Scvhost.exe: what it is and how to remove it
Scvhost.exe is a malicious file which is designed to deliver various cyber threats, including malware and Trojan viruses. The name of this executable is similar to a legitimate Windows process, which is known as svchost.exe and is responsible for managing operations that run from Dynamic-link Libraries (DLLs).
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan can look at Scvhost.exe and the other programs installed around the same time.
Do it yourself · free Remove Scvhost.exe yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Scvhost.exe: summary
| Distribution | Malicious version of the executable file might enter the system via malvertising, fake software updates or software-bundles |
|---|---|
| Name | Scvhost.exe |
| Type | Malware |
| Symptoms | Malware might be programmed to mine cryptocurrency which results in high CPU usage |
| Detection names | No Microsoft detection name is known |
| Damage | Not recorded in the old report |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Evidence | 3 write-ups by security sites; details still limited |
|---|---|
| File name | Scvhost.exe |
| What it is | Of unknown origin |
| First seen | 28 June 2018 |
| Facts checked | 6 October 2026 |
What the Scvhost.exe file is
From our report of Jun 2018 · not reviewed since
Scvhost.exe is a malicious file which deliberately uses similar name as a legitimate Windows process
Scvhost.exe is a malicious file which is designed to deliver various cyber threats, including malware and Trojan viruses.
The name of this executable is similar to a legitimate Windows process, which is known as svchost.exe and is responsible for managing operations that run from Dynamic-link Libraries (DLLs). Likewise, people might fail to recognize malware as it uses an exceptionally similar name as Service Host.
The critical Scvhost.exe virus symptom is an excessive usage of computing power. This can be noticed once you open the Task Manager. Even though you might find it insignificant, this may permanently affect your computer's performance in the long run with the following consequences:
Scvhost.exe high CPU usage results in the consequences mentioned above since the computer allocates all of its resources to mine digital currency rather than completing fundamental system processes. Likewise, if the malicious program disguises as Service Host, you should take action immediately.
Note that it is essential to remove Scvhost.exe and not the legitimate Windows process. Otherwise, you can permanently damage your operating system. Thus, the only way to identify that your PC is infected is by installing and running a full system scan with a professional antivirus.
For Scvhost.exe removal, you should get or another reliable security tool. In case you are blocked from downloading malware removal software, you can check the instructions at the end of this article and learn how to deactivate the malicious program on your system.
- Some programs start to crash;
- The computer constantly freezes;
- It takes longer for applications to load;
- Another malfunctioning of the system.
How to check the Scvhost.exe file
- File:
Scvhost.exe
From our report of Jun 2018 · not reviewed since
More from our earlier report on Scvhost.exe
- If the file is potentially dangerous, you can uninstall Scvhost.exe only with or another robust security software
Where Scvhost.exe comes from
From our report of Jun 2018 · not reviewed since
Criminals aim to find new ways how to infiltrate the systems with malware by employing social engineering techniques.
Malicious programs might not only use the same name as legitimate Windows processes but also enter the system with the help of deceptive methods.
Usually, bogus scripts can be embedded into the code of online advertisements which are displayed on your frequently visited sites. Such malware distribution technique is designed to create innocent-looking ads and trick people into clicking on them. As a result, the advert automatically starts virus installation.
Furthermore, you can unconsciously infect your system if you download software or its updates from unauthorized websites. Additionally, there is a strong risk that third-party tools hide the malicious program inside its installer which leads to the infiltration of malware.
Thus, remember to trust only official websites for software downloads and avoid clicking on online ads. Also, it is wise to choose Advanced/Custom settings when installing programs as they reveal additional components which are hidden from the user.
What to do with Scvhost.exe
How to remove Scvhost.exe
It is usually a leftover of an unwanted program.
Uninstall the program, then delete what remains.
Step 1: Uninstall programs you did not mean to install
Scvhost.exe rarely comes alone: it is usually installed by, or together with, a free program. In Windows 11 open Settings > Apps > Installed apps, in Windows 10 Settings > Apps > Apps & features, and sort by install date.
Uninstall every entry from the day the trouble began that you did not install on purpose, for example a download manager, a converter or a browser you never chose.
Keep drivers and entries from Microsoft, Intel, AMD, NVIDIA or your PC's maker unless you are sure.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Scvhost.exe, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Scvhost.exe that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of Jun 2018 · not reviewed since
Ways to complete Scvhost.exe removal if necessary
According to BedyNet.ru team, before you start Scvhost.exe removal, you should make sure that you are going to get rid of the malicious file and not essential system process.
For that, we strongly advise getting help from an IT professional or employing an antivirus software. This way, you won't disable secure Windows process and protect your computer from damage.
You can remove Scvhost.exe virus with , , or as they are designed to be easy-to-use for inexperienced PC users. Additionally, check the guidelines below in case the malware starts blocking the installation of the security software.
[GI=method-1]If you can't install the antivirus, reboot your PC to Safe Mode with Networking as shown below:
[GI=method-2]If the first method didn't help, try booting your system into Safe Mode with Command Prompt.
Questions about Scvhost.exe
Is Scvhost.exe safe?
It depends on where the file is and who signed it, not on the name. Open Task Manager, go to the Details tab, right-click Scvhost.exe and choose Open file location. A file inside Program Files or System32 with a valid digital signature from a known company is usually part of a legitimate program.
A file in AppData, Temp or ProgramData with no signature, especially one that restarts itself after you end it, is suspicious. If you cannot tie the process to anything you installed, uninstall recent unfamiliar programs and run a Microsoft Defender Offline scan.
Scvhost.exe keeps coming back. What should I do?
A process that returns after you end it has a restart mechanism, and that is a reason to treat Scvhost.exe as unwanted. Check Settings > Apps > Startup, Task Scheduler and the Services list for entries pointing to its folder, and disable them.
Look in Installed apps for anything added the same day and uninstall it. Then delete the folder and run a Microsoft Defender Offline scan, which works before Windows starts and can remove files that are locked or hidden while the system is running.
How did Scvhost.exe get onto my PC?
Files like Scvhost.exe, which is of unknown origin, usually arrive with a free program whose installer added extra offers that were ticked by default. They can also stay behind after you uninstall such a program, because the uninstaller removes the main part only.
Sort Installed apps by date and look at what was installed around the time the file appeared; that is usually the source. Next time, choose Custom or Advanced in installers and untick additional software. Read each screen before clicking Next.
Why does Scvhost.exe use so much CPU?
Usually it is doing work for Windows or another program:
- updates
- indexing
- scanning
- a stuck task
Wait a few minutes after start-up, then check again. If high use continues, restart the PC, install pending updates and check the related program. If the busy copy runs from an unusual folder, high CPU can be a cryptominer using the name.
The Details tab in Task Manager shows which copy is busy; for a system process, right-click it and choose Go to service(s) to see the services behind it.
How can I find out what Scvhost.exe does?
Look at what it touches. In Task Manager, check its CPU, memory and network use; in Resource Monitor, see which files and connections it opens; in Task Scheduler and the Startup list, see what starts it. The report here is an unfamiliar process called Scvhost.exe in Task Manager.
You can also upload the file to an online multi-engine scanner to see whether security vendors already detect it. Do not run it again to test it, and do not download tools offered on pages that promise to explain such files.
Can I rename or move Scvhost.exe to stop it?
Do not. Renaming or moving a genuine file breaks the program or the Windows feature it belongs to, and Windows may restore it anyway. Renaming a malicious copy does not make it harmless either: whatever starts it may still find it, or download a fresh copy.
The right tools are the program's uninstaller for unwanted software, a full scan and the offline scan for malware, and System File Checker for damaged Windows files. Each removes or repairs the related entries as well.
Why are there several Scvhost.exe processes?
Windows and many programs run separate instances for different tasks, tabs or users, so several copies in Task Manager can be normal. Right-click each one and choose Open file location: they should all point to the same genuine folder.
Many copies alone are not a sign of infection. A copy that points to another folder, or one with no publisher on the Details tab, is the one to check further. If the count keeps growing, a program may be starting new instances in a loop.
Can I stop Scvhost.exe from starting?
If it belongs to Windows, not safely. If it belongs to a third-party program, yes, in Task Manager > Startup apps or in the program's own settings, if you do not need its background features.
If it is malware or a leftover, remove it instead; disabling startup alone leaves it on the disk. Before changing anything, find out what the file is for. If you only want a faster start, the Startup impact column in Task Manager shows which entries slow it most.
Can I just delete Scvhost.exe?
Not right away. If the file is running or something restarts it, deleting fails or the file returns. First check what it is:
- open Properties
- look at the publisher and the signature
- note the folder
A file that matches an unfamiliar process called Scvhost.exe in Task Manager and has no publisher is not part of Windows. End its process in Task Manager, remove the startup entry or scheduled task that points to it, then delete the file and restart. If it comes back, an offline scan with Microsoft Defender removes what keeps restoring it.
Will Fortect remove Scvhost.exe?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Scvhost.exe, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)