Default SVCHOST.exe associated services, users and processes
Svchost.exe
Some time ago, Microsoft started moving
all of the functionality from internal Windows services into .dll files instead
of .exe files. From a programming perspective this makes more sense for
reusability… but the problem is that you can’t launch a .dll file directly from
Windows, it has to be loaded up from a running executable (.exe). Thus the
svchost.exe process was born.
Why Are There So Many svchost.exes Running?
If you’ve ever taken a look at the Services section in
control panel you might notice that there are a lot of services required by
Windows. If every single service ran under a single svchost.exe instance, a
failure in one might bring down all of Windows… so they are separated out.
Those services are organized into logical groups, and
then a single svchost.exe instance is created for each group. For instance, one
svchost.exe instance runs the 3 services related to the firewall. Another
svchost.exe instance might run all the services related to the user interface,
and so on. (htt1)
List
of process, Service, Description and Users
S#
|
Process
|
Services
|
Description
|
Users
|
1
|
Svchost.exe
|
power
|
power
|
system
|
|
|
PlugPlay
|
Plug
and play
|
system
|
|
|
DcomLaunch
|
Dcom
server process launcher
|
System
|
2
|
Svchost.exe
|
RpcSs
|
Remote
procedure calls
|
Network
service
|
|
|
RpcEptMapper
|
RPC
Endpoint mapper
|
Network
service
|
3
|
Svchost.exe
|
wscsvc
|
Security
center
|
LocalServiceNetworkRestrict
|
|
|
lmhost
|
TCO/IP
NetBIOS helper
|
LocalServiceNetworkRestrict
|
|
|
Event
log
|
Window
event log
|
LocalServiceNetworkRestrict
|
|
|
Dhcp
|
DHCP
client
|
LocalServiceNetworkRestrict
|
|
|
Audiosrv
|
Window
audio
|
LocalServiceNetworkRestrict
|
4
|
Svchost.exe
|
UxSms
|
Desktop
Window Manager Session Manager
|
LocalSystemNetworkRestrict
|
|
|
UmRdpService
|
Remote
Desktop Services User Mode Port Redirector
|
LocalSystemNetworkRestrict
|
|
|
TrkWks
|
Distributed
link tracking client
|
LocalSystemNetworkRestrict
|
|
|
TableInputService
|
Tablet
PC Input Service
|
LocalSystemNetworkRestrict
|
|
|
SysMain
|
SuperFetch
|
LocalSystemNetworkRestrict
|
|
|
PcaSvc
|
Program
Compatibility Assistance service
|
LocalSystemNetworkRestrict
|
|
|
Netman
|
Network
Connection
|
LocalSystemNetworkRestrict
|
|
|
CScService
|
Offline
Files
|
LocalSystemNetworkRestrict
|
5.
|
Svchost.exe
|
wuauserv
|
Window
update
|
system
|
|
|
Winmgmt
|
Window
Management Instrumentation
|
system
|
|
|
Themes
|
themes
|
system
|
|
|
ShellHWDetection
|
Shell
hardware Detection
|
System
|
|
|
SessionEnv
|
Remote
desktop configuration
|
system
|
|
|
SENS
|
System
Event Notification
|
system
|
|
|
Schedule
|
Task
Schedule
|
system
|
6.
|
Svchost.exe
|
WdiServiceHost
|
Diagnostic
Service Host
|
Local
Services
|
|
|
W32Time
|
Window
Time
|
LocalServices
|
|
|
sppuinotify
|
SPP
Notification Service
|
LocalServices
|
|
|
nsi
|
Network
Store InterFace Service
|
LocalServices
|
|
|
netprofm
|
Network
List Service
|
LocalServices
|
|
|
EventSystem
|
COM+Event
System
|
LocalService
|
7.
|
Svchost.exe
|
Remote
Desktop Services
|
Remote
Desktop Services
|
NetworkService
|
|
|
NlaSvc
|
Network
Location Awarness
|
NetworkService
|
|
|
LanManWorkstation
|
workstation
|
NetworkService
|
|
|
Dnscache
|
DNS
client
|
NetworkService
|
|
|
CrypSvc
|
Cryptographic
Services
|
NetworkService
|
8
|
Svchost.exe
|
FontCache
|
Window
Font Cache Service
|
NetworkService
|
9
|
Svchost.exe
|
MpsSvc
|
Window
Firewall
|
LocalServiceNoNetwork
|
|
|
DPS
|
Diagonastic
Policy Service
|
LocalServiceNoNetwork
|
|
|
BFE
|
Base
Filtering Engine
|
LocalServiceNoNetwork
|
10
|
Svchost.exe
|
SDRSVC
|
Windows
Backup
|
system
|
11
|
Svchost.exe
|
Policy
Argent
|
IPsec
Policy Agent
|
LocalSystemNetworkRestrict
|
|
|
|
|
|
Bibliography
(n.d.). Retrieved from
http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/
AUTHOR: