BleepingComputer.com: How to determine what services are running under a SVCHOST.EXE process

A new tutorial titled How to determine what services are running under a SVCHOST.EXE process was added by Bleeping Computer. Please use this topic to discuss any aspect of this tutorial.

A brief excerpt of the tutorial can be found here:


A very common question we see here at Bleeping Computer involves people concerned
that there are too many SVCHOST.EXE processes running on their computer. The
confusion typically stem from a lack of knowledge about SVCHOST.EXE, its purpose,
and Windows services in general. This tutorial will clear up this confusion
and provide information as to what these processes are how to find out more
information about them. Before we continue learning about SVCHOST, lets get
a small primer on Windows services.
Services are Windows programs that start when Windows loads and that continue
to run in the background without interaction from the user. For those familiar
with Unix/Linux operating systems, Windows servers are similar to *nix daemons.
For the most part Windows services are executable (.EXE) files, but some services
are DLL files as well. As Windows has no direct way of executing a DLL file
it needs a program that can act as a launcher for these types of programs. In
this situation, the launcher for DLL services is SVCHOST.EXE, otherwise known
as the Generic Host Process for Win32 Services. Each time you
see a SVCHOST process, it is actually a process that is managing one or more
distinct Windows DLL services.
Below I have outlined three methods, depending on your Windows version, to
see what services a SVCHOST.EXE process is controlling on your computer. I have
also included some advanced technical knowledge about svchost for those who
are interested.


We hope you find this tutorial helpful.

The Bleeping Computer Staff

I thank you Bleeping Computer for this tutorial. I've been trying to figure out EXACTLY which program was running the svchost.exe process, and now I know. I've been using Process Explorer, but I still couldn't pin-point exactly which program was responsible for each given process of the svchost.exe.

I'll never forget you guys/gals here because of this info. It's well documented and it has made me that much more informative of computers and how they operate.

Everyone needs this tutorial. It's a gold mine. It's very informative. You've taken my guesswork out of this mystery, which haunted me for the longest time. I'll always remember where I learned the real deal about the svchost.exe process. I love you all for this. I'm like a child right now with a new toy. This information means that much to me, and if you know what I know, you'll want to know about it too.

Keep up the excellent work Bleeping Computer.

i have a question,,wat if i have deleted the svchost.exe file?,,how can i retrieved that svchost,,

lol thank you for explaining what an svhost is because one time i ended one and i was like raar

Great tutorial. I enjoyed the read.
*Cheers*

Curry = New Member

I have a question.
svchost.exe has 8 attributes: -k LocalService, -k netsvc, -k DComLaunch, -k NetworkService, k- rpcss, -kbdx, -k imgsvc, -k wudfServiceGroup.
I`d assume there`s only 8 possible groups. Which attribute runs the 9th group? Or, have I missed the point?
Istra

Very nice tutorial. I have always seen the SVCHOST.exe processes running in the background, but never knew what they were or how to check what services they were running. Thanks BC!