Svchost.exe is a Windows system file. It is the Generic Host Process for Win32 Services.
Svchost.exe manages 32-bit DLLs as well as other services.
Microsoft runs a lot of software functionality from DLL (dynamic link library) interface.
But DLLs can’t launch themselves – they need an executable program. On startup,
svchost.exe checks the services in the Registry and makes a list of services it has to load.
Usually there are several svchost.exe files running at the same time. Each svchost.exe instance can group services,
so that separate services can be run depending on where and how svchost.exe is started.
The multiple executions of svchost.exe reduce the possibility of one process crashing the entire system,
thIs making the operating system more stable and secure.
IMPORTANT: The svchost.exe file should be in the C:\Windows\System32 folder. If you find it anywhere else, then svchost.exe could be a virus, trojan, worm, or spyware! Scan your computer with Auslogics Antivirus to make sure it’s not infected.
According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?
Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.
So What Can I Do About It?
You can trim down unneeded services by disabling or stopping the services that don’t absolutely need to be running. Additionally, if you are noticing very heavy CPU usage on a single svchost.exe instance you can restart the services running under that instance.
The biggest problem is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.
The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.
Svchost.exe groups are identified in the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost
Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes.
Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group.
Each Svchost group can contain one or more service names that are extracted from the following registry key, whose Parameters key contains a ServiceDLL value:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service
To view the list of services that are running in Svchost:
Click Start on the Windows taskbar, and then click Run.
In the Open box, type CMD, and then press ENTER.
Type Tasklist /SVC, and then press ENTER.
Tasklist displays a list of active processes. The /SVC switch shows the list of active services in each process. For more information about a process, type the following command, and then press ENTER:
Tasklist /FI “PID eq processID” (with the quotation marks)
) however i think i’ve finally identified what’s causing those connections.