how to detimine process under the svchost

http://www.bleepingcomputer.com/tutorials/tutorial129.html

Determining the services running under a SVCHOST.EXE process using Task List

For those who like to tinker around in a Windows command prompt/console window, and have Windows XP Pro or Windows 2003, there is a Windows program called tasklist.exe that can be used to list the running processes, and services, on your computer. To use task list to see the services that a particular SVCHOST.EXE process is loading, just follow these steps:

1. Click on the Start button and then click on the Run menu command.

2. In the Open: field type cmd and press enter.

3. You will now be presented with a console window. At the command prompt type tasklist /svc /fi “imagename eq svchost.exe” and press the enter key. You will see a list of the processes on your computer as well as the services that a SVCHOST.EXE process is managing. This can be seen in the image below.

TaskList /svc output

When you are done examining the output, you can type exit and press the enter key to close the console window.

You may also like...