Multiple instances are running for Svchost.exe in Windows 10 task manager

Hello Bane,

Thank you for contacting Microsoft Community.

We understand the inconvenience you have experienced.

Svchost.exe is a process on your computer that hosts, or contains, other individual services that Windows uses to perform various functions. For example, Windows Defender uses a service that is hosted by a svchost.exe process.

There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. One instance of svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of svchost.exe.

Open Task Manager by pressing CTRL+SHIFT+ESC, then right-click an instance of svchost.exe in Details tab, and then click Go to Service(s). The services associated with the process are highlighted on the Services tab.

Also suggest you to go for a complete system scan with Windows Defender or with any available Antivirus Software to make sure no virus is causing this issue. The Microsoft Safety Scanner is a free downloadable security tool that provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software. Do scan your PC by downloading Microsoft Safety Scanner.

Keep us posted if you require further assistance.

Hello Bane,

Thank you for contacting Microsoft Community.

We understand the inconvenience you have experienced.

Svchost.exe is a process on your computer that hosts, or contains, other individual services that Windows uses to perform various functions. For example, Windows Defender uses a service that is hosted by a svchost.exe process.

There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. One instance of svchost.exe might host a single service for a program, and another instance might host several services related to Windows. You can use Task Manager to view which services are running under each instance of svchost.exe.

Open Task Manager by pressing CTRL+SHIFT+ESC, then right-click an instance of svchost.exe in Details tab, and then click Go to Service(s). The services associated with the process are highlighted on the Services tab.

Also suggest you to go for a complete system scan with Windows Defender or with any available Antivirus Software to make sure no virus is causing this issue. The Microsoft Safety Scanner is a free downloadable security tool that provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software. Do scan your PC by downloading Microsoft Safety Scanner.

Keep us posted if you require further assistance.

Hello Bane,

Thank you for getting back to us with an update.

I forget to ask you this. By looking what or where you have confirmed it has downloaded 1.5 GB of Data?

If you really want to trace the services running behind Svchost.exe, then you can make us of Process Explorer v16.12. Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The Process Explorer display consists of two sub-windows. Hover your mouse over one of the processes (I.e. Svchost.exe) will show you a popup list of all the services.

Also, I suggest you to check this issue by setting up another User Profile. This might give us the clue on the root cause of the issue. Refer the article Set up accounts on Windows 10.

Let us know how it went.

Hello Bane,

Thank you for getting back to us with an update.

I forget to ask you this. By looking what or where you have confirmed it has downloaded 1.5 GB of Data?

If you really want to trace the services running behind Svchost.exe, then you can make us of Process Explorer v16.12. Process Explorer shows you information about which handles and DLLs processes have opened or loaded. The Process Explorer display consists of two sub-windows. Hover your mouse over one of the processes (I.e. Svchost.exe) will show you a popup list of all the services.

Also, I suggest you to check this issue by setting up another User Profile. This might give us the clue on the root cause of the issue. Refer the article Set up accounts on Windows 10.

Let us know how it went.

Hey thanks for the replay ! i keep track of recourse monitor, and am in contract with IDM company in lebanon for my data and there is a costumer website to check my download/upload/remaining data i monthly have ! and on that date it shows 300 + mb upload 1150 + mb download . and i kept on checking what cause this massive data consumption it was svchost.exe via resource monitor. 

Hello Bane,

We understand your concern in this regard.

1. Did you see any Windows Update installed in that particular date?
2. Is that data usage still occurring?
3. Did you check this issue by setting up another User Profile?

As I explained in earlier post, there can be multiple instances of svchost.exe running on your computer, with each instance containing different services. In view of the same, a Windows Update or app or application which connect to network and update itself is also a reason for data usage. Navigate to Start Button/>Settings/>Update & Security/> Windows Update /> Advanced options /> View your update history, there you can find all installed updates. See and confirm that, if any Windows Updates installed on that particular date.

Keep us posted if you require further assistance.

Adding to Yashwant:

Using Tasklist.exe command-line, you can see the list of services hosted by each Svchost.exe process, along with their Process ID. Right-click Start, click Command Prompt. Type

TASKLIST /SVC

I have been having %100 disk activity that nearly freezes the machine for minutes+ for some time now (several months) and after looking over tasks running with procexp.exe I discovered multiple instances of svchost.exe that have identical command lines.  I'm convinced that this is a problem if not the problem.  Any ideas how to fix this?

Microsoft Windows [Version 10.0.15063]

Here are command lines for all 82 instances at the moment:

C:\WlNDOWS\System32\svchost.exe -k utcsvc

c:\windows\system32\svchost.exe -k unistacksvcgroup -s an UserService

c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc

o:\windows\system32\svchost.exe -k unistacksvcgroup

C:\WlNDOWS\system32\svchost.exe -k RFCSS

C:\WlNDOWS\system32\svchost.exe -k NetwocherviceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WINDOWS\System32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k NetworkService

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\systern32\svchost.exe -k netsvcs

C:\WINDOWS\System32\svchost.exe -k NetSvcs

C:\WINDOWS\systern32\svchost.exe -k netsvcs

C:\WINDOWS\Systern32\svchost.exe -k netsvcs

C:\WINDOWS\Systern32\svchost.exe -k netsvcs

C:\WlNDOWS\systern32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WlNDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WINDOWS\System32\svchost.exe -k LocalSystem NetworkRestn'cted

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNo Network

C:\WINDOWS\System32\svchost.exe -k LocalServiceNo Network

C:\WINDOWS\System32\svchost.exe -k LocalServiceNo Network

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\W|NDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\WlNDOWS\system32\svchost.exe -k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe -k LocalServiceNetwodtRestricted

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe ~k LocalServiceNetwodtRestricted

C:\WINDOWS\System32\svchost.exe ~k LocalServiceNetworkRestricted

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe ~k LocalServiceAndNolmpersonation

C:\WlNDOWS\system32\svchost.exe -k LocalServiceAndNolmpersonation

C:\W|NDOWS\System32\svchost.exe -k LocalServiceAndNolmpersonation

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\System32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\System32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\W|NDOWS\system32\svchost.exe -k LocalService

C:\WlNDOWS\System32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WlNDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\svchost.exe -k iissvcs

C:\WlNDOWS\system32\svchost.exe -k ftpsvc

c:\windows\system32\svchost.exe -k devicesflow -s DevicesFlow UserSvc

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

C:\WINDOWS\system32\svchost.exe -k appmodel

C:\WINDOWS\system32\svchost.exe -k appmodel

Write this in CMD to display all service names.

tasklist /svc /fi "imagename eq svchost.exe" 

svchost.exe                    840 PlugPlay
svchost.exe                    880 BrokerInfrastructure, DcomLaunch, Power,
                                   SystemEventsBroker
svchost.exe                    976 RpcEptMapper, RpcSs
svchost.exe                     72 LSM
svchost.exe                   1140 NcbService
svchost.exe                   1160 TimeBrokerSvc
svchost.exe                   1264 Schedule
svchost.exe                   1284 hidserv
svchost.exe                   1324 ProfSvc
svchost.exe                   1412 BFE, CoreMessagingRegistrar, MpsSvc
svchost.exe                   1420 EventLog
svchost.exe                   1456 lfsvc
svchost.exe                   1536 UserManager
svchost.exe                   1592 nsi
svchost.exe                   1648 Dhcp
svchost.exe                   1772 NlaSvc
svchost.exe                   1832 SysMain
svchost.exe                   1840 EventSystem
svchost.exe                   1848 Themes
svchost.exe                   1928 netprofm
svchost.exe                   2000 SENS
svchost.exe                   1632 AudioEndpointBuilder
svchost.exe                   1516 FontCache
svchost.exe                   2176 Dnscache
svchost.exe                   2304 WinHttpAutoProxySvc
svchost.exe                   2352 Audiosrv
svchost.exe                   2416 StateRepository
svchost.exe                   2516 DusmSvc
svchost.exe                   2512 Wcmsvc
svchost.exe                   2592 ShellHWDetection
svchost.exe                   2836 LanmanWorkstation
svchost.exe                   2904 Winmgmt
svchost.exe                   2912 DPS
svchost.exe                   2920 DiagTrack
svchost.exe                   2956 CryptSvc
svchost.exe                   1000 TrkWks
svchost.exe                   2808 WpnService
svchost.exe                   3296 LanmanServer
svchost.exe                   3372 WdiServiceHost
svchost.exe                   3392 iphlpsvc
svchost.exe                   4952 TokenBroker
svchost.exe                   5024 TabletInputService
svchost.exe                   7012 Appinfo
svchost.exe                   6500 PcaSvc
svchost.exe                   6828 CDPSvc
svchost.exe                   7916 DoSvc
svchost.exe                   6048 wscsvc
svchost.exe                   8168 StorSvc
svchost.exe                   8520 WdiSystemHost
svchost.exe                    960 wuauserv
svchost.exe                   7260 CDPUserSvc_
svchost.exe                    820 WpnUserService_
svchost.exe                   6404 lmhosts
svchost.exe                   1556 SSDPSRV
svchost.exe                   9912 OneSyncSvc_
svchost.exe                   2636 smphost
svchost.exe                  10192 LicenseManager

Here's all mine. 57 annoying PIDs..

Please fix.