svchost.exe is a process that hosts, or contains other individual services that Windows uses internally.

Sometimes there are large number of processes running with the same name svchost.exe. In Windows 8.1 this service is called Service Host as you can see from the picture.

A few years ago Microsoft decided to move all functionalities from Windows services from .exe files to .dll files. However you cannot launch .dll file from Windows.

You need to have .exe file which will run these .dll files. Because of that svchost was created as .exe file which will host multiple Windows services.

Why there are so many Service host files running?

Windows require a lot of services to run. If we put all these services into a single svchost.exe instance, a failure in one service can cause entire system failure.

This is the main reason why we have a lot of svchost.exe files running. They are organized into logical groups, and a single svchost.exe instance is created for each group.

In Windows 8.1 you can easily see which Windows service is running under which Service Host file by expanding it in the Task Manager tree like on the picture below.

So for example, if you have one problematic svchost.exe process which consumes 100% CPU you can easily see what services are running under this Service Host.

If you are not having Windows 8 or you want more advanced options than I suggest you to install Process Explorer from Sysinternals .

With this great tool you can easily track problematic Windows services under svchost.exe and how much resources they consume.

Can svchost.exe be a virus?

Please make sure that your svchost file is located in Windows\System32 directory. If the file is located in this directory you probably don’t have a virus.

What is vshost.exe file in Visual Studio

When you build .NET applications (windows forms,WPF…) you can get a file appname.vshost.exe along with your exe file.

This file is also hosting process that improves debugging performance, enables partial trust debugging, and enables design time expression evaluation.
 

 

Improved debugging performance

When you hit F5 your program is run. However, running a managed application requires the creation of “AppDomain”. Creation of an AppDomain and initialization the debugger is time consuming.

When you hit F5 again, everything must be created and initialized again. vshost.exe hosting process speeds up this process by doing this work in the background.

Partial trust debugging

Visual Studio has ability to debug applications in partial trust with permission settings defined on the Security page.

Simulating a partial trust environment under the debugger requires initialization of the AppDomain, which is handled by the vshost.exe process.

Design time expression evaluation

Visual Studio has ability to test code in your application from the immediate window. vshost.exe is used to run your code under design time.

If you want to learn more about Windows Internals I can recommend a great book:

Book: Windows Internals 6th Edition (Developer Reference)