When you look at the taskmanager you’ll see several svchost processes. If you want to know what a specific svchost process does keep on reading…
Use the CLI command “tasklist /svc” to see it’s corresponding PID
c:> tasklist /SVC
svchost.exe 744 DcomLaunch, PlugPlay
svchost.exe 804 RpcSs
svchost.exe 836 Dhcp, Eventlog, lmhosts, wscsvc
svchost.exe 964 AeLookupSvc, Appinfo, CertPropSvc, gpsvc,
LanmanServer, MMCSS, ProfSvc, Schedule,
seclogon, SENS, SessionEnv, Winmgmt,
PID 744 for example started the services DcomLaunch and PlugPlay.
Now we need cmdline, a nice little tool by diamondcs. It displays the start parameter for each running process:
744 - C:Windowssystem32svchost.exe
C:Windowssystem32svchost.exe -k DcomLaunch
Process with PID 744 was started with the “-k DcomLaunch” parameter. When you check the registry key
you will see a string value called DcomLaunch. It’s data value contains all services this specific svchost service load. You can now modify the which services are loaded an which aren’t.