svchost.exe definition

A system process hosting one or more Windows services formally introduced with Windows 2000. Since running separate processes for each related service is inefficient, svchost.exe groups them together into a single process to use less resources. There can be multiple instances of svchost.exe running on a Windows device at the same time, each controlling a different set of services.

Because svchost.exe uses a lot of RAM while active and is featured prominently in Windows crash reports, many users mistakenly believe it to be a virus. While some malware does indeed masquerade as svchost.exe, attempts to remove the real file can destabilize the whole operating system.

Stopping viruses mimicking svchost.exe

• Use dedicated antivirus software and keep it up to date. Scan your system regularly to detect any virus masquerading as svchost.exe early.
• Do not click on suspicious links or attachments. Infected documents and webpages will try to run malicious scripts automatically, possibly creating a fake svchost.exe file in the process.
• Use NordVPN’s Threat Protection feature to avoid malicious websites and scan files for viruses as you download them.
• Check the network activity of suspected processes to see if they’re secretly communicating with external entities.

Further reading