Have you seen that the svchost.exe program operated in the background on your PC, in multiple copies and consuming a lot of memory? Don’t panic! This is an essential Windows system process
If you sometimes take a look at the Windows task manager to monitor the operation of Windows, you have certainly already noticed the presence of a program called Svchost.exe. And you have surely noted that this mysterious element was spinning in multiple copies – we are talking more exactly about instances – sometimes consuming a lot of processor resources (CPU) and RAM (RAM). And you obviously asked yourself about the nature and the role of curious program.
In fact, Svchost.exe is one of the essential components of Windows. This is not an application itself, but a process, that is to say a program without an interface turning in the background. Its main role is to charge libraries of dynamic links – the famous DLLs – to provide functions to applications when it needs it – on demand, therefore, hence the dynamic appellation. To simplify, it is a software component at the service of other applications, as indicated by its full name, Host service – “Service host” in French – sometimes contracted Svchost.
In essence, it is at the service of other programs, some of which are very important such as the Windows or Windows Update firewall, and can start as many times as necessary. On Windows 10, since the Creators Update update, we can sometimes count up to around fifty instances Svchost.exe active at the same time. In addition, as it works in the background, it is naturally invisible: it is only seen by displaying the list of processes and active services. But all of this is perfectly normal.
The svchost.exe file is normally located in the System32 folder, itself located in the Windows folder of your PC system disk-the one on which Windows is generally installed the disk (C :)-, which also contains most DLLs. The full path to find it is therefore often C: Windows System32. The executable file in itself only weighs a few kilo-oceets.
But seeing the svchost.exe file is not very interest. It is more useful to visualize the Svchost.exe processes in use. For this, you have to go through the task manager. You have the choice between three methods to open it.
- Type the keyboard shortcut CTRL + ALT + EXCHAP To directly display the task manager.
- Right click on the taskbar and select Task manager In the context menu.
- Or open the Start menuscroll the list of installed applications, unroll the section Windows Systemthen click on Task manager.
Note that, under Windows 7, the svchost.exe processes are not visible by default in the task manager. To do this, you must be connected with an administrator account.
How to control the active svchost.exe processes?
Whatever the method used, the task manager window is displayed.
- Click on the tab Processand scroll through the section Windows process. Active svchost.exe instances are displayed under the name Service host With an indication of the function of the process, such as IP assistance, Windows event journal, etc.
- By clicking on the left arrow From the name, you can check if a process brings together several sub-services, as in the example below.
- Then click on the tab Details. By browsing it, you can see many svchost.exe lines which are just as many active services.
- To find out what an svchost.exe line corresponds to, right click on it, then click on Service In the context menu.
- You are then redirected to the tab Servicesand the service linked to the active body appears highlighted.
SVCHOST.EXE can cause slowdowns of the PC due to intensive use of memory or processor. In this case, it is possible to force the service concerned after having identified it, to relieve the computer. Please note, this closure can cause malfunctions, in particular by stopping the application concerned. But it is not systematic and it is sometimes the only way to regain control of a clogged PC.
- Open the task manager as seen previously.
- In the tab Processbrowse the list of service hosts in the game Windows process To identify that with an abnormally high processor, memory or disk activity. To help you, you can click on the percentage of each element To classify consumption in order of magnitude.
- Click on the arrow to the right of the service host name to see the services it contains and identify the problem.
- Right click on the service, then click on Stop In the context menu.
It happens that malware uses svchost.exe to infect a PC. Some camouflage themselves in a service or group of services in order to be launched when Windows started. Others infiltrate the svchost.exe process to take control of it and carry out various actions, in particular by establishing connections with the outside via the Internet or Network.
If you notice an abnormal activity in the task manager, such as systematic overconsumption of memory or a body referring to a repertoire other than C: Windows System32it can be malware. In this case, never delete the svchost.exe file or a DLL possibly linked. Close the service as described above, then launch an analysis with your anti-virus to get rid of malware.