Changes

The '''Windows Service Host''' is a vital part of the [[Windows]] [[operating system]], but also a part which can be troublesome. to some individuals.  According to [[Microsoft]],  

The '''Windows Service Host''' is a vital part of the [[Windows]] [[operating system]], but also a part which can be troublesome. to some individuals.  According to [[Microsoft]],  

{{cquote|svchost.exe is a generic host process name for services that run from dynamic-link libraries.}}

{{cquote|svchost.exe is a generic host process name for services that run from dynamic-link libraries.}}

Since all internal [[Windows]] processes used to be [[Dynamic-Link Library|DLL]]s, [[Microsoft]] had a problem when they wanted to switch to executable [[software|programs]] for these services.  In the end, they officially made the switch, but old services where left as [[Dynamic-Link Library|DLL]]s.  SvcHost was added to the system to run the [[Dynamic-Link Library|DLL]]s as executable [[software|programs]].  The problem with this is that multiple services run under the umbrella Service Host process.

Since all internal [[Windows]] processes used to be [[Dynamic-Link Library|DLL]]s, [[Microsoft]] had a problem when they wanted to switch to executable [[software|programs]] for these services.  In the end, they officially made the switch, but old services where left as [[Dynamic-Link Library|DLL]]s.  SvcHost was added to the system to run the [[Dynamic-Link Library|DLL]]s as executable [[software|programs]]. <ref>http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running</ref>  

 

The problem with this is that multiple services run under the umbrella Service Host process. For this reason, malware will sometimes use the same name to "hide in plain sight."  Using a tool like [[Process Explorer]] one can check the location of the executable.  If it is not located in Windows\System32 of your operating drive, it is a fake.  However, the legitimate svchost.exe can be misused.  Even if you see the process running from the correct location, it may be running a malicious "service."

 

 

==External Links==

==External Links==

[https://malwaretips.com/blogs/svchost-exe-virus-removal How to detect and Deal with Malware Using the Name svchost.exe]

[https://malwaretips.com/blogs/svchost-exe-virus-removal]