In tip 2060, I explained the Svchost process in Windows 2000.

In tip 4310, you can see multiple Svchost processes in Windows XP.

%SystemRoot%\System32\Svchost.exe is a generic process name for services that run from dynamic-link libraries (DLLs). When you start Windows XP, Svchost,exe constructs multiple lists of service groupings that need to be loaded. Each instance can run at the same time. Svchost,exe groups are delineated at:


Each Value Name contains a list of included serviceDLL values, in a REG_MULTI_SZ data type. These servies are extracted from HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\.

To see the list of active services in each process, open a CMD prompt and Type:

Tasklist /SVC

The following was displayed from one of my Windows XP Professional computers:

Image Name                   PID Services

= =============================================
System Idle Process            0 N/A
System                         4 N/A
smss.exe                     372 N/A
csrss.exe                    484 N/A
winlogon.exe                 512 N/A
services.exe                 572 Eventlog, PlugPlay
lsass.exe                    584 Netlogon, PolicyAgent, ProtectedStorage,
svchost.exe                  748 RpcSs
svchost.exe                  816 AudioSrv, Browser, CryptSvc, Dhcp, dmserver,
                                 ERSvc, EventSystem, helpsvc, lanmanserver,
                                 lanmanworkstation, Messenger, Netman, Nla,
                                 Schedule, seclogon, SENS, ShellHWDetection,
                                 srservice, TermService, Themes, TrkWks,
                                 uploadmgr, W32Time, winmgmt, WmdmPmSp,
                                 wuauserv, WZCSVC
svchost.exe                  920 Dnscache
svchost.exe                  964 Alerter, LmHosts, RemoteRegistry, SSDPSRV,
spoolsv.exe                 1048 Spooler
explorer.exe                1328 N/A
TaskSwitch.exe              1484 N/A
taskmgr.exe                 1512 N/A
point32.exe                 1536 N/A
msmsgs.exe                  1560 N/A
fastkey.exe                 1568 N/A
IEXPLORE.EXE                1580 N/A
prntscrn.exe                1596 N/A
SetiSpy.exe                 1604 N/A
setiathome-3.03.i386-winn   1676 N/A
svchost.exe                 1828 stisvc
UdServe.exe                 1852 UndeleteService
Fast.exe                    1984 InteractiveLogon
dllhost.exe                 1224 COMSysApp
msdtc.exe                   1208 MSDTC
wmiprvse.exe                3056 N/A
cmd.exe                     3428 N/A
tasklist.exe                3460 N/A
The matching registry entries are:
Key Name:          SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost
Name:            imgsvc
Type:            REG_MULTI_SZ
Data:            StiSvc
Name:            LocalService
Type:            REG_MULTI_SZ
Data:            Alerter
Name:            netsvcs
Type:            REG_MULTI_SZ
Data:            6to4
Name:            NetworkService
Type:            REG_MULTI_SZ
Data:            DnsCache
Name:            rpcss
Type:            REG_MULTI_SZ
Data:            RpcSs
Name:            termsvcs
Type:            REG_MULTI_SZ
Data:            TermService