What is svehost.exe?

The genuine svehost.exe file is a software component of Virus Infections.
svehost.exe' is an executable used as a backdoor Trojan to infiltrate your PC and follow commands, such as logging keystrokes, stealing passwords, installing executables, obtaining system information, performing denial of service attacks (DOS), terminating valid processes, and much more. 'svehost.exe' should not be confused with 'svchost.exe,' which is usually a valid Windows process unless corrupted by a virus. The file attempts to steal and obtain information from your PC, while also controlling processes and terminating others. The goal of this file is to install itself in the 'System32' folder and pretend that it is a valid Windows process, which it is not.

SvEHost stands for Service E Host

The .exe extension on a filename indicates an executable file. Executable files may, in some cases, harm your computer. Therefore, please read below to decide for yourself whether the svehost.exe on your computer is a Trojan that you should remove, or whether it is a file belonging to the Windows operating system or to a trusted application.

Click to Run a Free Scan for svehost.exe related errors

Svehost.exe file information

Windows Task Manager with svehost
Svehost.exe process in Windows Task Manager

Here is some of what is known about the svehost.exe process. Up to now, our technical analysts have not been able to relate it to any particular software.

Description: Svehost.exe is not essential for Windows and will often cause problems. Svehost.exe is located in the C:\Windows\System32 folder or sometimes in a subfolder of C:\Windows. Known file sizes on Windows 10/8/7/XP are 942,080 bytes (62% of all occurrences), 946,176 bytes and 5 more variants. 
There is no description of the program. The application starts upon Windows startup (see Registry key: MACHINE\RunServices, MACHINE\Run). Svehost.exe is not a Windows system file. The program has no visible window. The svehost.exe file is located in the Windows folder, but it is not a Windows core file. The software uses ports to connect to or from a LAN or the Internet. Svehost.exe is able to record keyboard and mouse inputs, hide itself, manipulate other programs and monitor applications. Therefore the technical security rating is 92% dangerous, however you should also read the user reviews.

Recommended: Identify svehost.exe related errors

External information from Paul Collins:

Important: Some malware also uses the file name svehost.exe, for example Backdoor:Win32/Rbot or Backdoor:Win32/Rbot.gen!E (detected by Microsoft), and Backdoor.Win32.Rbot.ejd or Backdoor.Win32.Rbot.pcb (detected by Kaspersky). Therefore, you should check the svehost.exe process on your PC to see if it is a threat. We recommend Security Task Manager for verifying your computer's security. This was one of the Top Download Picks of The Washington Post and PC World.


User Comments

A google search showed links which told me that this is a nasty process, though i didnt really trust the resources that offered solutions.

  Lord Rayder   (further information)
It also made a keys.txt in system32 which logged all my activities until I terminated the svehost.exe process.
W32/Agobot-LV Worm
  Hayden   (further information)
svehost.exe known as wincap90 spyware
  jwhite71   (further information)
This is a SPYWARE, you must not confuse it with sv"c"host (svchost.exe), a real proccess of MS Windows. Some anti-spyware programs doesn't detect it.
  Guillermo GarcĂ­a   (further information)
It's a trojan virus.Comunicates with other web sites and could also log keystrokes
  doris   (further information)
Seems to upload data to
It is a tojan, sits in c:\windows\system 32 and c:\program files\temp directory. Loads at startup, sends packets of information at random intervals to specific ips. this can interupt terminal sessions on server, as the router becomes swamped with data. Look for similar creation dated files in system32 directory for companion files. Use microsoft process manager to stop all instances, scan and edit registry, .

Rating chart

Summary: Average user rating of svehost.exe: based on 9 votes with 9 user comments. 3 users suspect danger. 6 users think svehost.exe is dangerous and recommend removing it.

Do you have additional information? Help other users!
What do you know about svehost.exe:
How would you rate it:
Link for more info:
Your Name:

Best practices for resolving svehost issues

A clean and tidy computer is the key requirement for avoiding problems with svehost. This means running a scan for malware, cleaning your hard drive using cleanmgr and sfc /scannow, uninstalling programs that you no longer need, checking for Autostart programs (using msconfig) and enabling Windows' Automatic Update. Always remember to perform periodic backups, or at least to set restore points.

Should you experience an actual problem, try to recall the last thing you did, or the last thing you installed before the problem appeared for the first time. Use the resmon command to identify the processes that are causing your problem. Even for serious problems, rather than reinstalling Windows, you are better off repairing of your installation or, for Windows 8 and later versions, executing the DISM.exe /Online /Cleanup-image /Restorehealth command. This allows you to repair the operating system without losing data.

To help you analyze the svehost.exe process on your computer, the following programs have proven to be helpful: Security Task Manager displays all running Windows tasks, including embedded hidden processes, such as keyboard and browser monitoring or Autostart entries. A unique security risk rating indicates the likelihood of the process being potential spyware, malware or a Trojan. Malwarebytes Anti-Malware detects and removes sleeping spyware, adware, Trojans, keyloggers, malware and trackers from your hard drive.

Other processes

svehost.exe [all]