How to determine what services are running under a SVCHOST.EXE process Options

[TutorialBot]

A new tutorial titled How to determine what services are running under a SVCHOST.EXE process was added by Bleeping Computer. Please use this topic to discuss any aspect of this tutorial.

A brief excerpt of the tutorial can be found here:


A very common question we see here at Bleeping Computer involves people concerned
that there are too many SVCHOST.EXE processes running on their computer. The
confusion typically stem from a lack of knowledge about SVCHOST.EXE, its purpose,
and Windows services in general. This tutorial will clear up this confusion
and provide information as to what these processes are how to find out more
information about them. Before we continue learning about SVCHOST, lets get
a small primer on Windows services.
Services are Windows programs that start when Windows loads and that continue
to run in the background without interaction from the user. For those familiar
with Unix/Linux operating systems, Windows servers are similar to *nix daemons.
For the most part Windows services are executable (.EXE) files, but some services
are DLL files as well. As Windows has no direct way of executing a DLL file
it needs a program that can act as a launcher for these types of programs. In
this situation, the launcher for DLL services is SVCHOST.EXE, otherwise known
as the Generic Host Process for Win32 Services. Each time you
see a SVCHOST process, it is actually a process that is managing one or more
distinct Windows DLL services.
Below I have outlined three methods, depending on your Windows version, to
see what services a SVCHOST.EXE process is controlling on your computer. I have
also included some advanced technical knowledge about svchost for those who
are interested.


We hope you find this tutorial helpful.

The Bleeping Computer Staff