In tip 2060, I explained the Svchost process in Windows 2000.

In tip 4310, you can see multiple Svchost processes in Windows XP.

%SystemRoot%\System32\Svchost.exe is a generic process name for services that run from dynamic-link libraries (DLLs). When you start Windows XP, Svchost,exe constructs multiple lists of service groupings that need to be loaded. Each instance can run at the same time. Svchost,exe groups are delineated at:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Svchost.

Each Value Name contains a list of included serviceDLL values, in a REG_MULTI_SZ data type. These servies are extracted from HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\.

To see the list of active services in each process, open a CMD prompt and Type:

Tasklist /SVC

The following was displayed from one of my Windows XP Professional computers:

Image Name                   PID Services
====================

= ============================================= System Idle Process 0 N/A System 4 N/A smss.exe 372 N/A csrss.exe 484 N/A winlogon.exe 512 N/A services.exe 572 Eventlog, PlugPlay lsass.exe 584 Netlogon, PolicyAgent, ProtectedStorage, SamSs svchost.exe 748 RpcSs svchost.exe 816 AudioSrv, Browser, CryptSvc, Dhcp, dmserver, ERSvc, EventSystem, helpsvc, lanmanserver, lanmanworkstation, Messenger, Netman, Nla, Schedule, seclogon, SENS, ShellHWDetection, srservice, TermService, Themes, TrkWks, uploadmgr, W32Time, winmgmt, WmdmPmSp, wuauserv, WZCSVC svchost.exe 920 Dnscache svchost.exe 964 Alerter, LmHosts, RemoteRegistry, SSDPSRV, WebClient spoolsv.exe 1048 Spooler explorer.exe 1328 N/A TaskSwitch.exe 1484 N/A taskmgr.exe 1512 N/A point32.exe 1536 N/A msmsgs.exe 1560 N/A fastkey.exe 1568 N/A IEXPLORE.EXE 1580 N/A prntscrn.exe 1596 N/A SetiSpy.exe 1604 N/A setiathome-3.03.i386-winn 1676 N/A svchost.exe 1828 stisvc UdServe.exe 1852 UndeleteService Fast.exe 1984 InteractiveLogon dllhost.exe 1224 COMSysApp msdtc.exe 1208 MSDTC wmiprvse.exe 3056 N/A cmd.exe 3428 N/A tasklist.exe 3460 N/A
The matching registry entries are:
Key Name:          SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
  Name:            imgsvc
  Type:            REG_MULTI_SZ
  Data:            StiSvc
                   
  Name:            LocalService
  Type:            REG_MULTI_SZ
  Data:            Alerter
                   WebClient
                   LmHosts
                   RemoteRegistry
                   upnphost
                   SSDPSRV
                   
  Name:            netsvcs
  Type:            REG_MULTI_SZ
  Data:            6to4
                   AppMgmt
                   AudioSrv
                   Browser
                   CryptSvc
                   DMServer
                   DHCP
                   ERSvc
                   EventSystem
                   FastUserSwitchingCompatibility
                   HidServ
                   Ias
                   Iprip
                   Irmon
                   LanmanServer
                   LanmanWorkstation
                   Messenger
                   Netman
                   Nla
                   Ntmssvc
                   NWCWorkstation
                   Nwsapagent
                   Rasauto
                   Rasman
                   Remoteaccess
                   Schedule
                   Seclogon
                   SENS
                   Sharedaccess
                   SRService
                   Tapisrv
                   Themes
                   TrkWks
                   W32Time
                   WZCSVC
                   Wmi
                   WmdmPmSp
                   winmgmt
                   TermService
                   wuauserv
                   BITS
                   ShellHWDetection
                   helpsvc
                   uploadmgr
                   
  Name:            NetworkService
  Type:            REG_MULTI_SZ
  Data:            DnsCache
                   
  Name:            rpcss
  Type:            REG_MULTI_SZ
  Data:            RpcSs
                   
  Name:            termsvcs
  Type:            REG_MULTI_SZ
  Data:            TermService