English | Deutsch


Is svchost.exe safe?

Svchost.exe is a executable file (a program) within Windows. The filename extension .exe denotes an executable file. You should only run executable files from publishers you trust, because executable files can potentially change your computer settings or harm your computer. The free file information forum can help you determine if svchost.exe is a virus, trojan, spyware, or adware that you can remove, or a file belonging to a Windows system or to an application you can trust.


Svchost.exe file information

The process known as Generic Host Process for Win32 Services or Host Process for Windows Services or winrscmde or AutoHotkey or BindFile Microsoft or mIRC or CCProxy Microsoft MFC Application or Windows Host Process

belongs to software Microsoft Windows Operating System or AutoHotkey or GT.exe or BindFile or mIRC or Remote Access Auto Connection Manager or guangao or Generic Host Process for Win32 Services

by Microsoft (www.microsoft.com) or Home or mIRC Co. (www.mirc.com) or MS User or TODO: lQøST or Clickteam or All or VolkS.

Description: The original svchost.exe from Microsoft is an important part of Windows, but often causes problems. svchost.exe is located in the folder C:\Windows\System32. Known file sizes on Windows 7/XP are 14,336 bytes (80% of all occurrences), 20,992 bytes and 34 more variants. http://www.file.net/process/svchost.exe.html 
It is a Windows system file. The program has no visible window. The file is a trustworthy file from Microsoft. The application listens for or sends data on open ports to a LAN or the Internet. Therefore the technical security rating is 9% dangerous, however also read the users reviews.

Recommended: Identify svchost.exe related errors

Viruses with the same file name

Is svchost.exe a virus? No, it is not. The true svchost.exe file is a safe Microsoft Windows system process, called "Generic Host Process". However, writers of malware programs, such as viruses, worms, and trojans deliberately give their processes the same file name to escape detection. Viruses with the same file name are e.g. IRC.Backdoor.Trojan or Trojan.Gen (detected by Symantec), and Trojan-Downloader.Win32.VB.bsa or P2P-Worm.Win32.Palevo.andm (detected by Kaspersky).
To ensure that no rogue svchost.exe is running on your PC, click here to run a Free Malware Scan.

How to recognize suspicious variants? If svchost.exe is located in the folder C:\Windows, the security rating is 68% dangerous. The file size is 36,352 bytes (13% of all occurrences), 70,207 bytes and 250 more variants. Svchost.exe is not a Windows system file. The program is not visible. The svchost.exe file is located in the Windows folder, but it is not a Windows core file. It is a file without information about the developer of this file. Svchost.exe is able to record inputs, monitor applications, hide itself and manipulate other programs.

If svchost.exe is located in a subfolder of "C:\Documents and Settings", the security rating is 66% dangerous. The file size is 233,472 bytes (38% of all occurrences), 106,496 bytes and 218 more variants. The svchost.exe file is not a Windows system file. There is no description of the program. The program is not visible. The process is loaded during the Windows boot process (see Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, C:\Windows\win.ini, HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx, HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce, HKEY_LOCAL_MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad). Svchost.exe is able to monitor applications.

If svchost.exe is located in a subfolder of C:\Windows, the security rating is 68% dangerous. The file size is 20,992 bytes (8% of all occurrences), 37,888 bytes and 235 more variants.

If svchost.exe is located in a subfolder of C:\Windows\System32, the security rating is 73% dangerous. The file size is 32,768 bytes (5% of all occurrences), 86,016 bytes and 163 more variants.

If svchost.exe is located in a subfolder of "C:\Program Files", the security rating is 60% dangerous. The file size is 497,664 bytes (10% of all occurrences), 493,568 bytes and 156 more variants.

If svchost.exe is located in the folder C:\Windows\System32\drivers, the security rating is 88% dangerous. The file size is 30,720 bytes (8% of all occurrences), 34,304 bytes and 74 more variants.

If svchost.exe is located in a subfolder of C:\, the security rating is 62% dangerous. The file size is 183,808 bytes (21% of all occurrences), 239,104 bytes and 45 more variants.

If svchost.exe is located in a subfolder of "C:\Program Files\Common Files", the security rating is 59% dangerous. The file size is 1,429,504 bytes (10% of all occurrences), 397,824 bytes and 31 more variants.

If svchost.exe is located in the Windows Temp folder, the security rating is 60% dangerous. The file size is 409,088 bytes (30% of all occurrences), 102,400 bytes and 21 more variants.

If svchost.exe is located in a subfolder of C:\Windows\System32\drivers, the security rating is 79% dangerous. The file size is 244,868 bytes (20% of all occurrences), 177,421 bytes and 13 more variants.

If svchost.exe is located in the folder "C:\Program Files\Common Files", the security rating is 61% dangerous. The file size is 17,920 bytes (35% of all occurrences), 155,648 bytes and 10 more variants.

If svchost.exe is located in C:\, the security rating is 52% dangerous. The file size is 2,090,179 bytes (16% of all occurrences), 415,232 bytes and 10 more variants.

If svchost.exe is located in a subfolder of the "My Files" folder, the security rating is 66% dangerous. The file size is 13,537 bytes (57% of all occurrences), 7,168 bytes, 2,260,685 bytes or 13,893 bytes.

If svchost.exe is located in a subfolder of Windows Temp folder, the security rating is 61% dangerous. The file size is 1,539,847 bytes (16% of all occurrences), 645,120 bytes and 4 more variants.

If svchost.exe is located in the folder "C:\Program Files", the security rating is 56% dangerous. The file size is 28,672 bytes (33% of all occurrences), 37,376 bytes or 25,600 bytes.

If svchost.exe is located in the folder "C:\Documents and Settings", the security rating is 64% dangerous. The file size is 54,784 bytes (50% of all occurrences) or 145,408 bytes.

External information from Paul Collins:
There are different files with the same name:

  • "CashToolbar" definitely not required. CashToolbar Downloader-MY adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "France" definitely not required. Added by the MIMAIL.L WORM!. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "microsoft" definitely not required. Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Monitoring Service" definitely not required. Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Network Service" definitely not required. CoolWebSearch parasite related. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "NvClipRsv" definitely not required. Added by the DUMARU-AK WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Online Service" definitely not required. Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "PowerManager" definitely not required. Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Service Host " definitely not required. Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Service Host Driver" definitely not required. Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Service Process" definitely not required. Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Setup experation" definitely not required. Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process, which NOT appear in Msconfig/Startup!
  • "Srv32Win" can run at start up. Realtime-Spy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
  • "SSL" definitely not required. Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "SVCHOST" definitely not required. System1060 homepage hi-jacker. Found in a Windows\System1060 directory. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "svchost" definitely not required. Added by the MORB WORM or TARNO TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Svchost" definitely not required. Added by the MOXE-A WORM! This is not the valid svchost.exe as described here
  • "System Host Service" definitely not required. Added the the CONE.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "System Manager" definitely not required. Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "System Update2" definitely not required. Added by the AUTOTROJ-C TROJAN!
  • "SystemReg" definitely not required. Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Task Monitoring Service" definitely not required. Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "tjstartup" definitely not required. Added by the CURDEAL TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Windows Service Host" definitely not required. Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Windows Services Host" definitely not required. Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "WindowsUpdate" definitely not required. Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "xor" definitely not required. Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "Zone Labs Client Ex" definitely not required. Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
  • "zztp" definitely not required. Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!

Important: Some malware disguises itself as svchost.exe, particularly when not located in the C:\Windows\System32 folder. Therefore, you should check the svchost.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.



Score

User Comments

Seems to be running all the time now. Probably causing on-line duties to slow down rather than speed up. If I end process through task manager have to reboot computer to get on-line again.
  Paul Kelly  
Its an essential program used by windows to run, if its terminated in the task manager your computer will shut down automatically, my computer runs 6 svchost.exe programs at once and they use barely any cpu, just to say, its essential for your computer so dont delete it
  theking  
windows process
  josh  
This process mostly used for support background process
  TARUN TCT   (further information)
I find that this takes 100% CPU but after 15 to 20 minutes it returns back to normal CPU usage. During this period of 15 to 20 minutes I don't do anything on my LT. It started in my LT especially when it goes to hibernate and when restarted again.
  Ramesh  
Weird, but this is one of the only exceptions to Window's restriction on complete filenames being unique. (as in "C:\folder\folder\file.extention.") I have several instances of the file residing in the same location, with unique sizes. While not dangerous, it is somewhat odd...
  Leviathan  
If it is spelled correctly within your task manager it is not dangerous. Only if there is a misspelling we are dealing with something dangerous.
  Bastiaan   (further information)
I have 6 svchost running and my internet and pc is really slow. I tried so many softwares to check and clean my pc of viruses and malwares but the problem is still persistent. I am running the analyzer and it has the warning message...
  Janice  
More comments can be found here:
    (further information)

Rating chart

Summary: Average user rating of svchost.exe: based on 753 votes with 9 reviews.
220 users think svchost.exe is essential for Windows or an installed application. 37 users think it's probably harmless. 182 users think it's neither essential nor dangerous. 89 users suspect danger. 225 users think svchost.exe is dangerous and recommend removing it. 70 users don't grade svchost.exe ("not sure about it").


Do you have additional information?
What do you know about svchost.exe: 
How do you rate it: 
Link for more info's: 
Your Name: 


Svchost scanner


Security Task Manager shows all running Windows tasks including embedded hidden functions (e.g. keyboard or browser monitoring, autostart entry). A unique security risk rating indicates the likelihood of the process being potential spyware, malware, keylogger or a Trojan.

Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, trojans, keyloggers, malware and tracking threats from your hard disk. Ideal supplement to Security Task Manager.

SpeedUpMyPC scans, cleans, repairs and optimizes your computer.


Other processes


svchost.exe [all]