From: https://www.raymond.cc/blog/identify-loaded-svchostexe-in-windows-task-list/
Other than commonly using the Windows Task Manager to end a hung task or process, it is also very useful to quickly check the active running programs on your computer. You may noticed that there is quite a number of svchost.exe listed in the processes tab and is probably wondering what is it and how come there are so many of them running? Basically SVCHOST is used by Windows to run multiple Windows services and the reason why Windows services uses svchost.exe to run is because they are in DLL files and not an independent executable (.EXE) file. If you didn’t know, Windows Services is one of the startup method in Windows where it can automatically run in background without even requiring the user to login to their account in Windows, unlike other startup method where the programs will only run when the user is logged in to Windows.
Normally users would ignore the existence of svchost.exe listed in the Windows Task Manager and only look for some dubious image name. This is where some malware takes advantage by using the file name as svchost.exe, hoping that you would not notice its presence. One easy way to find out a suspicious svchost.exe is by looking at the user name that is used to run the svchost.exe. If the svchost is ran by SYSTEM, NETWORK SERVICE or LOCAL SERVICE, then it should be legitimate but if it is ran under YOUR user account, then you need to investigate if the svchost.exe file is from another location than C:\Windows\System32\. If you’d like to identify the services that are ran behind the svchost.exe, here are 7 ways to do it. 1. Windows Task Manager
Starting from Windows Vista, Microsoft has made it easy because the Task Manager is capable of showing you the service name associated with the svchost.exe process. To run windows Task Manager, right click on the task bar and select “Start Task Manager”. Alternatively you can also simultaneously press Ctrl+Shift+Esc. Then all you need to do is right click on the svchost.exe process and select “Go to Service(s)” where you will automatically jump to the Services tab and the service name being highlight.
You are able to start or stop the service by right clicking on the service name. The problem is, some virus disables the Windows Task Manager by changing a registry value and it is important to know other methods of identifying the svchost.exe service name.
2. Command Prompt
Another method to reveal the service that is associated with the svchost.exe is by using tasklist.exe from command prompt. In command prompt, type the command below, hit enter and the service name will be displayed at the right side of the tasklist output.
tasklist /svc /fi “IMAGENAME eq svchost.exe”
There are some limitations in using the tasklist.exe command line tool because it only the cryptic service name, not the display name or description. Just like Task Manager, command prompt too can be disabled from running by malware which is why sometimes it is good to have third party tools in hand.
3. Process Explorer
Process Explorer is the grandfather of all task managers. So far it seems to be the most comprehensive tool to control and view the information associated with svchost.exe. Simply double click on the svchost.exe in Process Explorer and click on the Services tab.
First you get to see all the services registered in the process that you’re viewing, then it shows the service name, display name and the path to do DLL file that was loaded. You are also able to configure the permissions for the service plus stopping, restarting, pausing and resuming the service.
4. Process Hacker
Process Hacker is another popular free and powerful open source task manager that is capable of showing and controlling the services from svchosts.exe process. Just like Process Explorer, double click on svchost.exe process and go to the Services tab. The list of associates services is shown and you can stop or pause the service. Double clicking on the service will bring up a more advanced property window to configure the permissions, startup type, error control and many more.
There are both installer and portable versions available including 32-bit and 64-bit builds.
5. Svchost Process Analyzer
Svchost Process Analyzer is a free and portable program that analyzes the svchost.exe and shows services that is associated with the process. Clicking on any ID on the top window will display the services at the bottom together with the DLL file and status. The description of the service will automatically refresh and shown at the top bar of the program. This tool can only display information but lack of control options.
Download Svchost Process Analyzer
6. Svchost Viewer
Svchost Viewer is another free and open source utility hosted at CodePlex that gives you the basic information such as service name and description. There are also two checkboxes to show if the service can be paused or stopped. If it can be stopped, click on the Service Control menu bar and select “Stop Selected Service”. A piece of interesting information shown in Svchost Viewer is the amount of data written and read.
7. Services In Svchost
Services In Svchost is a very simple program that simply shows the services in the svchosts.exe. There is no description, no control, or DLL file information. The only unique feature found in this utility is the ability to view the services on remote computers by entering the computer name or IP address.
There are requirements if you want to get the services on remote computer. Firstly it requires a user account that has a password set (empty password is not allowed) and the Remote Registry service must be manually started. Make sure the Windows Firewall is not blocking the connection. Once all this 3 requirements are met, you need to manually authenticate with the remote computer by accessing the shared folders. After authentication, simply enter the computer name and click Get Services button.
Download Services In Svchost
Read More: https://www.raymond.cc/blog/identify-loaded-svchostexe-in-windows-task-list/
1,580 total views
