Svchost exe location. The svchost process and how to distinguish it from the virus masquerading as it. Latest tips from the Computers & Internet section

The operation of the Windows operating system is a complex process that is only possible with the proper functioning of all software components. MacOS is no less complex, but in it users do not have the ability to monitor system processes. In Windows, you can view all executable files in the Task Manager, and some of them may scare inexperienced users. A prime example of a file that is causing concern is svchost.exe. Quite often in Windows, svchost.exe loads memory or CPU, and there is a feeling that it is a virus. Is this really true? Let's figure it out.

Svchost.exe: what is this process, what functions does it have and why is it needed?

There is a basis for the widespread belief that svchost.exe is a virus, but in reality, most often, this process does not pose any threat. If you understand the functional responsibilities assigned to this file, it is necessary to connect dynamic DLLs for programs and services that cannot work without them. Each program uses its own svchost file, which can be located in different folders of the Windows operating system.

Most often, the svchost.exe file can be found at the following addresses:

• C:\WINDOWS\system32
• C:\WINDOWS\Prefetch
• C:\WINDOWS\winsxs\ amd64_microsoft-window
• C:\WINDOWS\ServicePackFiles\i386

If the svchost.exe file is located in other folders, this is a reason to sound the alarm, but it is far from an indication that it is a virus. This rule also applies in the opposite direction; if svchost.exe is even located in one of the above folders, it may well turn out to be virus software.

It is very easy to determine in which folder the currently active svchost.exe processes are located. To do this, follow these steps:

In the Windows 8 and Windows 10 operating systems, you can view the list of services that use the svchost.exe process through the Task Manager. This is easy to do - you need to right-click on the suspicious process and select “Go to services”. It is worth noting that the names of many services are unlikely to tell the average computer user anything.

The svchost.exe process may not be a virus, and if it loads the system, then 2 scenarios should be considered here:

• The computer is infected with a virus that sends spam, mines cryptocurrency for its creators, or transfers other data to attackers;
• Due to inattention, the user does not notice that the malicious process is only hiding under the guise of the svchost.exe system library, but in fact it is not one.

If your computer is infected with a virus, and because of this the svchost.exe process loads Windows 10 or an earlier version of the operating system, then you should scan your computer with popular antiviruses. Be sure to install a Firewall, which will ensure your computer's network security.

In the second case, you should recognize the malicious file svchost.exe, which is not such, and then delete it.

How to distinguish svchost.exe virus from a system file

If the svchost.exe process is using up memory or the CPU, you should make sure that the file it references is valid. To do this, carefully check the name of the executing process. Below we will present several tricks of attackers who replace the svchost.exe process with another one, but similar in name. The following schemes are most often used to disguise the virus:

Listed above are only the most common options for masking the virus, but there may be others. Make sure that the process is called svchost.exe and that all letters are written in Latin characters.

If you find a process that masquerades as svchost.exe, but is not one, you should delete it. This is quite easy to do if you use the AVZ program.

How to remove svchost.exe using AVZ program

The well-known anti-virus utility AVZ is capable of detecting and removing unwanted programs, including viruses. It is free and has many useful features. The advantage of the AVZ program is that it does not need to be installed on the system drive. AVZ can be launched from a flash drive, external hard drive, or directly from a downloaded archive.

To remove the svchost.exe file using the AVZ utility, you must perform the following steps:

Instead of the words “Path to the virus” highlighted in red, you must specify the location of the svchost virus process. We have already described above how to determine where the virus file is located that is masquerading as svchost.exe. Copy the path to it (or write it manually) and paste it instead of the words highlighted in red. Attention: Quotes cannot be removed from the script - only letters highlighted in red.

After successfully removing the file that pretended to be svchost.exe, we strongly recommend that you scan your computer for viruses. There is a high probability that one of the programs generates new files that automatically run in processes and pretend to be svchost.exe.

Below is a list of the most common reasons why svchost.exe creates CPU load. First, we will look at what the general meaning of this process is, and then we will look at methods for solving the problem in specific cases.

What is svchost and can it be removed?

If there are many programs, then the number of running processes with this name can be increased to the required number. Therefore, if there are several svchost.exe in the Task Manager, this is normal and not yet a reason to worry.

Possible causes of CPU load

Viruses

A clear sign of such a threat:

Open Task Manager and check under whose name all svchost.exe are running (to make it easier to see, sort the display of processes by name).

• System
• Local Service
• Network Service

This way you will know where it is. Now this file can be sent for scanning through virustotal.com to obtain detailed information about the type of threat.

But the easiest way is to immediately use two programs to clean the system:

• Dr.Web Cure IT (on the page, first click “Next”, and then “Download with the function of sending statistics”)

The scanning speed depends on the size of the hard drive. But in the case of CureIT, it is quite possible to specify for scanning only the system partition on which Windows is installed, because almost always all pests try to “register” there. This will be enough.

In MBAM, you can simply click on “Start verification”, because... Scanning the entire system takes 15-20 minutes on average.

Based on the results of the scan, a report will be issued with a list of files that the program considers dangerous. MBAM will delete some elements (registry entries) immediately, but for others it may ask you to reboot the system.

CureIT digs deeper, but sometimes misses points that MBAM cleans up.

After downloading and installing the utility from Dr.Web, you can let it scan anything you want by simply clicking on “Start scanning”.

To be more confident that nothing will escape, you can specify, in addition to the main places to check, the entire disk on which Windows is located.

Automatic updates

Press the Win+R key combination and enter “services.msc” in the window that opens.

In the list of services, find Windows Update, double-click with the left mouse button and set the parameters as in the screenshot below.

Conclusions

In this article, I will tell you in detail what kind of Svchost.exe process this is, why svchost.exe loads Windows 7 memory, and also describe ways to solve the problem with this process.

It happens that while working at the computer it starts to slow down a lot. Trying to understand the cause of the dysfunction, you go to the “Task Manager” and see that the culprit of the problem is the Svchost.exe process, which is heavily loading the central processor or memory of your PC.

I found out that Svchost. exe is a system process in Windows that runs other system services. The use of this process dates back to Windows 2000, but now it is an integral part of the Windows 7 and 10 family of operating systems. To reduce overall processor costs, the developers decided to use one process to run various services, giving the process some versatility. Nowadays, four or more Svchost processes can be observed in the task manager, and each of them is responsible for the operation of a separate service. Therefore, Svchost loads the computer’s processor and memory, more on that later.

When viewing these processes in your task manager, you must remember that the user of the Svchost.exe process must always be either system, local service or network service. If this process is launched on behalf of you, the administrator, or someone else, then you are probably dealing with a virus.

Why Svchost.exe uses memory and CPU in Windows 7

There are several reasons for CPU and memory overload due to svchost.exe, and I will list each of them below.

• Random system crash. This sometimes happens in Windows 7
• Virus branded svchost.exe. A common problem. The creators of virus programs like to use the name of this process for their malicious applications, so a virus under the name svchost.exe is difficult to identify as a malignant program, even when svchost.exe significantly loads the processor or memory.
• Errors in the operation of the Windows automatic update module. If you have automatic Windows 7 updates enabled, failures to download them may cause problems with svchost.exe. There are also cases that the updates themselves contain various errors and bugs, and such an update can cause problems in the operation of the operating system, and svchost.exe in particular.
• Large event log file in the Windows 7 log. In some cases, high CPU and memory load from svchost.exe is associated with a very bloated log file in the system event log.
• Physical damage to memory chips, overheating of the system unit, etc. This happens rarely, but should not be ruled out.

Svchost.exe loads the processor in Windows - what to do

Let's take a closer look at the tools for fixing existing errors if Svchost exe loads Windows 7 memory.

• Just try to wait a while. Perhaps the operating system is simply being updated, and its normal operation will soon be restored.
• Restart your computer. This helps solve the problem with process loading not as rare as you might think.
• Try closing the most resource-intensive svchost.exe, if there are several of them. To do this, go to the Task Manager (by simultaneously pressing Ctrl+Alt+Del and selecting “Task Manager”), click on the “Processes” tab, select “Display processes of all users” at the bottom and see which svchost.exe loads the system the most. Try closing it by right-clicking on it and clicking “End process tree” in the menu that appears.

  

• Check the health of your memory using special programs, ask yourself how long ago you cleaned your PC from dust, whether the cooler inside your computer is making a loud noise (this may indicate that the PC cooling system is full of dust), how long ago you changed the thermal paste on the central processor. This hardware issue could be directly to blame for slowing down your PC speed and the svchost.exe load in particular.
• In many cases, the problem when svchost.exe loads memory is caused by failures in the Windows Update automatic update service. Therefore, either install all available updates, or completely disable the automatic update service through “Start” - “Control Panel” - “System and Security” — “Windows 7 Update.” On the left side of the screen, select “Customize settings”, and in the “Important announcements” menu that appears, select “Don’t check for updates” and confirm by clicking “Ok”.

  

  

• You can try rolling back the system to a date when there were no problems with svchost.exe and you did not pay attention to processor load.
• Check your system for viruses. First, go to the Task Manager (by simultaneously pressing Ctrl+Alt+Del and selecting “Task Manager”), go to the “Processes” tab, select “Display processes of all users” at the bottom and see which user is opposite each svchost.exe process. System, local service or network service are acceptable, all others are viruses or other malware. They need to be completed by clicking on this process, right-clicking and selecting “End process tree”. Use a good antivirus program (try Dr.Web CureIt!, Trojan Remover, etc.), your system may be infected with malware.
• We delete the Prefetch folder, used by the system to speed up the operation of services. We go to the general directory of the Windows OS, find the Prefetch folder there (usually located at C:\WINDOWS\Prefetch) and delete this folder, then reboot the computer;
• If the wuauclt.exe process is running in the manager, then in the Software Distribution folder located in the general Windows directory, delete all existing directories.
• Clearing the event log file in the Windows log To do this, press the Win+R key combination at the same time, type eventvwr in the menu that appears and confirm by clicking “Ok”. In the window that appears, double-click on “Windows Logs” (top left), and in the list below, right-click on “Applications” and select “Clear Log”. We will do the same with the items “Security”, “Installation”, “System”. Reboot the computer.

A visual demonstration of some methods of action when svchost.exe loads memory in Windows 7 can be seen in the video:

Conclusion

The main problems associated with the svchost.exe file overloading the processor are errors in the automatic updating of Windows 7 or 10, as well as virus programs hiding under an identical name or using svchost.exe for their own purposes. To combat them, it is recommended to check your computer with the most powerful antiviruses (for example: Dr. Web CureIt), disable automatic system updates, and also force close the most resource-intensive svchost.exe. It is the one that loads the processor, which means svchost.exe loads memory. If none of the above has helped you, then seek advice in the comments below.

Dear friends, readers, visitors and other personalities. Today we’ll talk about such a thing as svchost.

Often, users, seeing a lot of svchost.exe in the list of processes (and there are almost a dozen or more of them), begin to panic greatly and urgently write letters about the one that has filled their system and is literally bursting out of the case, in advance (apparently for intimidation) , :)

Today I want to once and for all close the question of what this most evil virus svchost is, how to fight it and whether it should be done at all (and is it a virus at all :)).

What is this SVCHOST process and is it a virus or not?

Let's start with the fact that Generic Host Process for Win32 Services(namely, that same svchost) is a system process that is universally important in the existence of those services, programs and system services that use so-called DLL libraries.

There really can be a lot of these svchost.exe in the system, because it is quite difficult for services and programs to use and mess with one (there are a lot of services, but the poor defenseless svchost is all alone), and therefore the system usually launches several copies of this happiness, but with different numbers (process IDs, to be precise).

Accordingly, each svchost.exe serves its own set of services and programs, and therefore, depending on the number of them in Windows, the number of these same svchost processes can vary from one to several dozen. Once again for those who do not understand: these are system processes and do not need to be touched.

But indeed, there are situations when viruses are disguised as this process (once again I want to emphasize: it is the viruses that are disguised, and not the process itself that is harmful). Let's figure out how to calculate them and what to do with them.

How to recognize the svchost virus and the file itself

Let's start with the fact that the system svchost.exe lives exclusively in the folder:

• C:\WINDOWS\system32
• C:\WINDOWS\ServicePackFiles\i386
• C:\WINDOWS\Prefetch
• C:\WINDOWS\winsxs\*

Where C:\ is the drive where the system is installed, and * is the long name of the folder like amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_f65efa35122fa5be

If it is located in any other place, and especially by some miracle settled in the WINDOWS folder itself, then it is most likely (almost 95.5%) that it is a virus (with rare exceptions).

Here are some of the ways viruses can disguise themselves as this process:

• C:\WINDOWS\svchost.exe
• C:\WINDOWS\system\svchost.exe
• C:\WINDOWS\config\svchost.exe
• C:\WINDOWS\inet20000\svchost.exe
• C:\WINDOWS\inetsponsor\svchost.exe
• C:\WINDOWS\sistem\svchost.exe
• C:\WINDOWS\windows\svchost.exe
• C:\WINDOWS\drivers\svchost.exe

And some of the most frequently used file names by viruses masquerading as:

• svс host.exe (instead of the English "c" the Russian "с" is used)
• svch0 st.exe (zero is used instead of "o")
• svchos1 .exe (one is used instead of "t")
• svcc host.exe (2 "c")
• svhost.exe (missing "c")
• svchosl .exe (use "l" instead of "t")
• svchost32 .exe ("32" added to the end)
• svchosts32 .exe ("s32" added to the end)
• svchosts.exe (added "s" to the end)
• svchoste .exe ("e" added to the end)
• svchostt.exe (2 "t" at the end)
• svchosthlp .exe ("hlp" added to the end)
• sve host.exe (use "e" instead of "c")
• svr host.exe (use "r" instead of "c")
• svd host32 .exe (instead of “c”, “d” is used + “32” is added to the end)
• svs host.exe (use "s" instead of "c")
• svhostes .exe (missing "c" + adding "es" to the end)
• svs chost.exe (extra "s" added after "v")
• svcs host.exe (extra "s" added after "c")
• svx host.exe (use "x" instead of "c")
• sys host.exe (use "ys" instead of "vc")
• svche st.exe (use "e" instead of "o")
• svchoes.exe (use "es" instead of "st")
• svho0 st98.exe
• ssvvcchhoosst.exe

There are others, in general, too, but these are some of the most popular, so keep that in mind and be vigilant.

You can see the name of the file in the task manager, although I recommend using it right away, fortunately, using it, you can immediately see the paths and other information simply by double-clicking on the process in the list.

How to remove and solve the problem with SVCHOST or virus

The good old one will help us in removing this muck (if it is what it is).
What we do:

Well.. We smile and wave.. In the sense of enjoying life and a cleaned computer.

However, if this does not help, then there is still a small way (taking into account, of course, that you have done everything written above) that can help.

Checking damaged system files for treatment purposes

In rare (very) cases, the option to check system files, which is available in the system itself, can help. Go to the path "C:\ -> Windows -> System32" (where the C:\ drive is where the system is installed).

There, find cmd.exe, right-click on it and select " Run as administrator".

At the command line itself, enter the line:

And wait for the process to complete. The system will scan all protected system files and replace any damaged files. This may not cure svchost itself, but it may fix accompanying files that lead to loads and other problems.

Afterword

As always, if you have any questions, additions or other differences, write in the comments.

• PS: Many people are faced with the fact that svchost loads the processor and the system in general. This is often due to the fact that the system contains a virus that sends spam or creates other harmful traffic, which is why the process is actively used by it. As a rule, this is treated by scanning for viruses, spyware and installing a firewall.
• PS2: The problem may be related to Windows update running in the background. It may make sense to disable it or even completely optimize the system (especially for the 10th version of the system)
• PS3: If all else fails, then try going through the Kaspersky Virus Remove Tool from to clean up possible svchost-varieties of the virus

Svсhost is a system process in the Windows 2000, Windows XP, Windows Vista, Windows 8, Windows 10 operating system families. Svсhost is important for shared service processes, where multiple services can share a single process to reduce system resource consumption . Grouping services into a single process saves resources, a consideration that worries NT developers as creating processes in Windows takes increasingly longer and consumes more RAM.

If one of the services throws an unhandled exception, the entire process may fail. Additionally, it may be more difficult for end users to identify component services. Issues with various hosted services, especially Windows Update, have been reported by users and are related to Svchost.

The Svchost process was introduced in Windows 2000, although basic support for service processes has existed since Windows NT 3.1.

Its executable image "%SystemRoot%"/"System32"/"Svchost.exe" or "%SystemRoot%"/"SysWOW64"/"Svchost.exe" (for 32-bit services running on 64-bit systems) runs in multiple instances, each hosting one or more services.

Services running in Svchost are implemented as dynamically linked libraries (DLLs). The registry key for such a service should have a value named ServiceDll in the Settings section, pointing to the DLL file of the corresponding service. Their ImagePath definition looks like “%SystemRoot%”/”System32″/”Svchost.exe -k”. Services sharing the same Svchost process specify the same parameter, which has the same entry in the SCM database.

The first time the Svchost process starts with a particular parameter, it looks for a value with the same name in the key "HKLM" - "SOFTWARE" - "Microsoft" - "Windows NT" - "CurrentVersion" - "Svchost", which it interprets as list of service names. It then notifies the SCM of all the services it hosts. SCM does not start a second Svchost process for any of the received services: instead, it simply sends a "start" command to the appropriate Svchost process containing the name of the service to be started in its context.

According to the MS 2003 presentation, the minimum working set of a shared service is approximately 150 KB versus 800 KB for a standalone process.

Service tags

Since Windows Vista, internal identification of services within shared processes (including svchost) is achieved using so-called Service tags. The service tags for each thread are stored in the SubProcessTag of its thread environment block (TEB). The service tag is propagated to all threads that then run the main service thread, except for threads created indirectly by the Windows thread APIs. The Service tags management set of routines is currently an undocumented API, although it is used by some Windows utilities, such as netstat, to display the TCP connections associated with each service. Some third party tools such as ScTagQuery also use this API.

Svchost.exe (netsvcs)

Netsvcs is a subprocess used by svchost.exe

Netsvcs is a subprocess used by svchost.exe (netsvcs). If and when a memory leak occurs, svchost.exe starts to put a lot of CPU load on it. This issue occurs because of a handle leak in the Winmgmt service after you install Windows Management Framework 3.0 on the computer. The Winmgmt service is a Windows Management Instrumentation (WMI) service in the svchost.exe process that runs under the LocalSystem account.

Identify and manage hosted services

Microsoft Sysinternals Process Explorer also provides information about the services running in svchost.exe processes when the user hovers over svchost.

None of the above methods allows the user to determine which of the many services running inside svchost is a specific resource, such as CPU, disk, network, or memory. Windows Resource Monitor takes into account most of these resources when the process is drilled down. However, it does take CPU usage into account when drilling down into services by going to the CPU tab. A list of open TCP connections and open UDP ports can be obtained using "netstat -b".

To solve other problems with a service running inside svchost, the service (or services that are supposed to cause the problem) must be (all) reconfigured so that they each run inside their own svchost instance. For example, "sc config foo type=own" will reconfigure the service named "foo" to run its own svchost. Changing the type "back to the general" is done using a similar command. You must restart the service for these configuration changes to take effect. However, this debugging process is not foolproof. In some cases, a heisenbug may occur, causing the problem to go away when the service is running separately.

A more advanced troubleshooting method is to create an isolated maintenance group.

High consumptionCPU and RAM processsvchost.exe

High usage problems with Svchost.exe, in most cases, occur on computers infected with a virus or malware. In other cases, high CPU usage issues or problems with Svchost.exe (netsvcs) may be caused by Windows Update, a full event log file, or other programs and services that run many processes while they are running.

Video - What to do if svchost loads the processor

How to solve Svchost.exe (netsvcs) problem with high memory or CPU consumption

Solution 1: Scan your computer for viruses

Many viruses or malware can cause svchost.exe high CPU and memory usage issues. Therefore, before you continue troubleshooting the svchost.exe loading problem, use different ones to scan and remove malware.

Solution 2: Find and disable the service that is causing the svchost high usage issue

Svchost.exe is a process that is required by several services or programs to run. So, determine which service or program is running in the svchost.exe process and is also consuming your system resources and your system memory, and then proceed to disable or completely remove that program (or service).

Step 1. Press the "Ctrl+Alt+Del" keys simultaneously and then open the "Task Manager".

Step 2. On the Processes tab, select the Show processes from all users checkbox.

Step 3. Right-click on the high-usage svchost.exe process and select Go to Services.

Step 4. In the Services tab, you should see several services highlighted that are running in the svchost.exe process.

Step 5. Now it's time to find out which process is hogging the CPU resources. For this you have two options:

Step 6. Once you've identified the culprit service or program, go to Computer Management (Control Panel/System and Security/Administrative Tools) to disable that service (or uninstall the program completely).

To disable a service on your computer permanently:

Solution 3: Empty Event Viewer Log

In some cases, the problem of using svchost.exe with high CPU usage (or high memory consumption) is due to large log files in Windows Event Viewer. So, another solution is to clear the Event Viewer log.

To do this:

Solution 4: Troubleshooting Windows Updates

On other computers, the high svchost.exe usage issue may occur when Windows is looking for updates (in the background). To resolve high CPU usage issues during Windows Update, follow these steps:

Step 1. Force Windows to recreate the empty Windows Update folder.

The Windows Update folder (commonly called the SoftwareDistribution folder) is where Windows stores downloaded updates. If this folder is damaged, you will face problems during Windows update. So first try to force Windows to re-create a new empty "SoftwareDistribution" folder.

To do this:

1. Press the Windows key + R at the same time to open a command prompt window.
2. In the launch command input field, enter: “services.msc” and press “Enter”.

   

3. Find the Windows Update service, then double-left-click on it and select Stop.

   

   

4. Go to the "C:"/"Windows" folder.

   

5. Delete (or rename) the "SoftwareDistribution.old" folder to the "SoftwareDistribution" folder.

   

   

   Note! When you run it again the next time Windows Update checks for available updates, a new "SoftwareDistribution" folder will be automatically created by Windows to store the updates.

6. Restart your computer and try checking for updates.

If the problem with high usage of "svchost" persists, continue to the next step.

Step 2. Run the Windows Update troubleshooter.

1. Download the Windows Update Microsoft troubleshooter on your computer.

   

2. Run the Windows Update troubleshooter.

   

3. Select "Windows Update" in the first window and click "Next".

   

4. Wait for the problem detection process to complete.

   

5. Click on the “Apply this fixes” link.

   

6. Let the program fix problems with Windows Update and restart your computer.

   

7. Check for updates again and if the svchost.exe high loading issue persists, proceed to the next step.

Step 3. Install the latest Windows Update Agent

Step 4. Install Microsoft Security Bulletin MS13-097.

Step 5. Fix corrupted system files using a system update readiness tool (such as Deployment Image Servicing and Management - DISM tool).

Other solutions that can be applied in different cases in which the problem with high usage of "svchost.exe" occurs when searching for updates.

Case 1. Applies to new installations of Windows 7 SP1.

Case 2. Used on an HP laptop with Windows 7 SP1 Home.

Step 1. Install security update KB2993651 according to your OS version:

• Security update for Windows 7 for x86-based systems (KB2993651);
• security update for Windows 7 for x64 systems (KB2993651);
• Security update for Windows 8.1 for x86-based systems (KB2993651);
• Security update for Windows 8.1 for x64 systems (KB2993651);

Step 2. Reset Windows Update Components. Restart your computer.

Case 3.

Case 4. Applicable to Windows 7 SP1 and Windows Server 2008 R2 SP1.

Download and install Windows Update Rollup 3 (KB3161608) according to your OS version.

Note! If the installation freezes: Restart your computer, stop Windows Update, and then install the update.

If after completing all these tasks you are still experiencing high CPU or memory usage issues, disable Windows Update completely or reinstall Windows on your computer. If you are using Windows 8 or Windows 8.1, you can also update your system. Good luck!

Video – Svchost loads the processor. Solving the problem