When you look at the taskmanager you’ll see several svchost processes. If you want to know what a specific svchost process does keep on reading…
Use the CLI command “tasklist /svc” to see it’s corresponding PID
1 2 3 4 5 6 7 8 9 10 | c:> tasklist /SVC … svchost.exe 744 DcomLaunch, PlugPlay svchost.exe 804 RpcSs svchost.exe 836 Dhcp, Eventlog, lmhosts, wscsvc svchost.exe 964 AeLookupSvc, Appinfo, CertPropSvc, gpsvc, LanmanServer, MMCSS, ProfSvc, Schedule, seclogon, SENS, SessionEnv, Winmgmt, wuauserv … |
PID 744 for example started the services DcomLaunch and PlugPlay.
Now we need cmdline, a nice little tool by diamondcs. It displays the start parameter for each running process:
1 2 3 4 5 | C:> cmdline … 744 — C:Windowssystem32svchost.exe C:Windowssystem32svchost.exe –k DcomLaunch … |
Process with PID 744 was started with the “-k DcomLaunch” parameter. When you check the registry key
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvchost
you will see a string value called DcomLaunch. It’s data value contains all services this specific svchost service load. You can now modify the which services are loaded an which aren’t.