Process Information

Process File: svchost.exe
Process Name: Microsoft Service Host Process

Author: Microsoft Corp.
Part Of: Microsoft Windows Operating System

Description:
svchost.exe (Generic Host Process for Win32 Services) is an integral part of Windows OS. It cannot be stopped or restarted manually. It manages 32-bit DLLs and other services. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. In normal conditions multiple instances of Svchost.exe run at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.

svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. This program is important for the stable and secure running of your computer and should not be terminated.

Note: svchost.exe could also be a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. It could also be a registered security risk and should be removed immediately.

Note: svchost.exe could also be a process registered as a backdoor vulnerability which maybe installed for malicious purposes by an attacker allowing access to your computer from remote locations, stealing passwords, Internet banking and personal data. If unaccounted for, this process should be removed immediately.

Note: svchost.exe could also be a process which belongs to the 007 Spy Software. This program is non-essential process to the running of the program, but should not be terminated unless suspected to be causing problems.

Note: svchost.exe could also be a process which is registered as a trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. It could also be a registered security risk and should be removed immediately.

Determining whether this process is a virus or a legitimate Windows process depends on the directory location it executes or runs from in WinTasks.

The svchost.exe file is located in the C:\Windows\System32 folder or in the C:\WinNT\System32 folder. In other cases, svchost.exe is a virus, spyware, trojan or worm!


Note: Many viruses masquerade themselves as SVCHOST to escape detection. Some have names that are similar, such as SCCHOST, others actually drop a program file called SVCHOST in the Windows folder or a Windows sub-folder.
Then, if in your computer you found a file called:
Svch0st.exe, (where the letter between the h and the s in the name of the file is a ZERO, not the letter o) you have one of the Backdoor.Graybird viruses, or the W32.Mydoom.Bi@mm virus, or one of the many other viruses which run as this filename.
Svchos1.exe, you have the W32.HLLW.Gaobot.DK virus.
Svchost32.exe, you have a virus. It may be one of the following viruses: Backdoor.IRC.Zcrew, W32.HLLW.Deborms.C, W32.Mimail.J@mm, or the W32.Paylap.@mm virus which mimics a PayPal account renewal screen. Note that there are other lesser known, or newer (!!) viruses which also show as a program called SVCHOST32.EXE.
Svhost.exe, you have a virus which could be any of a number of them, such as: Backdoor.Socksbot, Bat.Boohoo.Worm, W32.Bolgi.Worm, and a few more.

Recommendation for svchost.exe:
Should not be disabled, required for essential applications to work properly.

Summary account

System Process: Yes
Application: No
Background Process: Yes
Uses Network: Yes
Uses Internet: Yes