RIVET
Home / Process library / svchost.exe
What is svchost.exe?
svchost.exe is Service Host. A shell process that runs Windows services from DLLs. You normally see dozens of them, one per service or group.
| Name | svchost.exe |
|---|---|
| Full name | Service Host |
| Publisher | Microsoft Windows |
| Normal location | C:\Windows\System32 or C:\Windows\SysWOW64 |
| Safe to end? | Keep No. svchost.exe is part of Windows and should keep running. |
| If you end it | Whatever service it hosts stops, which can take networking, audio or sign-in with it. |
How to check it's the real svchost.exe
- Open Task Manager (Ctrl+Shift+Esc) and go to Details.
- Right-click svchost.exe and choose Open file location. It should open
C:\Windows\System32orC:\Windows\SysWOW64. - Right-click the file, choose Properties, then Digital Signatures. The signer should be Microsoft Windows.
A file called svchost.exe somewhere else, or without that signature, is worth scanning with Microsoft Defender.
What RIVET shows
RIVET's process list shows svchost.exe with this explanation, the verdict above, and a signature check, so you can see at a glance whether it is the genuine Windows file. Ending a process can't be undone, and RIVET warns you before it ends anything Windows needs.
Questions
Is svchost.exe a virus?
The genuine svchost.exe is part of Windows, signed by Microsoft Windows, and runs from C:\Windows\System32, C:\Windows\SysWOW64. Malware sometimes copies the name, so check the location and signature as shown above.
Can I end svchost.exe?
No. svchost.exe is part of Windows and should keep running. Whatever service it hosts stops, which can take networking, audio or sign-in with it.