PROCESSMicrosoft-signed
svchost.exeService Host
svchost.exe (Service Host) is a legitimate Windows process that hosts services which run from DLLs rather than their own executables. Many copies run at once, each hosting one or a few services, which is why Task Manager shows so many. High CPU or disk from svchost.exe almost always traces to a specific service, most often Windows Update.
What svchost.exe does
Many Windows services are not standalone programs; they are DLLs. They cannot run on their own, so Windows loads them inside a generic host process, svchost.exe. Each svchost instance is started by the Service Control Manager with a command line naming the service group it hosts:
svchost.exe -k netsvcs -p -s ThemesThe -k group and -s service tell you what that instance is running.
Why there are so many
Historically Windows grouped many services into a few svchost processes to save memory. Since Windows 10 1703, machines with more than roughly 3.5 GB of RAM run one service per svchost, trading a little memory for much better isolation: a crash or compromise in one service no longer affects others, and Task Manager can attribute resource use precisely. Twenty to eighty svchost.exe processes is normal on a modern PC.
Seeing what a svchost hosts
- Task Manager (Processes tab): expand a Service Host entry to see the service name and its resource use.
- Command line:
tasklist /svc /fi "IMAGENAME eq svchost.exe"- Resource Monitor (
resmon): the CPU and Disk tabs list services individually.
See the tasklist and sc records.
Fixing high CPU, disk or memory
- Identify the service with the methods above. Do not act on "svchost.exe" in the abstract; act on the service inside it.
- Windows Update (wuauserv) is the most common culprit. Let updates finish; if it is stuck, run the Windows Update troubleshooter, or stop the service, clear
C:\Windows\SoftwareDistribution, and restart it. - Delivery Optimization may be uploading updates to other PCs. Settings → Windows Update → Advanced → Delivery Optimization to limit or disable it.
- Superfetch/SysMain occasionally causes high disk on older machines; setting it to manual can help, though it usually improves performance.
- Rule out malware by confirming the path and signature (below), then run a full scan.
Never end a svchost.exe process with taskkill; stop the specific service with sc or the Services console instead, so the Service Control Manager handles it cleanly.
Confirming it is genuine
Right-click the process → Open file location: it must be C:\Windows\System32 (or SysWOW64 for 32-bit). → Properties → Digital Signatures: it must be signed by Microsoft. A svchost.exe anywhere else, or unsigned, warrants investigation.
Frequently asked questions
Why are there so many svchost.exe processes?
Since Windows 10 version 1703, on machines with more than about 3.5 GB of RAM, Windows runs each service in its own svchost process instead of grouping them. That improves reliability and security but multiplies the number of svchost.exe entries. It is normal.
How do I find which service is causing high CPU?
In Task Manager, expand the svchost.exe entry to see the service, or right-click it → Go to details, note the PID, and run tasklist /svc /fi "PID eq <pid>". Resource Monitor also attributes CPU and disk to the specific service.
Is svchost.exe a virus?
The real one runs from C:\Windows\System32 (or SysWOW64) and is signed by Microsoft. Malware sometimes uses the name from another folder. Check the path and signature; a svchost.exe outside System32/SysWOW64 is suspect.
Why is svchost.exe using so much disk or network?
Usually Windows Update (wuauserv) downloading or the Delivery Optimization service sharing updates. It settles after updates finish. Persistent high usage can indicate a stuck update; see the fixes below.