Windows 10: Svchost.exe (Microsoft Windows Publisher)

what is this thing? it keeps downloading and has already download 500MB+, is it essential?









:)

 

Multiple instances are running for Svchost.exe in Windows 10 task manager

I have been having %100 disk activity that nearly freezes the machine for minutes+ for some time now (several months) and after looking over tasks running with procexp.exe I discovered multiple instances of svchost.exe that have identical command lines.
I'm convinced that this is a problem if not the problem. Any ideas how to fix this?

Microsoft Windows [Version 10.0.15063]

Here are command lines for all 82 instances at the moment:

C:\WlNDOWS\System32\svchost.exe -k utcsvc

c:\windows\system32\svchost.exe -k unistacksvcgroup -s an UserService

c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc

o:\windows\system32\svchost.exe -k unistacksvcgroup

C:\WlNDOWS\system32\svchost.exe -k RFCSS

C:\WlNDOWS\system32\svchost.exe -k NetwocherviceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\systern32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k NetSvcs

C:\WINDOWS\systern32\svchost.exe -k netsvcs

C:\WINDOWS\Systern32\svchost.exe -k netsvcs

C:\WINDOWS\Systern32\svchost.exe -k netsvcs

C:\WlNDOWS\systern32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNo Network

C:\WINDOWS\System32\svchost.exe -k LocalServiceNo Network

C:\WINDOWS\System32\svchost.exe -k LocalServiceNo Network

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\W|NDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetwodtRestricted

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe ~k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe ~k LocalServiceNetworkRestricted

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe -k LocalServiceAndNolmpersonation

C:\W|NDOWS\System32\svchost.exe -k LocalServiceAndNolmpersonation

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\System32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\System32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\WlNDOWS\System32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WlNDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\svchost.exe -k iissvcs

C:\WlNDOWS\system32\svchost.exe -k ftpsvc

c:\windows\system32\svchost.exe -k devicesflow -s DevicesFlow UserSvc

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k appmodel

C:\WINDOWS\system32\svchost.exe -k appmodel

 

svchost.exe in Windows/Temp is a massive Trojan and when I remove it the system crashes and puts it back. Why is a VIRUS a SYSTEM FILE?

It's a file that Windows runs with System credentials. Technically svchost.exe is the wrapper that runs system services like Windows Audio and Network stuff.

That being said, I'm trying to ask Microsoft why they made a svchost.exe in the Windows Temp folder (not the System folder) that IS A MASSIVE VIRUS.

 

did some verification and it seems to be clean and legit. *Shock





process explorer appears to be more accurate than process hacker.

 

Svchost.exe (Service Host, or SvcHost) is a system process that hosts multiple Windows services in the Windows NT family of operating systems. You may notice multiple Svchost.exe processes this is normal because if every single service ran under a one Service Host process, a failure in one service could potentially bring down all of Windows. Instead, they are separated out.

With Windows 10 processes are shown on the “Processes” tab of Task Manager by their full names. If a process serves as a host for multiple services, you can see those services by simply expanding the process. This makes it very easy to identify which services belong to each instance of the Service Host process.





You can right-click any individual service view it in the “Services” Control Panel app, or even search online for information about the service.

 

A clear and concise explanation from @FreeBooter of the purpose of svchost. It's worth noting that exactly how the processes are separated out amongst svchosts underwent a big change in Creators Update (1703). On 64-bit systems with more than 3.5GB RAM each process will now get its own svchost, making for greater reliability.
https://blogs.technet.microsoft.com/...dows-10-v1703/

This has led some to worry at the vast numbers of svchosts running, I have 78 at present. But it is nothing to be concerned about, it's the same number of processes now, just that each gets it's own svchost instead of being in a group of services under one host.

 

Thank you @Bree

You are welcome @Win10Newb