How to end all svchost processes, except system?

Need CMD command terminate all the process svchost.exe except system.
taskkill /f /im svchost.exe yeah, but you need to bypass the system so they didn't even flinch.
The system is located in the system32 folder, but the virus may be there, just in a subfolder.
April 4th 20 at 00:33
5 answers
April 4th 20 at 00:35
Well the type they all the system.
Scan the system with antivirus. DrWeb CureIt or there KVRT, it will help.
The system is the system that I am talking about the presence of third-party files, it was difficult to enter the topic or what? I did not just put the difficulty level on average in order to not write nonsense, or gone from sensible answer to the question. I don't need antiviruses, it's not about them, I advise you to carefully read the question. - lazaro.Pri commented on April 4th 20 at 00:38
April 4th 20 at 00:37
How to end all svchost processes, except system?
Just to complete it. They all system.
Not the system in principle can not be.
Ndoug such nonsense... any file *.exe you can take and rename svchost.exe and run, it will become the system do? People sometimes do not understand what you write, don't get all think, apparently fly in the clouds under something... - lazaro.Pri commented on April 4th 20 at 00:40
@lazaro.Pri, Processes svchost.exe run system file services.exe and none other.
This is a system file launching child processes from libraries lying to your system directory.
It may not be systemic. - Audra_Mraz commented on April 4th 20 at 00:43
@Audra_Mraz, Tom, you are off on the wrong foot it seems arose )) I above wrote that any exe can be renamed to svchost.exe and start, folder system32 will not, of course, as any other. Read carefully, and read the topic of the question also. - lazaro.Pri commented on April 4th 20 at 00:46
@lazaro.PriCan, but it will not svchost - Audra_Mraz commented on April 4th 20 at 00:49
@Audra_Mraz, you misunderstood the topic of the question, please read carefully. There it is not about the system processes per se, but about the end of the fake svchost.exe bypassing the system, I kind of did all right. - lazaro.Pri commented on April 4th 20 at 00:52
@Audra_Mraz, although you may be right, it would be better to kill all the process svchost.exe they need the system wouldn't probably stop, or restart immediately. And kill the processes only from the user, it is not an option, as if left svchost.exe runs as a service, then the user relationship he will not have. I've got a Windows simply is not present at the moment, can't check. - lazaro.Pri commented on April 4th 20 at 00:55
April 4th 20 at 00:39
Make where.exe svchost.exe and see wrong, not in the folder system32. Rename it to svchost.delete. After a restart it will not start and you can delete it.
As for limitations of running the file, you can reset the length and make read only.
Constantine, you're the topic of the question generally read? And it is all read? You now write nonsense of some kind, even all the way past... - lazaro.Pri commented on April 4th 20 at 00:42
@lazaro.Pri, specifically and reasonably? Where is the nonsense?
If you know how to best - write the answer.
If you see a clear error specify the error. - Audra_Mraz commented on April 4th 20 at 00:45
@Audra_Mraz, OK, wrote a response exemplary. - lazaro.Pri commented on April 4th 20 at 00:48
April 4th 20 at 00:41
A possible solution, but need to consult a competent expert such as tiffany.Bernha
taskkill /f /fi "USERNAME qe %username%" /im svchost.exe
taskkill /f /fi "USERNAME ne system*" /im svchost.exe

The first option involves what processes are active for the current user without affecting system processes.
The second option does not touch users, beginning with the name of a system, but maybe this option will not work.
Although it may be better to kill all the process svchost.exe they need the system wouldn't probably stop, or restart immediately. Who thinks this? I've got a Windows simply is not present at the moment. And kill the processes only from the user, it is not an option, as if left svchost.exe runs as a service, then the user relationship he will not have. - lazaro.Pri commented on April 4th 20 at 00:44
Not all system services are configured to restart on failure.
Some, apparently very important, are configured to recycle when 1 and 2 fails, the subsequent restart will not be already. - tiffany.Bernha commented on April 4th 20 at 00:47
taskkill /f /fi "USERNAME qe %username%" /im svchost.exe
taskkill /f /fi "USERNAME ne system*" /im svchost.exe

There is no guarantee that the svchost that you need not run under system accounts.
As well as some system svchostы start from the name of the current user - tiffany.Bernha commented on April 4th 20 at 00:50
April 4th 20 at 00:43
I think that one team can not do here.
You can get a list of svchost running with PIDами and by then filter it, removing those that lie in the %SystemRoot%\System32 folder. After that, you can beat the rest in the list of processes PIDу from the list.
tasklist the full path does not print. The full path can be obtained with:
wmic process where "name='svchost.exe'" get Name,ProcessID,ExecutablePath

However for the most part I have svchostов running this command just gives the full path in ExecutablePath (Win10 x64), I assume that this is some kind generated by secondary processes.

Find more questions by tags cmd/batWindows