Windows 10: svchost Running under User Name

Hi,

Almost everywhere it says if svchost is running under the PC's name or the user logon name then there's a problem, possibly malware. But now I just read this:

Is this true? Must be...So what people have been saying is a sign of malware, is, at least in Win10 normal functioning. And svchost associated with it is in .../system32, where it should be. Supposedly MS is using it for telemetry.

Am I right about this? Thought I had some deep-seated malware but apparently not?

Thanks

:)

 

svshost.exe suspiciously using too much cpu

So for several months i noticed from time to time my machine would suffer a drastic slowdown.

When this occurred i opened task manager only to find a process with no name running under svchost.exe, using about 80% of cpu.

Usually i just closed it and that's it, the problem was gone until it happened again. I never really worried about it.

But since I make a lot of dowloads i was wondering whether this could be a virus, so i decided to check. I found what svchost.exe is and what it does, where it should be, etc. I was also informed that it would be suspicious to more than one running at once
or running under my current user and not system or local/network service etc.

So i found two things. One is that i do have a svchost listed under my user name, however whenever i do have this problem the one running is under system and located at Windows\Temp the one under my user i never found running, but this is where i got confused.

The one under my user is at Windows\System32. So is any of them "suspicious" or is are they both ok and it's just a hung process or something like that that causes the issue?

 

svchost.exe abnormally high CPU usage (~25%) if network is enabled

Svchost.exe is a
generic host process name for a group of services that are run from dynamic-link libraries (.dll's) and can run other services
underneath itself. This is a valid system process that belongs to the Windows Operating System which handles processes executed from .dll's. It runs from the registry key, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost where details
of the services running under each instance of svchost.exe can be found. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. It is not unusual to find
multiple instances of Svchost.exe running at the same time in
Windows Task Manager in order to optimize the running of the various services.

• svchost.exe SYSTEM
• svchost.exe LOCAL SERVICE
• svchost.exe NETWORK SERVICE

Each Svchost.exe session can contain a grouping of services, therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. The

process identifier (PID)'s must be checked in real time to determine what services each instance of svchost.exe is controlling at that particular time. The PID is not static and can change with each logon but generally they
stay nearly the same because they are always running services.

It is not uncommon for a computer to have a svchost process running between 95 - 99% of CPU resources. There can be several issues relating to a spiking svchost to include access violations, memory leaks, Windows Installer (MSI), Windows Update, and other programs
installed on your system.

Investigating Svchost.exe Tutorials::

• How to determine what services are running under a Svchost.exe process
• Using Svchost Viewer to show exactly what each svchost.exe is Doing
• 7 Ways to Easily Identify Svchost.exe Service Name

 

I have never seen svchost running under user name, not in 10 either.
You should open file location an check, if it is really svchost in System32.
Then again, I have never allowed telemetry and I disable Unistack services.

 

Malware can run disguised as a sub process under SVCHost. Other programs also run under SvcHost, since it is a main process used by Windows when traffic steering for network and other items. You can run the programs in this post to check for possible malware or a run away process. Read & Run Me First Malware Removal Guide (incl. Spyware, Virus, Trojan, Hijacker) | MajorGeeks.Com Support Forums

 

That's a great malware scanning link. Thanks.