Svchost.exe is a process that hosts other Services to perform various functions. There can be multiple instances of svchost.exe running on your computer, with each instance containing different services. We published a post a while back explaining what svchost.exe is and what services are. See our post, Svchost.exe explained and demystified.
In Windows 7, you can use the Task Manager to view which services are running under each instance of svchost.exe. However, in Windows XP, you need to use the Tasklist utility (for Windows XP Professional Edition) or Process Explorer (for Windows XP Home Edition), which is a free program, to view this list of services.
SVCHost.exe in Windows 7
First, we will show you how to view the list of services running under each instance of svchost.exe in Windows 7. Open the Task Manager by right-clicking on the Taskbar and selecting Start Task Manager from the popup menu.
On the Windows Task Manager dialog box, click the Processes tab. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
Initially, only the processes for the current user are visible, and svchost.exe is run by the Windows system. To show the svchost.exe processes, click the Show processes from all users button at the bottom of the dialog box.
Select one of the svchost.exe processes, right-click on it, and select Go to Service(s) from the popup menu.
The Services tab displays the services being run by the selected svchost.exe instance.
To close the Task Manager, select Exit Task Manager from the File menu.
SVCHost.exe in Windows XP Professional
You will notice in Windows XP Professional, in the Task Manager, that there is no Go to Service(s) option when you right-click on an instance of svchost.exe. To see the list of services hosted by each instance of svchost.exe in Windows XP Professional, use the Tasklist.exe console utility.
Select Run from the Start menu.
Enter “cmd.exe” (without the quotes) into the Open edit box and click OK.
Type tasklist /svc >c:\taskList.txt
At the prompt in the command window, type the following line and press Enter:
tasklist /svc > c:\tasklist.txt
Once you are returned to a prompt, type “exit” (again, without the quotes) and press Enter to close the command window.
There is now a tasklist.txt text file on your C: drive. Double-click the filename to open the file in Notepad.
The tasklist.txt file contains the list of processes, their process IDs and the services running under each process, respectively in each column.
To close Notepad, select Exit from the File menu.
Windows XP Home Edition
The Tasklist.exe utility is not available in Windows XP Home Edition. Use the free utility, Process Explorer to view the services running under each instance of svchost.exe.
Download Process Explorer from
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx.
To run Process Explorer, unzip the downloaded file and double-click on the procexp.exe file.
When the Process Explorer License Agreement dialog box displays, read through the agreement and click Agree to close the dialog box.
To find out what services are running for which instances of svchost.exe, just hover your mouse over an instance of svchost.exe and a popup displays, showing you a list of services.
You can also use Process Explorer to kill processes, and even ultimately replace the Task Manager.
You can perform standard Windows shutdown, restart, and logoff tasks using Process Explorer.
To close Process Explorer, select Exit from the File menu.
WARNING: There have been viruses circulating in the past that use the same name as svchost.exe. The legitimate version of svchost.exe is present in the %windir%\system32 directory, “%windir%” indicating the windows directory for your version of Windows.
by Lori Kaufman