.

If svchost.exe is located in a subfolder of the "My Files" folder, the security rating is 66% dangerous. The file size is 13,537 bytes (57% of all occurrences), 7,168 bytes, 2,260,685 bytes or 13,893 bytes.

If svchost.exe is located in the folder "C:\Program Files", the security rating is 56% dangerous. The file size is 28,672 bytes (33% of all occurrences), 37,376 bytes or 25,600 bytes.

If svchost.exe is located in a subfolder of Windows Temp folder, the security rating is 50% dangerous. The file size is 158 bytes (50% of all occurrences) or 36,352 bytes.

External information from Paul Collins:
There are different files with the same name:

• "CashToolbar" definitely not required. CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "France" definitely not required. Added by the MIMAIL.L WORM!. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "microsoft" definitely not required. Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Monitoring Service" definitely not required. Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Network Service" definitely not required. CoolWebSearch parasite related. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "NvClipRsv" definitely not required. Added by the DUMARU-AK WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Online Service" definitely not required. Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "PowerManager" definitely not required. Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Host " definitely not required. Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Host Driver" definitely not required. Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Service Process" definitely not required. Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Setup experation" definitely not required. Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process, which NOT appear in Msconfig/Startup!
• "Srv32Win" can run at start up. Realtime-Spy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
• "SSL" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "SVCHOST" definitely not required. System1060 homepage hi-jacker. Found in a Windows\System1060 directory. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "svchost" definitely not required. Added by the MORB WORM or TARNO TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Svchost" definitely not required. Added by the MOXE-A WORM! This is not the valid svchost.exe as described here
• "System Host Service" definitely not required. Added the the CONE.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "System Manager" definitely not required. Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "System Update2" definitely not required. Added by the AUTOTROJ-C TROJAN!
• "SystemReg" definitely not required. Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Task Monitoring Service" definitely not required. Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "tjstartup" definitely not required. Added by the CURDEAL TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Windows Service Host" definitely not required. Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Windows Services Host" definitely not required. Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "WindowsUpdate" definitely not required. Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "xor" definitely not required. Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "Zone Labs Client Ex" definitely not required. Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
• "zztp" definitely not required. Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!

Important: Some malware camouflages itself as svchost.exe, particularly when located in the c:\windows or c:\windows\system32 folder. Therefore, you should check the svchost.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.

Svchost scanner

Other processes