Determining which services are linked within a Svchost.exe process

[Elliot B.]

There are various Svchost.exe processes running on any Windows XP/Vista system.

Svchost.exe is a generic host process name for services that run from dynamic-link libraries (DLLs) within modern versions of the Microsoft Windows operating system.

How can I find out which proesses are running within any certain Svchost.exe host service?

[Argi]

Could try the Sysinternals Process Explorer. I think that provides detailed information.

[+Biscuits Brown MVC]

You could also open an elevated command prompt and type

tasklist /svc

[night_stalker_z]

  chAos972 said:

Could try the Sysinternals Process Explorer. I think that provides detailed information.

I agree. It provides a tree view of the processes and its does more than the Task Manager.

[HeartsOfWar]

  Tempus said:

You could also open an elevated command prompt and type

tasklist /svc

(Y)

does what you need without having to download or install anything extra

[Elliot B.]

  HeartsOfWar said:

(Y)

does what you need without having to download or install anything extra

Agreed. Cheers for that guys (Y)

[Brandon Live Veteran]

On Vista you can right-click on a process in Task Manager and select "Go To Service(s)." This will take you to the services tab with the services running in that process selected.

[Elliot B.]

  Brandon Live said:

On Vista you can right-click on a process in Task Manager and select "Go To Service(s)." This will take you to the services tab with the services running in that process selected.

Ah, very useful! (Y)

[MAyers]

It is a very useful command, but it still lists a bunch of services for one instance of svchost.

I have to admit it's a very confusing service for me.?Here's?my?list....

[Elliot B.]

  MAyers said:

It is a very useful command, but it still lists a bunch of services for one instance of svchost.

I have to admit it's a very confusing service for me. Here's my list....

This may help you.

[MAyers]

Useful, but still not cystal clear. Here's a quote from your source on Wiki. It does

provide a compliment to the command the other gentleman showed us.

This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in Windows XP Professional can run the following command at the system prompt to get a breakdown:

C:\>tasklist /svc /fi "imagename eq svchost.exe"

[+Biscuits Brown MVC]

  MAyers said:

It is a very useful command, but it still lists a bunch of services for one instance of svchost.

I have to admit it's a very confusing service for me. Here's my list....

What that is showing your is that svchost with process id of 1440 is responsible for running the 19 services listed. If you kill that process, those services will stop. If you do not need the dnscache for instance, kill svchost proc ID 1532.

[Linkinfamous]

  Tempus said:

What that is showing your is that svchost with process id of 1440 is responsible for running the 19 services listed. If you kill that process, those services will stop. If you do not need the dnscache for instance, kill svchost proc ID 1532.

Going around and killing svchost processes is completely the wrong way to go about doing it. End the service, instead. That way, the service gets a chance to shut itself down.

[MAyers]

Agreed. We were just talking about the svchost process and how it clumps together processes, which makes it difficult at times to work with.

A lot of times you'll see a svchost error but can't tell which process is really the culprit. Or a piece of spyware might attach itself to the svchost

process and try to hide within the clump of services. Just not as straight forward as some of the other services.