Default SVCHOST.exe associated services, users and processes

Default SVCHOST.exe associated services, users and processes

Svchost.exe

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

Why Are There So Many svchost.exes Running?

If you’ve ever taken a look at the Services section in control panel you might notice that there are a lot of services required by Windows. If every single service ran under a single svchost.exe instance, a failure in one might bring down all of Windows… so they are separated out.

Those services are organized into logical groups, and then a single svchost.exe instance is created for each group. For instance, one svchost.exe instance runs the 3 services related to the firewall. Another svchost.exe instance might run all the services related to the user interface, and so on. (htt1)

List of process, Service, Description and Users

S#	Process	Services	Description	Users
1	Svchost.exe	power	power	system
		PlugPlay	Plug and play	system
		DcomLaunch	Dcom server process launcher	System
2	Svchost.exe	RpcSs	Remote procedure calls	Network service
		RpcEptMapper	RPC Endpoint mapper	Network service
3	Svchost.exe	wscsvc	Security center	LocalServiceNetworkRestrict
		lmhost	TCO/IP NetBIOS helper	LocalServiceNetworkRestrict
		Event log	Window event log	LocalServiceNetworkRestrict
		Dhcp	DHCP client	LocalServiceNetworkRestrict
		Audiosrv	Window audio	LocalServiceNetworkRestrict
4	Svchost.exe	UxSms	Desktop Window Manager Session Manager	LocalSystemNetworkRestrict
		UmRdpService	Remote Desktop Services User Mode Port Redirector	LocalSystemNetworkRestrict
		TrkWks	Distributed link tracking client	LocalSystemNetworkRestrict
		TableInputService	Tablet PC Input Service	LocalSystemNetworkRestrict
		SysMain	SuperFetch	LocalSystemNetworkRestrict
		PcaSvc	Program Compatibility Assistance service	LocalSystemNetworkRestrict
		Netman	Network Connection	LocalSystemNetworkRestrict
		CScService	Offline Files	LocalSystemNetworkRestrict
5.	Svchost.exe	wuauserv	Window update	system
		Winmgmt	Window Management Instrumentation	system
		Themes	themes	system
		ShellHWDetection	Shell hardware Detection	System
		SessionEnv	Remote desktop configuration	system
		SENS	System Event Notification	system
		Schedule	Task Schedule	system
6.	Svchost.exe	WdiServiceHost	Diagnostic Service Host	Local Services
		W32Time	Window Time	LocalServices
		sppuinotify	SPP Notification Service	LocalServices
		nsi	Network Store InterFace Service	LocalServices
		netprofm	Network List Service	LocalServices
		EventSystem	COM+Event System	LocalService
7.	Svchost.exe	Remote Desktop Services	Remote Desktop Services	NetworkService
		NlaSvc	Network Location Awarness	NetworkService
		LanManWorkstation	workstation	NetworkService
		Dnscache	DNS client	NetworkService
		CrypSvc	Cryptographic Services	NetworkService
8	Svchost.exe	FontCache	Window Font Cache Service	NetworkService
9	Svchost.exe	MpsSvc	Window Firewall	LocalServiceNoNetwork
		DPS	Diagonastic Policy Service	LocalServiceNoNetwork
		BFE	Base Filtering Engine	LocalServiceNoNetwork
10	Svchost.exe	SDRSVC	Windows Backup	system
11	Svchost.exe	Policy Argent	IPsec Policy Agent	LocalSystemNetworkRestrict

Bibliography

(n.d.). Retrieved from http://www.howtogeek.com/howto/windows-vista/what-is-svchostexe-and-why-is-it-running/

 AUTHOR:

Lubna Shamsher

Read More

Solved: McAfee Host Data Loss Prevention Missing "RUN CLIENT TASK" option in Server Task

Solved: McAfee Host Data Loss Prevention Missing "RUN CLIENT TASK" option in Server Task

When we create a New Query for DLP and try to create a server task to lets suppose deploy DLP Agents on systems that have particular tag, for that we need to have the following:

1. Create a Query to filter machines with specific tag
2. Create Server task and select the query created in the first step
3. In Sub-Action select RUN CLIENT TASK NOW option to deploy DLP agents.

While we observer that only 3 options were showing instead of many options that should have been present.

but we have figured out that the option was missing as shown in the first figure, we did alotttttttttt of testing multiple creating queries and thanks to Mark from Mcafee DLP we were able to find out the cause.

SOLUTION

The RUN CLIENT TASK NOW options and many other options will only and only show when while creating the Queries, we select the Chart Type as "TABLE"

we selected this option for the chart type and were able to see RUN CLIENT TASK NOW option.

Read More

Deleting Events in MacAfee Host Data Loss Prevention (HDLP)

How to Delete Events in MacAfee Host Data Loss Prevention (HDLP)

1. GO TO DLP POLICY MANAGER

To verify that the events have been deleted, i am running the client task manually created to check the violations of Email Protection Rule.

There were many events coming up, after flushing the macafee DLP events as shown above, the entries were flushed.

Read More