I don't know if this is the right place to post this question but I have two tasks that have appeared recently and are always taking up most of my CPU. They don't have a name and when I go to stop them they don't stop running.

If I open file location they go to svchost.exe but I feel it could be malware disguising itself.

Is there any chance these two tasks are malware?

  • 2
    open a command prompt and type tasklist /SVC AND tasklist /FI "imagename eq svchost.exe" /svc update your question with the results
    – HashHazard
    Nov 4 '16 at 1:22
  • Depending on your Windows version and patches, the one svchost process that contains Windows Automatic Update 'wuauserv' is frequently a ginormous CPU and memory hog; see superuser for several Qs on this. I don't know any second one like this though. Nov 4 '16 at 6:36

svchost.exe (Service Host) is a normal process used for running services (background programs) on Windows. You can use tools like Process Explorer to determine what executables are being ran by the Service Host process. Without further information as to what is being ran by the Service Host it is impossible to provide you with additional recommendations, and JL117748's "answer" is woefully uninformed in regards to the basics of the Windows operating system. You can download a copy of Process Explorer here.


I should have been more detailed and addressed how to specifically see which services are being ran by Service Host, since by saying executable gave the impression of only child processes as brought up by dave_thompson_085. If you right click on the svchost.exe process in Process Explorer, and select Properties, then click on the Services tab as can be seen in the screenshot below. Assuming the services arent needed/required by the operating system, they can be disabled by opening the Computer Management MMC (in Administrative Tools, or right clicking the Start Menu/Windows Logo button), selecting Services underneath Services And Applications, then double clicking the relevant service, clicking the stop button and then changing the Startup Type to Disabled.

eProcess Explorer

  • Note that there are both processes under svchost, such as shown by ProcessExplorer TreeView, and service threads inside svchost, shown by mousing over svchost or doubleclicking it (or select, Process, Properties) in the Services tab, as well as tasklist /svc commented by Hollowproc. Nov 4 '16 at 6:39
  • Yea i don't see the need to download additional software to answer OPs question.
    – HashHazard
    Nov 4 '16 at 17:09
  • If OP doesn't know what svchost and thinks it is malware, its pretty easy to assume that using a command line would be beyond his abilities. There is a reason why GUIs exist, and it is to make computing more accessible to the masses.
    – Muh Fugen
    Nov 4 '16 at 18:50

This could very well be the case , where you might have a rootkit installed. Because such changes can only happen if you modify _EPROCESS structure, which requires us to write a kernel driver. If thats the case, no AV can help you. I dont know if there are known rootkit hunters, but you should probably look into that angle.


I may be able to answer more fully if I know where this svchost.exe is located, but I'll give it my best shot. This is most likely malware, as legitimate processes usually don't run with no name. The malware could, if advanced enough, be making task manager hide the process name and make the process properties point to svchost.exe. You should consult your antivirus(use a full scan, not a quick one).

Hope this helped.

  • Thanks for the reply, the svchost.exe is located in C:\Windows\System32 I have a feeling its malware because its only a recent thing.
    – Bad Dub
    Nov 3 '16 at 22:54
  • How recent? Is this a recent Windows installation?
    – JL117748
    Nov 3 '16 at 23:25
  • Its just windows 10, AVG didnt pick it up so I trying BitDefender
    – Bad Dub
    Nov 4 '16 at 1:03
  • If you haven't already try a Malwarebytes Pro Trial.
    – JL117748
    Mar 15 '17 at 13:46

If you're running windows 10, other articles have suggested the cause is actually Windows Update glitching out. My laptop's Microsoft functionality is corrupted, though, so I'm not sure if the solution of updating will actually fix it, but I figured I'd throw this out there for other potential wanderers of the forum. I have the same problem, but mine aren't using any memory or CPU, so I don't actually NEED to fix it. Given, because my updates never work, I ALSO end up killing any of the processes associated to updating, so that's probably WHY my blank svchosts aren't using anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.