Svchost exe loads the processor windows 7 solution. What to do if svchost loads the system

Svchost.exe is an executable file that has “scared” more than one user. Although this word could be written without quotation marks. This process, with its full, one hundred percent load on the computer processor, is truly frightening.
What this process is responsible for, why the full download occurs and how to deal with it is the topic of today’s article.

Svchost virus or system process?

In order not to waste CPU time and load RAM, the developers assigned one process to several services at once. Some users considered this decision of the developers to be erroneous, since it has a number of shortcomings. And here's why.

Important information! Svchost.exe is constantly used by attackers who create Trojans and viruses in order to disguise their executable files as this process, sometimes causing irreparable damage to the operating system. The fact that the process starts several services at once is to the advantage of malware developers. And when the user has problems and suspects viruses in the system, he launches the dispatcher, and there are almost a dozen of these svchost.exe. And how can you guess which of these identical processes is hiding a malicious file?

Since this process is a system one, allowed to run by the operating system, ending it is fraught with unstable operation of the computer or critical errors. Therefore, many users turn their attention to other files, hoping to find malicious codes and programs in other places in the OS.

Important information! The svchost.exe process never runs as an administrator (user). This operation is launched only by system services, NETWORK and LOCAL SERVICE, as well as SYSTEM through their mechanisms. If the operation is started by the Run section of the registry, it is a 100% viral executable file.

Ways to solve the problem with svchost.exe

Solution two: Check for virus activity on the system. It checks itself or starts. But it’s easier to overlook viruses yourself, but the program is unlikely to make a mistake. But to be on the safe side, first check the system manually, and then run an anti-virus scan with a special utility.

Find the Processes tab.

To make checking more convenient, sort all processes depending on how they load the system or how much RAM they consume. This can be done in the Memory and CPU columns.

Click on these two columns, the system will sort the processes, and those that consume more resources will go first. You saw several svchost.exe files.

Now you should see under whose name the executable files are running. If from the system (SYSTEM), NETWORK and LOCAL SERVICE, then these are safe processes launched by the OS.

And if you are wondering on whose behalf (by what service) the svchost.exe process is running, click on each of them and go to a separate tab.

A lot of resources are usually consumed by the “IP Helper Service” and the one that is responsible for automatically updating the computer software.

Disable the first and second services one by one, but in the second case you will not receive automatic updates for the operating system, and all these processes will have to be started manually.

The IP helper service supports IPv6, which is not widely used, so feel free to disable it. This will not affect the operation of the operating system.

There are cases when a virus disguised as svchost.exe infects the antivirus program itself installed on the operating system, and therefore it does not recognize it and produces incorrect scan results.

To ensure that scanning for virus activity is successful, do not use installed antivirus programs, but use free utilities that are designed specifically for such one-time checks, for example, from Kaspersky Lab. To run the scan, copy the program downloaded to your computer to removable media. Then turn on the system in safe mode and check using the utility.

Solution four: You can restore the operating system from the last checkpoint. The point is that a checkpoint is created with a fully functional operating system. And if problems arise, the system can be rolled back (restored) using a previously created checkpoint. The computer boots with operating parameters, and the operating system operates as before.

Solution five The Prefetch folder is used by the computer to launch programs and speed up the operating system. The system saves the parameters of previous downloads to this folder. Delete everything stored there. Prefetch can be found in the system directory (Windows folder) of the operating system.

The first step is to try disabling applications one by one. Indeed, a low-power device can easily be overloaded by simultaneously running several heavy-duty applications.

Second. Often the cause of problems is prolonged active surfing on the Internet. The system is littered with hundreds of megabytes of temporary files. The registry is confused. There are two options here.
1. Run the cleaner and remove all unnecessary files, repair the registry and perform basic defragmentation.
2. Didn't help? Then open System Restore and roll back to an earlier state. It is almost never possible to restore normal performance in one go. Usually no more than three restorations are sufficient.

And don't forget to create rollback points. Does the computer fly? Go to Recovery and create a return point. It will come in handy.

Another classic cause of system overload is the svchost.exe process.

What is it and why does it interfere with the operation of the computer? The svchost.exe process is one of the auxiliary system services involved in many other tasks. The thing is useful, but sometimes it's buggy. What can disrupt this process?
1. Physical damage to memory chips. A lot of dust has accumulated in the system unit. Service centers recommend vacuuming the inside of your computer at least once a year.
2. Errors when downloading automatic updates. For example, during the update process there were interruptions in the Internet connection or power outages. Facts have been noted where the update packages themselves were initially delivered with bugs. Even Microsoft experts themselves admitted this.

In cases where problems are caused by bad updates, it is recommended to go to the official Microsoft website and download a proven and reliable package, then install it yourself.

Viruses are often disguised as svchost.exe processes.

It is very convenient for hackers to present a virus or Trojan under the guise of the svchost.exe process. The system will issue a notification about an unknown error and the user will still be able to figure out the reasons. First you need to find out if the svchost.exe process is at fault? To do this, open the Windows Task Manager (Alt+Ctrl+Del) and go to the Processes tab.

There will be at least four svchost.exe processes. Now look at the load level for each process. If some svchost.exe process has a load close to 100%, this is the culprit of the problems. What's next?
1. To begin with, it is always recommended to reboot the system. Most often the problems disappear.
2. If everything happens again, open the Task Manager again and end the overloaded svchost.exe process. To do this, open the context menu (right mouse button) and click End Process Tree. Restart your computer again.
3. Didn't help? Now the surgical method. Open Windows Explorer. Find the Windows folder. Select the folder C:\WINDOWS\Prefetch. Delete this folder. Then open Task Manager again and again end the tree of the overloaded process svchost.exe Restart the computer.

Basically, if the problem was actually a random crash of the svchost.exe process, everything should be fine. If the problems continue, the cause should be looked for somewhere else. It may actually be a viral infection. Then you need to take a closer look at all the processes and try to identify the disguised virus.

Signs of a virus disguised as the svchost.exe process

Normal svchost.exe processes run under the username:
- SYSTEM LOCAL SERVICE
- NETWORK SERVICE

Or something like that. Viruses hide under the username ADMIN or whatever you are logged into the Windows user account.

If a misdirected Cossack is detected, complete its tree and thoroughly clean the system with antivirus. Don't be afraid if you accidentally kill the normal svchost.exe process. The smart Windows system will simply reboot automatically.

Be sure to install a decent antivirus package if you use the Internet. Especially if you like to explore new sites, experiment with programs and other eighteen-plus entertainment. Download the healing utility Dr. Web CureIt. Copy it to a flash drive and store it for a rainy day. This program does not require installation and is capable of finding and neutralizing viruses on already affected systems.

For the rainiest day, keep a Windows distribution kit and make timely backups of important documents.

Surely, no one needs to explain that very often in their work, many users of modern PCs are faced with a situation where the operation of the computer terminal slows down. Unfortunately, very often you can see that it is the Svchost process that loads the memory and processor. Let's see what this process is and how to get rid of unnecessary load on system resources.

What is the process Svchost.exe

First you need to figure out what kind of service this is and how it works. Naturally, every user, when entering the “Task Manager” when entering a command in the “Run” menu or when calling using Ctrl + Alt + Del in the process tree, observes not one, but at least four or five Svchost processes. exe, doing something unclear.

Don't panic right away. That's how it should be. In fact, this is a system service that was used by Microsoft specialists in Windows systems relatively recently. This refers to the fact that previously this process was assigned exclusively to functions responsible for a correct network connection or connection to the Internet.

This did not in any way affect the launch of applications. Then the developers added headaches to the service and assigned it responsibilities related to speeding up the launch of programs and their components after the Services.exe service started. So it turns out that, intentionally or unintentionally, Svchost loads the memory of Windows 7, as they say, regardless of persons and ranks. Here a situation emerged that in Russian can be described as “they wanted the best, but it turned out as always.” Nevertheless, it is possible to combat the manifestations of excessive load, but first let’s look at how exactly this service affects the system.

Why does the Svchost.exe process load the system?

First of all, it is worth saying that the developers tried to make a single service that should be responsible for launching all programs. On the one hand, this is very good. Why run a bunch of unnecessary components to start this or that process? In particular, this applies to calling data from so-called dynamic libraries.DLL. Such files themselves are not executable, but work only through hosts.

The simplest example is the use of RTAS, DX or VST format plugins connected to audio, video editors or special music sequencers via a DirectX bridge or service drivers such as ASIO4ALL.

So it turns out that good intentions did not lead to anything good. A single service has received excessive load, as a result of which the Svchost service loads memory so much that neither the processor nor physical memory can cope with such a load. Judge for yourself, you can simultaneously open up to a dozen applications on a computer terminal or laptop. Some people like to play their favorite game while listening to music. But all this is launched through Svchost.exe.

Well, if you take into account that there is a connection to the Internet, then the whole system may freeze, because the service itself, as mentioned above, combines not only the functions of launching applications, but also the priorities of a network connection and access to the World Wide Web . Here it is worth considering the fact that if you are using an online game, and it is quite resource-intensive, not only the Svchost.exe service will work. Netsvcs uses memory no less. This is a related process when accessing the Internet.

How many processes can be running simultaneously

When a user feels or observes in the process tree that the Svchost service is loading RAM, he immediately begins to panic, because there are at least four identical services in the list. No worries. Depending on the number of running applications and the availability of an Internet or local network connection, there can be much more of them (up to a dozen or more). Some people think that these are viruses and try to terminate everything they can, and then delete the accompanying components and the program file itself. This is wrong. A little later we will talk about how to distinguish a normal process from malware.

The simplest method to terminate the Svchost.exe process

So, we have a situation where Svchost loads Windows 7 memory too much. What is the simplest way to get rid of this? Yes, very simple. You just need to restart your computer terminal.

After a reboot, the use of system resources from calling applications will decrease significantly.

You can do it differently and go to the “Task Manager”, called from the command line or the usual keyboard shortcut Ctrl + Alt + Del, on the “Processes” tab, find the service we are interested in (in this case, Svchost.exe) and click the “End Process” button.

In this case, you need to choose exactly the component that has the most negative impact on the use of the processor or RAM. Naturally, you can terminate all other processes.

Removing Process Components

In some cases, there is a situation where Svchost.exe loads the processor. What to do in this case?

Some experts recommend using the physical intervention method and stopping the service by deleting the Prefetch folder, which is located in the Windows root directory (C:\WINDOWS\Prefetch), after which you will need to end the process tree and reboot the system. Nothing bad will happen.

Svchost.exe process attributes

Regarding attributes, the Svchost.exe process is never run as a user, even if he is an administrator on a particular computer terminal or server.

There can be only three options in the process description: LOCAL SERVICE, SYSTEM or NETWORK SERVICE. Anything that has other attributes can be completed without hesitation and without a twinge of conscience.

Suspicion of viruses

Of course, there may also be a situation where it is clear that the Svchost process is loading memory for no apparent reason, and the attributes of the service do not correspond to what was indicated above. In that case, you can be sure that it is. Of course, such a process can be completed manually, but it is strongly recommended that you check the system with some powerful anti-virus package. This, however, does not always help either, since viruses disguise themselves as services quite well and can even hang in RAM.

Here it is better to use applications like Dr. Web Rescue Disc or Kaspersky Rescue Disc, which start even before Windows starts. Such applications are capable of detecting viruses even in situations where the standard antivirus misses threats or simply does not find them.

Conclusion

That's all, actually. We have figured out the general concepts of why Svchost loads memory or processor, and how to stop this service. The only question that remains is whether it is advisable to stop or delete the process. If this is a regular process, you should not terminate it even on low-power machines; it is better to wait a little until the service stops accessing any data or libraries. Well, as a last resort, you can simply reboot the system or close problematic programs. It’s better not to get into the system itself.

When a process ends, the Task Manager may experience a spontaneous reboot or, worse, a blue screen of death. Then you will have to restore Windows or even completely reinstall it. And these, as you know, are processes that are extremely undesirable. In addition, most likely, no user will want to reinstall Windows 7 or restore it from the console, since this is quite a troublesome task. And such a process takes a lot of time, not to mention the preparatory operations.

The problem with a freezing computer is probably familiar to everyone without exception. As a rule, this is blamed on viruses, poorly written programs, as well as simple overheating. From time to time, svchost.exe is the culprit. What kind of process is this, and why does this happen? Let's try to figure it out!

Virus or not?

Firstly, many people immediately succumb to panic. When they see svchost in the Task Manager, they immediately assume that an insidious virus has entered the computer. The latest antivirus (or better yet two) is immediately installed, after which the computer is scanned several times. If the user was so zealous that he installed two or three security applications at once, then the system is guaranteed to crash.

We warn you right away: this is not a virus, so do not rush to delete svchost.exe! What is this process then?

General information about the application

This is the name of a very important component responsible for launching the system's dynamic libraries (DLLs). Accordingly, both Explorer (Explorer) of Windows itself and more than one thousand third-party applications depend on it. This especially applies to games that actively use these libraries via DirectX.

It is located at this address: %SystemRoot%\System32. By reading registry entries at each boot, the application generates a list of services that should be started. It should be noted that several copies of svchost.exe can be running at the same time (you already know what kind of process this is). The important thing is that each process may well contain its own group of services. This was done for maximum comfort in monitoring the operation of the system, as well as to simplify debugging in case of any problems.

All groups that are currently part of this process can be found in the following registry sections:

• HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost;
• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service.

All parameters that are available in these sections are visible as separate instances of svchost.exe (we have already explained what this is).

Each registry section that relates to them has a parameter of the form: REG_MULTI_SZ. It contains the names of all services available as part of a specific Svchost group. Each of them contains the name of one or more services, the description of which contains the ServiceDLL key.

This is what the svchost.exe file is.

How to check processes associated with Svchost?

To see all the services that are currently associated with this process, you need to do a few simple things.

• Click on “Start”, and then find the “Run” command in this menu.
• Enter there and then press ENTER.
• After that, copy and paste the following expression into the command line emulator that opens: Tasklist /SVC. Use the ENTER key again.
• A list of all processes will be displayed in the form of a list. Attention! Be sure to enter the /SVC key parameter, as it displays the active services. To get extended information about a specific service, use the following command: Tasklist /FI "PID eq process_id" (including quotes).

If you have problems

It often happens that after entering commands, the computer displays something unintelligible, like: “The command cannot be recognized.” Don't rush to enter it again.

Typically, this happens because you are working under an account whose rights are simply insufficient to perform this type of action. It doesn't matter whether you have an administrator account or not. To correct the situation, the command line emulator should be launched in a slightly different way.

To do this, click on the “Start” button, then enter CMD in the “Search” field. A list of found files will open on the right side of the menu. Right-click on the first of them (with the corresponding name), and then select “Run as administrator” in the context menu that appears.

So we have given you the basic information. Now let's look at those malicious programs that can masquerade as a harmless system application.

How to separate the wheat from the chaff?

Look carefully at the process name: it should be written as sVChost! There are some Trojans that masquerade as sVHost that are very common. If you see something like this in your “task manager”, then in this case it is indeed time to completely scan the system for the presence of malicious applications.

Especially “advanced” viruses and Trojans can still masterfully camouflage themselves by having exactly the same name as the real process. But even they can be distinguished with 100% probability by paying attention to the most characteristic signs. Let's look at them.

Firstly, a real system process is never (!) launched as a regular user. Its start can be initiated by SYSTEM, LOCAL SERVICE, and NETWORK SERVICE. What is more important is that it does not start (!) when the system starts using startup tools. Accordingly, the list of programs that start simultaneously with the system should under no circumstances include svchost.exe. What is the process in this case?

If you see something like this, then there is only one reason - a virus.

Checking startup

Don't know how to do this? It's very simple! First, click on the “Start” button and left-click on the “Run” field. Then enter the MSConfig command there. A list of all applications launched at startup will open, which you need to review carefully.

If there are many svchost.exe processes (or even one), then you will definitely have to think about how to remove it from your computer.

What to do if you detect a “spy”?

As we have already said, in this case it is best to scan the OS with a powerful antivirus program. But before that, it won’t hurt to perform a number of simple steps with which you can completely block the virus from any opportunity to harm you. In general, the svchost.exe virus has spread widely across the RuNet in recent years. As a rule, malware that specializes in stealing user personal data operates under the guise of a normal system process.

First, in the “File location” line, find the specific folder in which the virus file is located. Select it in the list with the left mouse button and click on the “Disable” button. Click “OK”, then go to the directory with the desired file and delete it. All. Can be scanned by antivirus.

The process is very CPU intensive. Why does this happen and what should I do?

So we are back to the beginning of our article. Do you remember that sometimes due to svchost.exe (what kind of process this is, we have already explained in detail) the computer begins to slow down and “hang”? Why is this happening? And how can you overcome this phenomenon without reinstalling the system?

The simplest way

There is a fairly simple and effective recommendation that helps in many cases. Open the “Task Manager”, look for the svchost process there, then right-click on it and select “Priority/Low”. It should be noted that this must be done with each process of the same name that is in the “Task Manager”.

We remind you once again: if you see the svchost.exe file (you already know what it is), under no circumstances rush to delete it, suspecting it is a virus!

Windows Update Service

Often on Windows XP the problem with almost 100% and svchost is caused by the fact that the update service does not work correctly. Some computer resources have found an explanation for this phenomenon.

The issue is an incorrect update checking mechanism. Considering the number of patches that have been released for this system, a small error in memory allocation has turned into a serious problem: the computer is not only slow, but you can easily search for “patches” for days, alternately freezing at the same time.

How to disable the problematic service?

To temporarily disable Windows Update, go to the “Control Panel” and find the “System and Security” item there. It is there that the desired “Windows Update” is located, in which we are interested in the “Turn on or off automatic updates” item. Check the box next to “Do not check for updates.” Click on OK and reboot the machine.

If after this everything is fine, and the processor is not in a “dead” state most of the time, then the culprit of all the problems was indeed the update service. In the event that the problem continues to occur after this, we return Windows Update to its original state, after which we continue to look for the culprit of all the misfortunes.

Internet Browser

However, take your time. In many cases, Internet Explorer is to blame. Remember how at the very beginning of the article we discussed the importance of svchost for Explorer? But “Internet Browser” is an important part of the file manager of the Windows OS family.

Problems with it very often begin when the IE version is very outdated. For example, Microsoft itself has not recommended using Windows XP with the sixth version of Internet Explorer for a very long time.

Accordingly, in this case it is quite simple. Use the Windows Update service mentioned above. Download and install all the latest updates for your version of the operating system, install the new version of IE. It is possible that this measure will help you.

Games

Observe which applications the processor is overloaded after trying to launch. In addition, you should be wary of “svchost.exe application error” messages, which are an almost 100% indicator that some third-party application is to blame for the system’s inappropriate behavior.

Most often, this program is a game downloaded by its happy owner from some “left” site. Those who have made modifications to the program code, removing protection from it, rarely test their creation for full compatibility with certain systems, their DLLs, etc. So there is nothing to be surprised in this case.

"Bat"

In rare cases, owners of old versions of The Bat mail program encounter this problem, which for one reason or another many people continue to use. Try uninstalling the application. After this, install the latest version of the utility, and then look at the computer’s behavior again.

Drivers

Very often, when moving the system to another disk after some serious errors in the file system, as well as after a virus attack, users are faced with an OS that is completely frozen due to svchost. exe. “How to remove this malicious process?” - think novice users.

Let us warn you once again: deleting this file will lead to dire consequences and complete system inoperability, so before taking extreme measures, it is better to read our next advice.

There is information that the svchost.exe process, the error of which spoils so many nerves for users, may not work correctly due to incorrectly installed or “crooked” drivers. Very often it turns out that the cause is programs for video cards and sound cards. The drivers for these are complex and unpredictable, so if possible, remove them and then install the latest (or most stable) versions.

Windows Defender

Owners of Windows Vista/7 should pay attention to the Windows Defender program, which is included as standard with these operating systems. It serves to prevent malware from entering the system, but sometimes it itself behaves no better.

Problems arise if the installed third-party antivirus software for some reason does not deactivate Defender. This is especially true for all Eset Nod products, which have been extremely popular with many domestic users in the recent past.

To correct this situation, click on the “Start” button, go to “Control Panel”, and then find “Defender” in it. In its main window there is an item “Run scan when idle.” Uncheck it, click OK. In some cases this measure turns out to be useful.

We hope you found out what the svchost.exe program is. We talked in detail about its purpose, as well as methods for eliminating problems with it. Typically, the troubleshooting methods we provide work. All you need to do is strictly follow the instructions in the article.

In addition, it does not hurt to update the system on time.

Users who frequently use Task Manager have noticed that several svchost.exe services are displayed in the list of worker processes. But not everyone, and especially inexperienced users, know what svchost.exe is in the Task Manager and what it is responsible for.

What is svchost.exe?

Svchost.exe is a system executable (as the name suggests) file for Windows OS. It is responsible for launching some applications and functions, reducing the load on the central processor and RAM. Therefore, you cannot remove it from the system (except in cases where malware is disguised as this service or when you can disable unused services, as described in the article “Increasing computer performance by disabling unused services”).

If you see multiple copies of svchost.exe in the Task Manager, don't worry, because their number depends on the number of programs running: the more there are, the more of these services.

How the process works

This process is present in almost every version of Windows, but its potential was revealed only with the release of Windows XP. Before that, he was primarily responsible for the network connections through which the computer connects to the Internet. But Microsoft developers decided not to stop there, so now the service is designed to run background local processes related to dynamic libraries that have the “.dll” extension.

Interesting! Dynamic libraries cannot be launched in normal mode.

svchost.exe allows you to save computer resources because you do not need to physically run the executable file when using the service. Therefore, the number of processes loading RAM and virtual memory of the PC is reduced. It is because of this that several services with the same name are simultaneously displayed in the Task Manager.

In addition, the svchost.exe file is automatically launched when Windows starts, regardless of what programs are “hanging” in autorun. Therefore, completely disabling unnecessary services and applications will not affect its loading.

Reasons for downloading resources

Often, users notice that a process loads one of the resources (processor or RAM) of the device, regardless of whether programs are running or not. There are various reasons for this.

Viruses

The main reason is malware that has entered the computer and “masquerades” as the svchost.exe file. Sort processes in Task Manager by name and see on whose behalf these services are running. If this is done on behalf of a user account (your account), then this is the “tricks” of the virus. If the “Username” column indicates: Local Service, Network Service or System, such a file is safe.

If you think you have discovered a virus, right-click on the process → Open file location. This way you will determine the location of the malware and check it through the VirusTotal.com portal. But it’s better to immediately scan the system using Dr.Web CureIt or Malwarebytes Anti-Malware. The fact is that deleting one executable file will not help get rid of the virus, since there are probably auxiliary fragments on the computer that will restore it after a reboot or simply prevent it from being deleted.

Since in most cases the user does not change OS settings, Windows is set to automatically download updates by default. This is also the “responsibility” of svchost.exe. To disable downloading updates:

Problematic programs

This reason is typical for those users who install a huge number of programs and applications on their computer and do not monitor them. To identify unnecessary software, install Process Explorer on your PC. It will help you determine which programs are taking up device resources, but you are not using them.

Another advantage of Process Explorer is that it works closely with the file checking service for malware - VirusTotal, so it will help distinguish system services from viruses.

To check a file, select it in the program window → Options → VirusTotal.com → Check VirusTotal.com.

Using µTorrent

Often, the µTorrent program loads computer resources when downloading files. To reduce CPU load:

Troubleshooting

The easiest way to reduce the load on the main components of your computer is to restart it. But this approach does not always help. The drastic measure is to “kill” the svchost.exe process in the Task Manager. How to do this for Windows 10.

How to recognize a virus?

It is easy to recognize a virus that disguises itself as the svchost.exe file. It runs under the user account or any other processes except Local Service, Network Service or System.

Another characteristic feature is “mistakes” in the name. Processes called svhost, svchosts or others are malware that need to be removed.

"Cleaning" the system

If you find a virus on your computer masquerading as the svchost.exe file, run an in-depth system scan with installed antivirus software.

Important! Surely scanning with installed software will not bring results.

But it’s better to use special utilities from well-known companies: Dr.Web CureIt, Malwarebytes Anti-Malware or Kaspersky Rescue Disc. They will identify and neutralize malware.

Video

You will learn more about the svchost.exe process in the video.