What is svchost.exe?

This article interests you because you have been wondering why on earth there are so many processes running with the weird name svchost.exe. Nope, you can’t stop them or your system may crash faster than you know it. What is svchost.exe? Is it a virus or trojan?!

Fear not. Svchost.exe is actually a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files for the sake of better re-usability. However, this created a little problem as a .dll file cannot be executed directly. Thus, the svchost.exe process was born to facilitate running those .dll files.

Exert from Microsoft knowledgebase, a description of Svchost.exe in Windows XP Professional Edition.

The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.

So, svchost.exe is not a virus nor a trojan. You may then ask why there are so many instances of them? Let’s take a look in my Windows XP system.


Right click on an empty area on the task bar and select “Task Manager”. Select the Processes tab. Click on the Image Name header to sort it in either ascending or descending order. Now, you should be able to see a list of svchost.exe running.

If you are checking this on a Windows Vista machine, you may not see svchost.exe by default. You need to click on the option “Show processes from all users” located at the bottom of the Processes screen. Enable this option.


You can right click on one of the processes and select “Go to Service(s)”. This will switch over to the Services tab, where the relevant services running under that particular instance of svchost.exe process will be highlighted. See a screen shot below.

Windows Task Manager

Great. Now we can see a slightly more meaning full name of the service it’s running and then you can decide whether it’s safe for you to disable or kill the process.

Of course it’s always good to play safe. If your computer behaves normally, you don’t hand itchy and kill those processes. 🙂