Comments on: Identify Loaded SVCHOST.EXE in Windows Task List

By: Pat

Pat — Thu, 16 Feb 2012 13:51:00 +0000

Exelence! thanks so much!

By: Robert

Robert — Mon, 22 Dec 2008 03:18:52 +0000

It\\\’s been a while since this article was written, but as of Dec 2008, you can easily discover process ID in task manager. It is a column you can add to the display under the View menu on the process tab.
Malware often lists rubbish or N/A in the tasklist report in dos. So, once you know which svchost.exe items are reporting rubbish, it\\\’s easy to correlate them to the bad boys in task manager.

By: Arek

Arek — Fri, 18 Jul 2008 17:00:49 +0000

More interesting would be the process with PID 1232. DNS Client in this case is obvious.

By: Simon

Simon — Sun, 18 May 2008 17:07:35 +0000

Thanks for sharing this. But, how can we remove the svchost.exe file ?

By: Sam Ahmed

Sam Ahmed — Wed, 21 Nov 2007 16:08:27 +0000

Hey Raymond i would like to add a tricky part

if your service host which is called SVCHOST.EXE loaded more than 25,000kb it means that it is sending (hosting) out something but if less thats okay .

in easy words if your svchost.exe has high Mem Usage over 25,000kb kill it.

By: j.Smith

j.Smith — Wed, 21 Nov 2007 10:15:06 +0000

Thanks Ray

By: Identify Loaded rundll32.exe in Windows Task List » Raymond.CC Blog

Identify Loaded rundll32.exe in Windows Task List » Raymond.CC Blog — Wed, 21 Nov 2007 08:00:33 +0000

[...] I’ve written a guide on how to identify svchost.exe in your Windows and here’s another process that might be showing in your Windows Task List but you [...]