Member Avatar for Wallace Tait

Need help here to understand why svchost .exe is running twice in the windows task manager.
Here's a run down;

svchost.exe is running in LOCAL SERVICE and has a mem usage of 4,492k

svchost.exe is running in NETWORK SERVICE and has a mem usage of 1,936k

I would appreciate your help in understanding these processes and why they have to run double.
Wallace Tait.

  • 4 Contributors
  • 4 Replies
  • 208 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by oalee

Dani AI

Generated

Brief expert note for : multiple svchost.exe entries are expected. svchost is the "Service Host" process that loads many Windows services (DLL-based services) into separate host groups so services can run with different accounts and privileges (LocalService, NetworkService, LocalSystem, etc.). On recent Windows builds Microsoft even splits many services into their own host process to improve isolation. Service host grouping in Windows 10. (learn.microsoft.com)

How to tell what a particular svchost is doing: modern Task Manager can expand a "Service Host" entry or let you right-click → "Go to service(s)". From the command line the canonical tool is:

tasklist /svc
tasklist /svc /fi "imagename eq svchost.exe"

For deeper detail (DLL names, command line, which threads are busy) use Sysinternals Process Explorer. tasklist documentation · Process Explorer (Sysinternals). (learn.microsoft.com)

Malware can mimic svchost names or live in the wrong folder, as others warned (, ). Confirm legitimacy by opening the process' file location (should be C:\Windows\System32 or SysWOW64) and checking the digital signature. A quick PowerShell check is:

Get-AuthenticodeSignature 'C:\Windows\System32\svchost.exe'

If unsigned or located in AppData/Temp, treat it as suspicious and scan with up-to-date antimalware tools. Get-AuthenticodeSignature (PowerShell). (learn.microsoft.com)

If one svchost is chewing CPU or memory, identify the specific hosted service first (tasklist/Task Manager/Process Explorer), restart that service or the machine, check Windows Update (many svchost spikes relate to update activity) and run full malware scans before disabling services. Randomly killing svchost processes risks breaking networking, audio, printing, updates, etc. For Windows Update and svchost-specific guidance see the Microsoft support/answers threads on troubleshooting update-related svchost issues. (learn.microsoft.com)

Recommended Answers

All 4 Replies

Member Avatar for caperjack

svchost ,is a generic process name use by different programs ,I have 4 or 5 in mine .


and here is more info .
http://support.microsoft.com/?kbid=314056

Member Avatar for Puckdropper

It's normal.

There is a virus that executes as svchost.exe, but it likes to use 100% of the CPU when it can. I came across that when I forgot to put up the firewall. (Format and reinstall, then I want to make sure the internet's working, so I plug in the network cable...don't think of the firewall...oops.)

Member Avatar for caperjack

The virus is usuall disguised as ,but usually spelt different like SVXCHOST.EXE ,SXOCHOST.EXE or the like

Member Avatar for oalee

I once saw a virus that spells scvhost.exe, I almost didn't notice it except that the anti-virus im running alerted me about it.

multiple instances of svchost.exe running at the same time is perfectly normal, except if you are infected with the blaster worm that executes it and takes up 100% of your cpu. What you need to do is keep your windows up to date with all the fixes and patches.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.