• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

What is svchost.exe?

W

WabeWalker

Supreme [H]ardness
Joined
Sep 3, 2007
Messages
4,508
Suddenly, in task manager, I see that I have 15 instances of something called svchost.exe running. Some of the files are very large - one in particular is over 100,000 k.

Anybody know what this is, and where it came from?

I'm running VISTA 64 by the way. My CPU usage is hovering around 1% with none of my programs running.
 
I Googles it myself, but the problem is that many of these websites are clearly bogus, and although the sites look professional, their true purpose is to trick people into downloading a file that will 'check for spyware' and 'solve the problem'.

I was hoping to hear from an expert here who has dealt with this personally, which is kind of what this forum is about.

I trust the people here. People here keep each other in check. Thank you.
 
Jesus, I wonder why I have 15 instances of this file. The only thing I've done lately is download the Metro patch from Steam, and also the Amnesia demo.
 
Snowknight26 said:
It explains why in the Microsoft KB article.
Click to expand...

How do I get rid of the 15 instances of this file then? Even when I end the process tree these files magically reappear after ten or twenty seconds.

Is this reason for a new OS installation?

That Microsoft article, by the way, went straight over my head - no idea what I'm supposed to do to solve this.
 
MrGuvernment said:
You dont, it is part of the OS, accept it and move on.
Click to expand...

Theses files are new. Two nights ago they weren't there.

You're telling me to ignore them? But they're huge? I mean, one of them is over 100,000k, another is 95,000k.

There are 15 of these things. This can't be normal?
 
I found this website.

http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

As far as I can tell there is no way I can get rid of these svchost files, which are calling up services. All I can do is disable the services that aren't required, so that when the svchost files call upon those services, precious resources won't be used.

So the question becomes, in VISTA 64 how do I know which services to shut down?

God, it might be essayer to re-install the OS.
 
you search your hdd for that filename.
make sure the only instances are in the %systemroot%\Windows\System32 and %systemroot%\system32\dllcache folders (it may also exist in some patch uninstallers if you haven't cleared them).

if that filename exists elsewhere, it could be a virus.

and no, these files are not "new".
Windows always uses the svchost.exe file.
 
I don't know what's going on, but this morning, one day after I first noticed this problem, my memory percentage being used, at 'idle', is now a whopping 61%

How can that be? With none of my programs running, 61% of my memory has been eaten away. That leaves 39% for my programs when they run.

When I do run my programs, I'm noticing hard drive activity, which I'm convinced wasn't there before.

Ugh.

EDIT: One of the svchost files is a whopping 190,000 K, while another is 155,000 k.
 
WabeWalker said:
I don't know what's going on, but this morning, one day after I first noticed this problem, my memory percentage being used, at 'idle', is now a whopping 61%

How can that be? With none of my programs running, 61% of my memory has been eaten away. That leaves 39% for my programs when they run.

When I do run my programs, I'm noticing hard drive activity, which I'm convinced wasn't there before.

Ugh.

EDIT: One of the svchost files is a whopping 190,000 K, while another is 155,000 k.
Click to expand...

You REALLY need to make an effort to understand the articles that were linked before. Odds are the memory will be released once whatever service it is finishes its task and HDD access will stop. My money is on at least one of those svchost processes being a virus scan.
 
But I have read these articles.

They don't address where these files have come from, and why they've suddenly appeared. I check into task manager all the time, and I've never seen these files before. There are 15 of the frickin' things.

Where did they come from?

People here are saying that they were always there. I can assure you that they weren't always there. If they're just magically appearing, but were hidden before, then why are they suddenly no longer hidden. Nobody seems to be know the answer to this.
 
That program does quite a lot of windows related tasks, such as running the clip board (copy and paste) among other things. It's normal to have multiple processes, but yeah I have seen it where it goes bonkers. Never seen 15 though. usually I have about 6 of them, and one is always using way more ram then the others. Right now on the machine I'm on i have one using 28MB, the others are using about 3-5MB

It's not uncommon for a virus to name itself like a system file though, so I would start by doing a scan and see if it finds anything.

You could also try to terminate them one at a time. If it's the true windows one, you'll basically crash (windows will do a force shutdown) but if it actually lets you close it, then it's probably another program called the same thing
 
Go to the svchost process, right click and go to "go to service" it goes to the next tab and shoows what the services are. Svchosts is a wrapper for more than one system type thing. It isn't anything to worry about, neither is the memory usage, as it will be freed up when you need it. It might be any number of things, drive indexing, virus scans. It has probably been doing this for a while but you just haven't noticed before, it's just part of the OS that does its job under the radar. Its not really something to worry about or tinker with. But as Red Squirrel says it does have a chance that it's some kind of malware, especially if things have been running slower or differently, so scan with things if you wish to.

Look I have loads:
o8bhie.png

Windows 7 64bit 16! I winz!!
 
WabeWalker said:
I don't know what's going on, but this morning, one day after I first noticed this problem, my memory percentage being used, at 'idle', is now a whopping 61%

How can that be? With none of my programs running, 61% of my memory has been eaten away. That leaves 39% for my programs when they run.
Click to expand...

http://downloadmoreram.com

Go!

In all seriousness, don't worry about it.
 
Backtracking which service is which is a bit annoying, but you can get a general idea of what they are by going to Administrative Tools > Services. Essentially all of the core Windows services run under the guise of svchost.exe, and you'll find the rest of the background daemons in there as well.

I have no idea why you wouldn't have noticed them before, since they don't just appear out of thin air. You probably just haven't noticed them. No one can explain it because your scenario is quite frankly impossible. If your clocks syncs, you get updates from MS, you are connected to the internet, the event manager is running, hell if your hardware is detected, you have a svchost for each and every one of those. It's like claiming there are no cars behind you when you haven't bothered to look in the rear view mirror.

From the moment you boot on a clean install, svchost.exe is in your face. The number of svchost instances depends on the amount of junk you have running in the background. 10-15 svchost.exe instances under Vista is perfectly normal - each probably houses multiple services anyway. The number varies by XP/Vista/7, but I've seen 12-14 instances of svchost on numerous clean Vista machines.
 
Okay.

I should probably explain something else. This is my gaming machine - that's all I use this for. I don't surf the net or even download files, unless they're patches. If there's a virus on this machine then it came from Steam, d2d, a patch, or from one of my game discs.

I have no anti-virus software on this machine, and my firewall is always off.

I like to have next to no processes running, so task manager is something I look at a lot. Those 15 instances of svchost were definitely not there before.

Anyway, this is no big deal, because it's just my gaming system - that said, I care more about this 'appliance' than any other in my home. It just bugs me that this has suddenly shown up.

Also, to repeat myself, when I end the process tree on these files, they go away, and then pop back up again - it's annoying.
 
so ummmm... have you searched to see where all this file exists? which I suggested earlier?

and yes, it was always there. Granted, maybe fewer of them, but svchost.exe has existed for quite some time now.
I currently have 8 on my XP box

j-sta said:
you search your hdd for that filename.
make sure the only instances are in the %systemroot%\Windows\System32 and %systemroot%\system32\dllcache folders (it may also exist in some patch uninstallers if you haven't cleared them).

if that filename exists elsewhere, it could be a virus.

and no, these files are not "new".
Windows always uses the svchost.exe file.
Click to expand...

Other instances of SVCHOST.EXE:

1) svchost.exe is a process registered as a backdoor vulnerability which may be installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. If unaccounted for, this process should be removed immediately.

2) svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.

3) svchost.exe is a process belonging to Microsoft Service Host Process. This could also be a stealth monitoring software that sits in the background and tracks all activities such as keyboard input (including websites visited, passwords etc.) This information can be sent to third parties through email or ftp uploads. If you did not intentionally install this program make sure you remove it to protect your privacy.


Warning: Multiple instances of SVCHOST may be running on your pc at one time. Some of these may or may not be the legitimate versions.
Click to expand...

http://www.liutilities.com/windows-process/svchost-exe/
 
Also, I should clarify something, having re-read the post above: I didn't mean that svchost wasn't there before, just that there weren't 15 of them, nor were they this large.
 
j-sta said:
so ummmm... have you searched to see where all this file exists? which I suggested earlier?

and yes, it was always there. Granted, maybe fewer of them, but svchost.exe has existed for quite some time now.
I currently have 8 on my XP box
Click to expand...

He said it is a clean install. It is highly unlikely it is a virus and much more likely it is just windows doing what windows does.

Vista and 7 tend to have more of these tasks running than XP boxes. My work Windows 7 machine is running 13 right now with nothing interesting running. A server with a fresh copy of windows 2003 R2 running next to me is running 9 of these.

OP is just wasting time now. Just forget about it. If it really bothers you don't show processes from all users in task manager and you will never see them again.
 
Superdemon said:
He said it is a clean install. It is highly unlikely it is a virus and much more likely it is just windows doing what windows does.

Vista and 7 tend to have more of these tasks running than XP boxes. My work Windows 7 machine is running 13 right now with nothing interesting running. A server with a fresh copy of windows 2003 R2 running next to me is running 9 of these.

OP is just wasting time now. Just forget about it. If it really bothers you don't show processes from all users in task manager and you will never see them again.
Click to expand...

no... he never said it was a fresh install.

he asked if this may be a reason to do a fresh install.

not to mention
I have no anti-virus software on this machine, and my firewall is always off.
Click to expand...
 
j-sta said:
http://www.liutilities.com/windows-process/svchost-exe/
Click to expand...

Okay, I'm not a rocket scientist, but even I'm not THAT stupid.

Do people actually fall for this stuff?

And to the guy above, how exactly am I wasting time? 15 instances of a file have suddenly appeared in task manager - some of the people posting here have been extremely helpful in providing information, but like everything on the net you do have to sift through a lot of nonsense - I mean, obviously.
 
WabeWalker said:
Okay, I'm not a rocket scientist, but even I'm not THAT stupid.

Do people actually fall for this stuff?
Click to expand...

I'm confused... what do you mean by this?

I have used liutilities.com a lot when researching processes to find out the validity of the file.

ignore the "run a free registry scan!" links, and the info provided on the page is helpful.

Here's another:
http://www.neuber.com/taskmanager/process/svchost.exe.html

again, ignore the links. If you would actually read the information provided on the page, you would see that it does provide useful information.
 
j-sta said:
I'm confused... what do you mean by this?
Click to expand...

This information is what you linked me to.

------------------------

1) svchost.exe is a process registered as a backdoor vulnerability which may be installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. If unaccounted for, this process should be removed immediately. Click here to run a free registry scan now.

2) svchost.exe is a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system. Click here to run a free registry scan now.

3) svchost.exe is a process belonging to Microsoft Service Host Process. This could also be a stealth monitoring software that sits in the background and tracks all activities such as keyboard input (including websites visited, passwords etc.) This information can be sent to third parties through email or ftp uploads. If you did not intentionally install this program make sure you remove it to protect your privacy. Click here to run a free registry scan now.

Warning: Multiple instances of SVCHOST may be running on your pc at one time. Some of these may or may not be the legitimate versions.
Scan for SVCHOST.EXE related errors

--------------------

Some people will see that and actually download the file.
 
WabeWalker said:
This information is what you linked me to.

------------------------

<snip>

--------------------

Some people will see that and actually download the file.
Click to expand...

ahh, ok.

well, it can be installed with other drive-by malware.
it could be packaged with other malicious software.
etc
It's not like somebody actually needs to intentionally download and execute a file called svchost.exe
 
If it makes you feel any better, I have 14 svchost.exe processes running on my Vista 64 machine. None of mine are using that much memory though (highest is ~20mb) but I really don't use that computer anymore.

How much memory do they use if you restart and don't do anything other than let it idle?
 
WabeWalker said:
Okay.

I should probably explain something else. This is my gaming machine - that's all I use this for. I don't surf the net or even download files, unless they're patches. If there's a virus on this machine then it came from Steam, d2d, a patch, or from one of my game discs.

I have no anti-virus software on this machine, and my firewall is always off.

I like to have next to no processes running, so task manager is something I look at a lot. Those 15 instances of svchost were definitely not there before.

Anyway, this is no big deal, because it's just my gaming system - that said, I care more about this 'appliance' than any other in my home. It just bugs me that this has suddenly shown up.

Also, to repeat myself, when I end the process tree on these files, they go away, and then pop back up again - it's annoying.
Click to expand...

Umm, even if it was a gaming machine you should still have a firewall and an antivirus running, whether you actively download other files on it or not.
That's just crazy.
 
CanesVenetici said:
Umm, even if it was a gaming machine you should still have a firewall and an antivirus running, whether you actively download other files on it or not.
That's just crazy.
Click to expand...

That stuff can bog your system down. I've been gaming since 1982, and I've never had a problem.

What do I care about?

1) credit card number being compromised.
2) password for hotmail, steam, or D2D being compromised.
3) games running slowly because of malicious coding.

So far, I've never had a problem. Knock on wood.

On my Macbook, however, I go everywhere and download everything. Now my iPad is filling in for that purpose as well.

Just playing it safe is one of the best ways to protect yourself. If you're surfing for porn on the same computer you're doing your banking on, then by all means.
 
Also, I can't help but say this - it's just in my nature: so far, I still don't have one of the answers to one of my questions.

Two nights ago, those 15 instances of the file in question weren't there - yes there were two or three such files, but they were very small, and weren't using consequential resources.

So where did these processes come from, and what could have triggered them to suddenly appear?

It would be nice to have a concrete answer to that question.
 
WabeWalker said:
Also, I can't help but say this - it's just in my nature: so far, I still don't have one of the answers to one of my questions.

Two nights ago, those 15 instances of the file in question weren't there - yes there were two or three such files, but they were very small, and weren't using consequential resources.

So where did these processes come from, and what could have triggered them to suddenly appear?

It would be nice to have a concrete answer to that question.
Click to expand...

Windows Engineers are the ones that know the answer, I have 12 running right now, different things trigger it. leave it alone and dont sweat the small stuff.
 
As long as the description of each process is "Host Process for Windows Services," you are probably in the clear.
 
I feel like OP is trolling at this point. EVERYONE who's posted has given the same information, but s/he won't believe any of it. As someone stated earlier, you very likely just hit the "show processes from all users" button. You can't help someone who won't help himself and won't accept good advice or diagnosis.

Gaming since 1982 is irrelevant to the concept of computer security. I've been driving for over ten years, so I don't need to wear a seatbelt. See how that works? It's just a matter of time before another Sasser-esque STD-worm rolls around.
 
Woofer00 said:
you very likely just hit the "show processes from all users" button.
Click to expand...

Could you be a little more specific, please - seriously, this is exactly what I wanted to know.

How do you hide processes? I've honestly never heard of this before.

If I've somehow revealed hidden processes (in other words if all those instances of svchost were always running, but I simply did something to reveal them in Task Manager) then I need to know how I did it? And please don't accuse me of trolling! Any half curious person would want to know this!
 
He means in task manager. In the "processes" tab on the bottom left "show processes from all users" is either checked or not. If it is, then you should see everything and a lot. If it's not, there shouldn't be all that much running.

On my 3 yr old Vista 64 install I have 15 processes with it unchecked and no svchost.exe processes shown (but they're obviously running).
 
dudewth said:
He means in task manager. In the "processes" tab on the bottom left "show processes from all users" is either checked or not. If it is, then you should see everything and a lot. If it's not, there shouldn't be all that much running.

On my 3 yr old Vista 64 install I have 15 processes with it unchecked and no svchost.exe processes shown (but they're obviously running).
Click to expand...

Of course.

Thanks. I should have realized that's what he meant.
 
You must log in or register to reply here.
Back
Top