Which svchost

The problem is, some virus disables the Windows Task Manager by changing a registry value and it is important to know other methods of identifying the svchost. Another method to reveal the service that is associated with the svchost. In command prompt, type the command below, hit enter and the service name will be displayed at the right side of the tasklist output. There are some limitations in using the tasklist.

Just like Task Manager, command prompt too can be disabled from running by malware which is why sometimes it is good to have third party tools in hand.

Process Explorer is the grandfather of all task managers. So far it seems to be the most comprehensive tool to control and view the information associated with svchost. Simply double click on the svchost. You are also able to configure the permissions for the service plus stopping, restarting, pausing and resuming the service. Download Process Explorer. Process Hacker is another popular free and powerful open source task manager that is capable of showing and controlling the services from svchosts.

Just like Process Explorer, double click on svchost. The list of associates services is shown and you can stop or pause the service. Double clicking on the service will bring up a more advanced property window to configure the permissions, startup type, error control and many more. Download Process Hacker. Svchost Process Analyzer is a free and portable program that analyzes the svchost. Clicking on any ID on the top window will display the services at the bottom together with the DLL file and status.

The description of the service will automatically refresh and shown at the top bar of the program. EXE process. EXE process is controlling on your computer. EXE process using Task List. EXE process is loading, just follow these steps:. Click on the Start button and then click on the Run menu command. You will now be presented with a console window. EXE process is managing. This can be seen in the image below. When you are done examining the output, you can type exit and press the enter key to close the console window.

To start, simply start the task manager by right clicking on the task bar and then selecting Task Manager. When Task Manager opens click on the Processes tab. You will now be presented with a list of processes that your user account has started as shown in the image below. Windows 7's Current User Processes. We, though, need to see all of the processes running on the computer. To do this click on the button labeled Show All Processes. When you do this, Windows may prompt you to allow authorization to see all the processes as shown below.

Show all Processes Confirmation. Press the Continue button and the Task Manager will reload, but this time showing all the processes running in the operating system. All Windows 7 Processes. You will now see a list of services on your computer with the services that are running under this particular SVCHOST process highlighted. EXE process in Windows 8. This will open the basic Task Manager as shown in the screenshot below. Scroll down until you see the Windows Processes category and look for the Service Host entries as shown in the image below.

Next to each Service Host row process will be a little arrow. Click on this arrow to expand that particular Service Host entry to see what services are running under it. Under the expanded Service Host, you will now see the list of services that is running under it. These groups are determined by the settings in the following Windows Registry key:.

Under this key are a set of values that group various services together under one name. Below you will see standard groups found in XP Pro. Each of the service names in these groups corresponds to a service entry under the Windows Registry key:. Under each of these service entries there is a Parameters subkey that contains a ServiceDLL value which corresponds to the DLL that is used to run the service.

When Windows loads it begins to start services that are set to enabled and have an automatic startup. When Windows attempts to start one of these types of services and there is currently not a svchost instance running for that services group, it will create a new SVCHOST instance and then load the DLL associated with the service.

If on the other hand, there is already a SVCHOST process running for that group it will just load the new service using that existing process. An example would be:. This will generate a list of all running processes, pass that list to the find command and filter to only show the svchost. If you want to output this to a text file, use the following command:. Finally, you can use a third-party program from Microsoft called Process Explorer.

Just download it, unzip it and run the EXE file. There is no need to install anything, which is convenient. Click on the header for the Process column to sort the list of processes and then scroll down till you see svchost. Go ahead and hover your mouse over any process and it will show you the services that are associated with that process. So those are a couple of simple and easy ways to learn more about the svchost. Founder of Help Desk Geek and managing editor. He began blogging in and quit his job in to blog full-time.

He has over 15 years of industry experience in IT and holds several technical certifications. Read Aseem's Full Bio. We hate spam too, unsubscribe at any time.