Home
Windows
By
Abhishek Silwal
Host Process for Windows Services or svchost.exe is a system process that runs in the background. If you ever see it on the Task Manager or any other apps, you may be curious, especially since the Task Manager shows a lot of this process running at the same time.
You may also be encountering some issues with this process, such as high consumption of internet bandwidth or other system resources. In this article, I’ll go through what exactly this process is while also providing the solution for those problems.
What is Host Process for Windows Services (Svchost.exe)?
Host Process for Windows Services or svchost.exe is, as the name says, the system process that hosts Windows services. In newer Windows systems, you will also find this process as Service Host.
Unlike Programs, services are not independently running processes and are actually parts of some Dynamic Link Library (DLL) files in your system. Each service is associated with different types of Windows processes.
By default, a service only needs to start if your system runs another process (service or program) that requires the service. They also have different Startup types that help control when your system needs to run them.
The Host Process for Windows Services acts as a shell or host process for loading the services whenever necessary depending on their configuration.
Why are There So Many Service Host Processes?
The Windows Services can run under three different user groups—the Local System, Local Service, and Network Service. Also, the services running under Local System and Local Service may or may not require full or restricted network access. So the services can be classified into six individual groups based on this property.
Previously, a single svchost.exe used to be responsible for one category or classification of services for conserving the system’s memory resources. However, the complete svchost.exe along with all of its services can fail if a single service running under this process experiences some issues.
So, after Windows 10 version 1703 and on computers with 3.5 GB+ RAM, each service has started running in its own svhcost.exe processes. This is why you’ll see a lot of this process running on your system.
Is Svchost.exe a Virus?
The legitimate svchost.exe is a system process and not a virus. The current security in Windows systems is also good enough that viruses are unlikely to infect this process.
However, it is possible for malware creators to create viruses with similar names like svchosl.exe or svchosts.exe and infect your system. Or they may create malware with the name svchost.exe that runs from some other location on your system. Similarly, the real svchost.exe processes can only run under specific usernames.
So you can use the following steps to check if the process is legitimate or not.
- On the Task Manager, if you are on the Processes tab, right-click on the Service Host process you wish to check and select Go to details. If you are already in the Details tab, you can proceed to step 2.
- Check the name of the process as well as its User name carefully. It should not run under your user account or anything other than LOCAL SERVICE or NETWORK SERVICE or SYSTEM.
- Right-click on
svchost.exeand select Open file location. It should open toC:\Windows\System32orC:\Windows\SysWOW64and point to thesvchost.exefile.
If any of the checks did not give the required result, the process might be a malware process. In this case, you need to scan your computer with Windows Defender (Virus & threat protection) or another antivirus to secure your system.
Can I Disable or End Service Host?
The Service Host processes are always running the essential services on your system. So the legitimate svchost.exe is not a process that you would ever want to forcefully close. In fact, if you ever try to do so, you will receive a message prompt that says “Ending this process will cause Windows to become unstable or shut down..”
It is possible to check the “Abandon unsaved data and shut down” option and click Shut down to close the process. If you only end the svchost.exe for some less important services, it won’t affect your system much. They may even restart automatically. However, if it is running a critical service, your system will forcefully shut down or run into a Blue Screen of Death (BSOD) error.
So, it’s never recommended to manually disable or end the Service Host or Host Process for Windows Services processes.
Fixing Service Host Using Up Internet Bandwidth or Other Computer Resources
Service Host is only a shell process, so it is actually the service under this process that is using up internet bandwidth or any other type of computer resource. In this case, the only solution is to find out the exact service or the relevant application the service depends on and close them.
Disable Some Services
Usually, this issue occurs when some services that work in the background are using up internet data. For example, your system may be downloading Windows Update files from other computers on the same network or Microsoft’s server itself. In such cases, you can disable some non-critical services that won’t hamper your system from blocking such background activities.
- Open Run by pressing Windows + R.
- Type
services.mscand press Enter to open Windows Services. - Look for the following services:
- Background Intelligent Transfer Service
- Delivery Optimization
- Sysmain
- Double-click on these services to open their Properties.
- Set Startup type to Disabled and select Stop.
- Click Apply and OK.
Note: Keep in mind that Windows Update depends on Background Intelligent Transfer Service. So, if you disable this service the automatic updates won’t work.
You can also use the Task Manager to see which service under Service Host or Host Process for Windows Services is consuming the Internet Bandwidth and then troubleshoot it.
- Press Ctrl + Shift + Esc to open the Task Manager.
- On the Processes tab, scroll down to Windows processes.
- Look for the exact Service Host or
svchost.exeprocess showing the most Network usage. - Check its name or expand it to determine the responsible service.
- Then, you can try disabling it from Windows Services.
If the Startup type of the service is grayed out, it is a critical service, and thus Windows itself does not allow disabling it from this app. While it is still possible to do so using the Registry Editor, you should never do so, as it will harm your system.
If you can disable the service, but it is a service you need (check the service description for more information), you will have to look for specific solutions for the exact service.
Check Process Explorer
If the associated service is an important service that you can’t or don’t want to disable or disabling it does not help, it’s better to run the Process Explorer and see which processes are using the services under the svchost.exe process.
Process Explorer is an additional resource provided by Microsoft as a Sysinternals utility. It is similar to Task Manager but can also show all the related processes, DLLs, and handles for individual programs. Here’s how you can use it in this case:
- First, note down the exact service through Task Manager.
- Download and extract Process Explorer from Microsoft Sysinternals.
- Open the Process Explorer folder and run
procexp.exeorprocexp64.exeas admin. You need to right-click on the executable and select Run as administrator to do so.
- The program should list the processes in a tree structure. If not, click on View > Show Process Tree.
- Hover over each
svchost.exe. It will show the services that the particular instance is running. Search for the instance that is running the service you noticed from the Task Manager.
- Look for all the programs under this
svchost.exe - Right-click on one of the programs and select Suspend to pause the process. Make sure to right-click on the suspended processes again and select Resume after you finish the troubleshooting.
- Check the impact on the network usage in the Task Manager.
- Reiterate this process for all the programs under the particular
svchost.exeprocess inside Process Explorer until you can determine which process is using up the network resources.
After that, disable or uninstall the application to resolve your issue.
Fixing “Host Process for Windows Services Has Stopped Working”
You will get an error with the message “Host Process for Windows Services has stopped working” when one of the various services or programs running under svchost.exe suddenly stops working due to any issues.
In normal scenarios, this error occurs due to temporary reasons, and you won’t be seeing it next time, or a restart is enough to resolve it. However, if the components fail due to severe causes, this error will pop up frequently or on every login.
Check Event Logs
The different programs and services corresponding to the Service Host process can stop working due to different reasons. So you will need to first use the Event Viewer or Reliability Monitor to check the event logs and determine which process has failed. Here, I will be using the Reliability Monitor.
- Open Run.
- Type
perfmon /reland press Enter to open this app. - Click on the day where you encountered this error on the graph.
- Look for the Host process for Windows Services and double-click on it.
- Check the Fault Module Name to determine the system file or component that failed.
- Search for it on the internet to find the relevant app or service.
If it corresponds to a driver, you need to update it. If it is an app, you can reinstall or update the app. For other system files and services, the only option is to try repairing the corrupt files using SFC or DISM.
Update Windows
Some updates can also carry unintentional bugs that cause conflicts with certain services or svchost.exe processes and stop them from working properly. So, it’s best to have your system fully updated to prevent any such issues.
Windows also rolls out updates for device drivers through the Windows Update. So, you definitely need to look for updates if the faulting module was related to a device or driver.
- Press the Windows key + I to open Settings.
- Go to Windows Update or Update & Security > Windows Update.
- Click Check for Updates if the option is available.
- After it lists the available updates, click on Install now.
Run SFC and DISM
Most of the DLL files that the svchost.exe process runs are system files. So if any such components fail, you might be able to fix them using the System File Checker and the Deployment Image Servicing and Management tool.
- Open Run.
- Type
cmdand press Ctrl + Shift + Enter to open the Elevated Command Prompt. - Type the commands below and press Enter after each to execute them.
dism /online /cleanup-image /restorehealthsfc /scannow
Fixing “Host Process for Windows Services Using Microphone”
If you see the Currently in use message under Host Process for Windows Services in the Microphone Privacy setting, it indicates that your system is currently listening to the Microphone. You need to go to the relevant setting and disable it in such cases.
- Open Run.
- Type
mmsys.cpland click OK to open Sound options. - Go to the Recording tab and double-click on the current Microphone device (with tick mark).
- Go to the Listen tab.
- Uncheck Listen to this device.
- Click OK.
From Wikipedia, the free encyclopedia
Svchost.exe (Service Host, or SvcHost) is a system process that can host one or more Windows services in the Windows NT family of operating systems.[1] Svchost is essential in the implementation of shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concern to NT designers because creating Windows processes takes more time and consumes more memory than in other operating systems, e.g. in the Unix family.[2] However, if one of the services causes an unhandled exception, the entire process may crash. In addition, identifying component services can be more difficult for end users. Problems with various hosted services, particularly with Windows Update,[3][4] get reported by users (and headlined by the press) as involving svchost.
The svchost process was introduced in Windows 2000,[5] although the underlying support for shared service processes has existed since Windows NT 3.1.[2]
Its executable image, %SystemRoot%\System32\Svchost.exe or %SystemRoot%\SysWOW64\Svchost.exe (for 32-bit services running on 64-bit systems) runs in multiple instances, each hosting one or more services.
Services running in SvcHost are implemented as dynamically-linked libraries (DLLs). Each service’s registry key must have a value named ServiceDll under the Parameters subkey, pointing to the respective service’s DLL file. Their ImagePath definition is of the form %SystemRoot%\System32\svchost.exe -k %service group%; (i.e. netsvcs). Services sharing the same SvcHost process specify the same parameter, having a single entry in the SCM’s database. The first time that a SvcHost process is launched with a specific parameter, it looks for a value of the same name under the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost key, which it interprets as a list of service names. Then it notifies the SCM of all the services that it hosts. SCM does not launch a second SvcHost process for any of those received services; instead, it simply sends a «start» command to the respective SvcHost process containing the name of the service that should be launched within its context, and whose respective DLL SvcHost loads.
According to a 2003 Microsoft presentation, the minimum working set of a shared service is approximately 150 KB instead of 800 KB for a standalone process.[6]
Changes to Service Host grouping in Windows 10
[edit]
Starting with Windows 10 version 1703, Microsoft changed the way services are grouped into host processes. On client computer systems with more than 3.5 GB of memory, services are no longer grouped into shared host processes. Instead, each service is run in its own process. This results in better isolation of services, making the computer system more resilient to service failures and vulnerabilities and easier to debug. However, it adds some memory overhead. [7]
Starting with Windows Vista, the internal identification of services inside shared processes (svchost included) is achieved by so-called service tags. The service tag for each thread is stored in the SubProcessTag of its thread environment block (TEB). The tag is propagated across all threads that a main service thread subsequently starts, except for threads created indirectly by Windows thread-pool APIs.[8]
The set of service tag management routines is currently an undocumented API, although it is used by some Windows utilities like netstat to display the TCP connections associated with each service. Some third-party tools like ScTagQuery also make use of this API.[8]
Identification and management of hosted services
[edit]
In Windows XP and later editions, the command tasklist /svc shows a list of the services being run by each listed process (i.e. by each running instance of svchost.exe), with each separate instance of the svchost process identified by a unique Process ID number (PID).
In Windows Vista and Windows 7, the «Services» tab in Windows Task Manager includes a list of services, showing their groups and Process IDs (PIDs); right-clicking on an svchost instance in the Task Manager’s «Processes» tab and selecting «Go to Service(s)» switches to that list of services and selects the service running under the corresponding svchost instance.
In Windows 8, the Task Manager interface was streamlined so that each svchost entry can be expanded by a single click to a sub-list of services running inside it.
The Sysinternals Process Explorer (available as a free download from Microsoft) provides additional information about services running under svchost.exe processes, when the user hovers the mouse over an svchost instance in Process Explorer.
None of the above methods allows the user to identify which of the multiple services running inside an svchost instance accesses a particular resource, i.e. processor, disk, network or memory; the Windows Resource Monitor only accounts for (most of) those resources at process level. It does however show processor usage at service level, on the «CPU» tab.[9] A service-aware list of TCP connections and UDP ports opened can be obtained using the command netstat -b.[10]
In order to troubleshoot other kinds of problems with a service running inside an svchost instance, the service(s) suspected to be causing the problem must (all) be reconfigured so that each runs inside its own svchost instance. For example, sc config foo type= own will reconfigure the service named «foo» to run in its own svchost instance. Changing the type back to shared is done by an analogous command. The service must be restarted for such a configuration change to take effect. This debugging process is not foolproof however; in some cases, a heisenbug may occur, which causes the problem to go away when the service is running separately.[11]
A more complex method of troubleshooting is to create an isolated service group.[12]
In Windows 10, starting with release 1703, svchost was redesigned by Microsoft to host only one service per process, depending on available system memory.[13] The default setting causes services to be hosted independently if the system has at least 3.5 GB of RAM.
- inetd
- systemd
- Service Control Manager
- List of Microsoft Windows components
- Windows NT startup process
- ^ Russinovich, Solomon & Ionescu (2009:302)
- ^ a b «Shared Services». Archived from the original on 6 October 2014. Retrieved 1 October 2014.
- ^ Woody Leonhard (16 December 2013). «Microsoft promises to fix Windows XP SVCHOST redlining ‘as soon as possible’«. InfoWorld. Retrieved 1 October 2014.
- ^ «Svchost.exe gets worse before it’s fixed — Series — Windows Secrets». Retrieved 1 October 2014.
- ^ «How to troubleshoot Service Host (svchost.exe) related problems?». Retrieved 1 October 2014.
- ^ David B. Probert, «Windows Service Processes»
- ^ «Changes to Service Host grouping in Windows 10». Microsoft. 2021-08-27. Retrieved 2021-01-10.
- ^ a b Russinovich, Solomon & Ionescu (2012:335)
- ^ «Figuring out why my SVCHOST.EXE is at 100% CPU without complicated tools in Windows 7 — Scott Hanselman». Retrieved 1 October 2014.
- ^ Whether this is useful is doubtful, it typically shows only the name of the service for the running web browser (e.g. it lists various items of information related to the internet connection and ports in use, but logs them all as simply «firefox.exe»)
- ^ «What is svchost.exe, and why do I have so many instances of it?». Retrieved 1 October 2014.
- ^ «Getting Started with SVCHOST.EXE Troubleshooting». Retrieved 1 October 2014.
- ^ «Changes to Service Host grouping in Windows 10». Microsoft. Retrieved 30 April 2018.
- Russinovich, Mark; Solomon, David; Ionescu, Alex (2009), Windows® Internals (5th ed.), Microsoft Press, ISBN 978-0-7356-2530-3
- Russinovich, Mark; Solomon, David; Ionescu, Alex (2012), Windows Internals. Part 1 (6th ed.), Microsoft Press, ISBN 978-0-7356-4873-9
- svchost.exe uitgelegd
- ScTagQuery
В Диспетчере задач есть много различных процессов и загадочных файлов, которые постоянно потребляют какие-то ресурсы компьютера, включаются, отключаются и живут своей активной цифровой жизнью. Среди них пользователи находят и так называемый Хост-процесс для служб Windows, он же svhost.exe. Эта статья расскажет вам, для чего нужен этот процесс.
Что за процесс svchost.exe
Хост-процесс для служб Windows – это системный процесс операционной системы. Сервисы и службы Windows, которые запускаются из исполняемых файлов exe, регистрируются в диспетчере задач как полноценные отдельные процессы с собственными именами и графиками потребления памяти, процессора, диска и сети. Те сервисы, которые загружаются из динамически подключаемых библиотек (также известные как DLL – Dynamic Linked Library), не могу т «прописаться» как полноценный процесс. Вместо этого система регистрирует их в виде процесса, известного как Хост-процесс для служб Windows или svchost.exe. Среди этих сервисов числятся диспетчеры сетевых подключений, служба Plug-and-play, центр обновлений, механизмы защиты и так далее.
Другая его особенность заключается в том, что для каждого сервиса, основанного на динамически подключаемых библиотеках, система создает отдельный хост-процесс. Именно поэтому вы можете увидеть несколько svchost.exe в Диспетчере задач. Чтобы посмотреть, какое количество svhost.exe у вас запущено, откройте Диспетчер задач и перейдите на вкладку Подробности. Зачастую в системе работает несколько десятков хост-процессов для служб Windows. Это норма.
Хост-процессы. Тысячи их.
К сожалению, Диспетчер задач не разрешает посмотреть, сколько именно сервисов или групп связано с каждым хост-процессом. Если вам действительно интересно узнать, какие библиотеки подключены к хост-процессам вашего компьютера, понадобится небольшая утилита Process Explorer, разработанная Microsoft. Она «портативна», поэтому вам не нужна будет установка. Просто скачайте ее и распакуйте в нужную локацию. Запустите файл processxp64, если у вас 64-разрядная версия Windows или processxp, если 32-разрядная. В списке Process найдите svchost.exe – это те самые хост-процессы для служб Windows. Наведение курсора на один из них отображает список служб, связанных с конкретным процессом. К примеру, Диспетчер локальных сеансов, доступ к HID-устройствам, журнал локальных событий, служба профилей пользователей и так далее. Много различных служб, жизненно важных для работы Windows.
svchost.exe грузит процессор
Вы можете заметить, что сразу после включения компьютера все хост-процессы служб Windows сильнее загружают ваш компьютер, особенно процессор. Это тоже норма, так должно быть. Спустя некоторое время (не особо долго) все успокоится, и нагрузка упадет. Почему так происходит? Когда Windows стартует, хост-процесс сканирует все записи сервисов и реестра, а также составляет список DLL-сервисов, необходимых для запуска. Затем происходит загрузка этих сервисов, из-за чего увеличивается потребление ресурсов процессора.
На увеличение нагрузки CPU процессом svchost.exe также влияют также другие факторы. К примру, система проводит индексацию, скачивает обновление или выполняет другую фоновую задачу, которая требуется для обслуживания системы. Разумеется, бывают и внештатные ситуации, когда одна из служб системы работает некорректно, что приводит к нагрузке на процессор и замедлению быстродействия компьютера. Причин этому может быть большое количество. К примеру, поврежденные системные файлы, проблемный драйвер, сбой в работе службы, выход из строя жесткого диска или вредоносное ПО.
Зачастую главной причиной аномальной нагрузки на процессор служит сбой в работе одной или нескольких служб. Диагностировать такой сбой можно в той же утилите Process Explorer. Найдите в ней процесс, потребляющий больше всех ресурсов и наведите курсор мыши. В окне всплывающей подсказки появится список подключенных служб или службы. Попробуйте отключить их и понаблюдать за результатом. Обнаружив проблемное место, действуйте уже соответственно инструкции по решению проблем в работе службы.
Предупреждение: службы системы не стоит слепо отключать. Убедитесь, что вы знаете, что делаете, а также уверены в своих возможностях вернуть все обратно. Слепые манипуляции с системой могут привести к повреждению ее работы.
svchost.exe — вирус или нет
Мы уже уяснили, что процесс svchost.exe или Хост-процесс для служб Windows – это стандартный механизм системы, который в принципе не может быть вирусом на нормально работающем компьютере. Тем не менее, бывают случаи, когда вредоносное ПО или вирус выдает себя за svchost.exe.
Обратите внимание на расположение файла. В диспетчере задач на вкладке Подробнее нажмите правой кнопкой мыши на один из svchost.exe и выберите Расположение файла. Его основное местоположение – папка C:\Windows\System32 или SysWOW64. Файл с аналогичным именем встречается также в директориях Prefetch, WinSxS и ServicePackFiles, вы никогда не попадете из Диспетчера задач в эти папки, если svchost.exe работает в штатном режиме.
При подозрении наличия вредоносного ПО и обнаружении аномалий в расположении svchost.exe вам надо будет обратиться к услугам своего антивируса, что вполне очевидно. Это руководство лишь поможет вам понять, в чем причина увеличения нагрузки на компьютер процессом svchost.exe.
Quick Links
-
What Is the Service Host Process?
-
Why Are There So Many Service Host Processes Running?
-
Is There Anything For Me To Do With All This Information?
-
Is Service Host Process a Virus?
Summary
The Service Host process (svchost.exe) is a shell for loading services from DLL files. Services are organized into groups, and each group is run inside a different instance of the Service Host Process. There are usually many instances of svchost.exe running because Windows requires numerous services to operate correctly.
If you’ve ever browsed through Task Manager, you may have wondered why there are so many Service Host processes running. You can’t kill them, and you sure didn’t start them. So, what are they?
What Is the Service Host Process?
Here’s the answer, according to Microsoft:
Svchost.exe is a generic host process name for services that run from dynamic-link libraries.
But that doesn’t really help us much. Some time ago, Microsoft started changing much of the Windows functionality from relying on internal Windows services (which ran from EXE files) to using DLL files instead. From a programming perspective, this makes code more reusable and arguably easier to keep up to date. The problem is that you can’t launch a DLL file directly from Windows the same way you can an executable file. Instead, a shell that is loaded from a executable file is used to host these DLL services. And so the Service Host process (svchost.exe) was born.
Why Are There So Many Service Host Processes Running?
If you’ve ever taken a look at the Services section in Control Panel, you’ve probably noticed that Windows requires a lot of services. If every single service ran under a one Service Host process, a failure in one service could potentially bring down all of Windows. Instead, they are separated out.
Services are organized into logical groups that are all somewhat related, and then a single Service Host instance is created to host each group. For example, one Service Host process runs the three services related to the firewall. Another Service Host process might run all the services related to the user interface, and so on. In the image below, for example, you can see that one Service Host process runs several related network services, while another runs services related to remote procedure calls.
Is There Anything For Me To Do With All This Information?
Honestly, not a lot. In the days of Windows XP (and previous versions), when PCs had much more limited resources and operating systems weren’t quite as fine-tuned, stopping Windows from running unnecessary services was often recommended. These days, we don’t recommend disabling services anymore. Modern PCs tend to be loaded with memory and high-powered processors. Add that to the fact that the way Windows services are handled in modern versions (and what services run) has been streamlined, and eliminating services you think you don’t need really doesn’t have much of an impact any more.
That said, if you notice that a particular instance of Service Host — or a related service — is causing trouble, like continual excessive CPU or RAM usage, you could check into the specific services that are involved. That might at least give you an idea of where to start troubleshooting. There are a few ways to go about seeing exactly what services are being hosted by a particular instance of Service Host. You can check up on things within Task Manager or using a great third-party app named Process Explorer.
If you’re using Windows 10 or Windows 11, processes are shown on the «Processes» tab of Task Manager by their full names. If a process serves as a host for multiple services, you can see those services by simply expanding the process. This makes it very easy to identify which services belong to each instance of the Service Host process.
You can right-click any individual service to stop the service, view it in the «Services» Control Panel app, or even search online for information about the service.
If you’re using Windows 7, things are a bit different. The Windows 7 Task Manager did not group processes the same way, nor did it show regular process names — it only showed all the instances of «svchost.exe» running. You had to explore a bit to determine the services related to any particular instance of «svchost.exe.»
On the «Processes» tab of Task Manager in Windows 7, right-click on a particular «svchost.exe» process, and then choose the «Go to Service» option.
This will flip you over to the «Services» tab, where the services running under that «svchost.exe» process are all selected.
You can then see the full name of each service in the «Description» column, so you can choose to disable the service if you don’t want it running or troubleshoot why it’s giving you problems.
Microsoft also provides an excellent advanced tool for working with processes as part of its Sysinternals lineup. Just download Process Explorer and run it — it’s a portable app, so no need to install it. Process Explorer provides all kinds of advanced features — and we highly recommend reading our guide to understanding Process Explorer to learn more.
For our purposes here, though, Process Explorer groups related services under each instance of «svchost.exe.» They’re listed by their file names, but their full names are also shown in the «Description» column. You can also hover your mouse pointer over any of the «svchost.exe» processes to see a popup with all the services related to that process — even those that aren’t currently running.
Is Service Host Process a Virus?
The process itself is an official Windows component. While it’s possible that a virus has replaced the real Service Host with an executable of its own, it’s very unlikely. If you’d like to be sure, you can check out the underlying file location of the process. In Task Manager, right-click any Service Host process and choose the «Open File Location» option.
If the file is stored in your Windows\System32 folder, then you can be fairly certain you are not dealing with a virus.
That said, if you still want a little more peace of mind, you can always scan for viruses using your preferred virus scanner. Better safe than sorry!
Table of Contents
. What is SvcHost?
. SvcHost and Windows 7
. SvcHost in Windows 10
. Using SysInternals Process Monitor to understand Service Host
. SvcHost parameters and Registry
. Checking Service Host for security threats
. Check if svchost.exe is legit
. Check the parent process of svchost.exe
. What can go wrong with legit Service Host?
Affiliate: Experience limitless no-code automation, streamline your workflows, and effortlessly transfer data between apps with Make.com.
Got an alert from our EDR regarding execution of the “svchost.exe” via Command Line.
What is “svchost”? Basically, this is shared process for hosting Windows Services, hence the name SvcHost (Service Host). There can be one service or a group of services under one instance of “svchost.exe”.
SvcHost and Windows 7
The problem? In Windows 7 in Task Manager under [Processes] tab you would see number of “svchost.exe” instances with description of “Host Process for Windows Services”. No indication of what service or services are running. Off course you can add the Command Line column:
Task Manager => [View] => Select Columns
[V] Command Line
[OK]
And you will see the CMDs of the services. For example:
C:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k WerSvcGroupC:\Windows\system32\svchost.exe -k netsvcIn Task Manager you can
RightClick svchost.exe => Go to Service(s)
You will be redirected to the [Services] tab and the service that is running under this specific svchost will be shown.
Another way is to run a Command line, which will show you all the instances of svchost.exe and what services are running under it:
tasklist /SVC /fi “imagename eq svchost.exe”SvcHost in Windows 10
In Windows 10 after build 1703, there’s only one service per svchost running if you have more than 3.5 GB of memory. In Task Manager under [Processes] tab you will see “Service Host: Background Intelligent Transfer Service”. Which makes it a lot easier to understand.
To know which Command line is responsible for which service, you can goto the services:
[Win] + [R] => services.msc => [OK]
Double Clicking the service will open its window. Let’s say that for example you’ve opened “Windows Time”. In the [General] tab you will see:
Service name: W32Time
Display name: Windows Time
Path to executable:
C:\Windows\system32\svchost.exe -k LocalService
Path to executable is how this service is executed. As you can see it is a Command line that executes “svchost.exe” with “-k” switch and the name of the service or a group of services (in this case “LocalService”, which is a group). In Windows 10 there were more switches added. Example of “WebClient” after execution:
C:\WINDOWS\system32\svchost.exe -k LocalService -p -s WebClient“-s” used for “service name” and “WebClient” as in any service is the actual name of the service as it is written in the properties of the service. You won’t see this in service properties.
Using SysInternals Process Monitor to understand Service Host
Process Monitor from SysInternals Suite can be used (and not only for svchost).
Download it and “Run as Administrator” (in Windows 10 you won’t see any info without it).
After you run it, you will see all the processes in your system. To simplify the view:
[View] => Select Columns…
[V] User Name
[V] Command Line
[OK]
This will add the “User Name” responsible for all the executables and the “Command Line” that ran it. Now you will see the exact command also in Windows 10.
Double Clicking any “svchost.exe” line will show you all the needed information.
[Image] tab will show you the Version of the executable, File location, Command line it was executed with, Parent process that executed this current process that you opened, User that executed this process. If the process is a service, you will see that it has [Services] tab. Inside this tab you will see the name of the services that this process runs or the paths to DLL files that this svchost.exe is running.
SvcHost parameters and Registry
What happens when the svchost is launched with a parameter?
Svchost.exe navigates in the registry to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Then the key with the name of the parameter is opened, like “LocalService”. If you open this key in Windows 10 most likely you will see the next list:
nsi
WdiServiceHost
w32time
EventSystem
RemoteRegistry
SstpSvc
netprofm
lltdsvc
FontCache
fdphost
bthserv
LicenseManager
bthavctpsvc
tzautoupdate
WpcMonSvc
SEMgrSvc
WinHttpAutoProxySvc
CDPSvc
workfolderssvc
PhoneSvc
DispBrokerDesktopSvc
SharedRealitySvc
CaptureService
WebClient
These are all the services that will run after command execution under this specific instance of svchost.exe. Let’s take for example “w32time”. After that all the services in this list will be run from the registry location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Each service with its key name, in our case:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\w32time
The path to the service DLL will be in the Parameters path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters
In the “ServiceDll” key. So, the DLL from that path will run under svchost.exe. This will be done for all the services from the list of the “LocalService” group.
Parent process is the process that executes the svchost.exe itself. In a regular environment it Is always will be “services.exe” and some service account with the SID of S-1-5-18 (NT AUTHORITY\SYSTEM), S-1-5-19 (NT AUTHORITY\LOCAL SERVICE), S-1-5-20 (NT AUTHORITY\NETWORK SERVICE), which are reserved for system accounts. You can find the full list of Security Identifiers in Microsoft Support – Windows known SIDs.
You can read more about LocalSystem, LocalService, NetworkService accounts on their relative pages in Microsoft Docs.
In two words:
LocalSystem is a SYSTEM account that runs mostly OS core executables and services,
LocalService runs local services (there are also services that are executables and not DLLs, like “FontCache”),
NetworkService runs local services that are related mostly to network activities.
User SIDs that start with “S-1-5-21” will most likely be the domain users or local users on a computer. To find out whom the SID belongs, you can navigate in the registry to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\
Select your user that starts with “S-1-5-21-“ and check for the value of the key that is called “ProfileImagePath”. The value will be the path to the user’s folder on your computer like
C:\Users\YourUsersName
The local regular user (even if he is an administrator on the host) that logged in interactively – can’t run svchost.exe by design. So, if you run any command of the service (like the one for WebClient: C:\WINDOWS\system32\svchost.exe -k LocalService -p -s WebClient) nothing will happen. It will run for a second or two and terminate. Two of the standard methods of executing a service (that is not running) is from Services console (services.msc) and with Command line of the file
C:\Windows\System32\sc.exe
The commands to start and stop a service (for example WebClient):
sc start webclientsc stop webclientIn the second case you must run CMD with Administrative privileges. In both cases the Parent Process of this instance of “svchost.exe” will still be “services.exe”.
Checking Service Host for security threats
So, what is the issue from the security point of view?
1. Svchost.exe is not legit
2. Parent process of the svchost.exe is not legit
3. Svchost.exe is legit, but its usage is not or being compromised
Check if svchost.exe is legit
1. Process Monitor:
Run “Process Monitor” as Administrator => [View]
[V] Command Line
[V] User Name
[OK]
2. Find the “svchost.exe” that you think is problematic => DoubleClick it => Goto [Image] tab
3. Check that the User Name in “User:” is one of the System accounts from above and not the Regular user account.
*** If a regular user account is running it then svchost.exe that is running doesn’t belong to system core and most likely is compromised!
4. Check that svchost.exe is running from “C:\Windows\System32”, look at the “Path:”. It should be “C:\Windows\System32\svchost.exe”.
*** If it is anything else, then your svchost.exe is compromised!
5. Check the file Hash over known services (the best way for most services is to use SHA256). If you’re using the computer at home, you can upload the file to a service for a check, but it is strongly not advised. If you’re in enterprise environment, you shouldn’t use file upload. Services like VirusTotal and Hybrid-Analysis are Public, so if your organization is targeted, by uploading the file it will be available online in these services and the attacker might know that your organization is aware of the attack.
So, in this case you will need the file Hash and check if it is already in the database of these services. If it is not, better use paid service like ThreatGrid From Cisco, which is Private for your organization (though there is still a way to know if a file hash is in ThreatGrid without having an account, you just won’t see any details regarding the investigation).
5.1. Run “powershell.exe”
5.1.1. [Win] + [R] will show you the “Run” window. Execute there
powershell.exeand it will open you the powershell window.
5.2. Execute “Get-FileHash” cmdlet over “svchost.exe”:
Get-FileHash c:\windows\system32\svchost.exeOr you can write “Get-FileHash” hit [Space] and drag the svchost.exe file in question (if the path to the file is not standard).
5.2.2. When you hit [Enter] you will see the “Algorithm” column (which by default is SHA256). Under the “Hash” column you will find your hash. Select the hash and hit [Enter], the hash will be copied to clipboard.
5.3. Goto VirusTotal Malware Databse (this is Public database of malicious file results over different engines)
5.3.1. You will be redirected to [Search] option, which is responsible to Search in VirusTotal database for Hashes (also URLs, domains, IPs).
5.3.2. Paste your Hash from the clipboard and hit [Enter]
5.3.3. If the results were found and it is green circle with 0 engines, it is a legit file, if it is not, you will see what the problem is in the [Details] tab.
*** If there are engines that found that your Hash is malicious – it might be!
5.4. Goto Hybrid-Analysis Sandbox (Public sandbox for malware analysis).
5.4.1. Goto [Report Search] tab, which is responsible for Hash search (also you can search by IP or Domain).
5.4.2. Paste your hash and hit [Enter] and check for the results.
5.5. Another site is Talos, which is part of Cisco intelligence. Talos connects to Cisco ThreatGrid sandbox database and shows if there is already an analysis of the file in ThreatGrid. Off course you will need ThreatGrid account in order to see the analysis itself. Talos File Reputation only works with SHA256 Hashes. Goto Cisco Talos File Reputation.
5.5.1. Paste you Hash, check that you’re not a robot
5.5.2. If the file is in the database you will be provided with the link to ThreatGrid login page and after login you should see any information about it, if the user that uploaded it made it public to the ThreatGrid users. By default, all the submissions are Private.
*** If you can’t find the hash of your svchost.exe file in any of the databases, most probably that it is malicious and the virus is new or you’re Operating System was updated recently, but in case of the update it should get very quick to the databases as it is a core process. Any way beware.
Check the parent process of svchost.exe
We need to find the parent process of our “svchost.exe”:
6. Return to “Process Monitor” that you left in stage 4.
6.1. Find the Parent process. It should be “services.exe”.
6.2. If you still have the svchost.exe window opened, check in the [Image] tab in “Parent:” option.
*** If it is not “services.exe” it is definitely malicious!
7. Close the window of your svchost.exe in question and find all the instances of “services.exe” in Process Monitor. Follow the same pattern that we did for “svchost.exe” from stage 1 to 5. There should be only 1 instance of “services.exe” though.
What can go wrong with legit Service Host?
If you’re using EDR software in Enterprise environment, you will see all the details prior to svchost execution in the logs. You should check for previous activities of “sc.exe” commands, like “sc create” (or “sc.exe create”) and registry changes in the keys that were stated above. This can indicate some messing around with svchost. With “sc create” you can create any service that you like including malicious executables. Some info about “sc.exe” Command Line Tool and “sc create” Command Switch can be found on Microsoft site.