How to identify what's really running as SVCHOST.EXE

What is Svchost.exe?

This is the name of a generic host process for services that are executed from DLL files. Still don’t understand? In English, it mans this:

Simple Explanation

It’s a Windows process that has the same title as other visible processes in the task manager, like “explorer.exe” or “winlogon.exe”, but with the particularity of being generic so that it actually functions as a host for all the services that start from DLL files. Its name is as it is said: svchost, which when you cut it in two you have svc for services and host for host.

Detailed explanation

The svchost.exe file can be found in the %SystemRoot%\System32 folder. Each time Windows starts, the svchost.exe process analyses the “services” section of the registry so that it can build a list of all the services it needs to load. Multiple instances of the svchost.exe can be started, happily living together with each one of these instances containing a unique service or group of services.

If you are curious you can consult these groups of services via the registry editor in the HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost branch.

Each value of the keys that scvhost represents in a group of services will, by consequence, be an instance of svchost.exe. These groups will appear in the form of distinct instances when you view the active processes as you can see from the following screen capture:

As you can see, these instances don’t actually provide you with a lot of information about the services that are running, which can be a little frustrating. Fortunately there is a simpler way of listing the group of services that are executed via the svchost.exe process, which we will look at a little later.

To identify the DLL files that are used by these services, and then the services that are executed from these DLL files, you will need to look at the following tree:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\[name of service in question]\Parameters

In the example above, for the “Nla” service you will see that the DLL being used in ServiceDll is in fact an instance of the mswsock.dll.

So this should explain most things that you will need to know about the svchost.exe file. So, that’s enough blah blah, let’s see what’s next…