Fix Svchost Errors

Standard Vista Services

[ERROR_SELECT]

This is a list of svchost.exe services I got from a malware clean Vista computer. If any of your svchost.exe services is not in this list you should double check it for malware.

I got this table by running following code on my Windows Vista 32 bit machine.

This code outputs service group extracted from ImagePath registry key, description extracted from service file, service executable extracted from DisplayName and full path to service binary.

Application Experience Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeTcbPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\aelupsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc
IIS Resource DLL
Svchost Group apphost Privileges
Svchost Command C:\Windows\system32\svchost.exe -k apphost SeChangeNotifyPrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\inetsrv\iisres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppHostSvc
Application Information Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
SeTcbPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\appinfo.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Appinfo
Software installation Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeShutdownPrivilege
SeTakeOwnershipPrivilege
Executable File Name c:\windows\system32\appmgmts.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
Windows Audio Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\audiosrv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder
Windows Audio Service
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
SeIncreaseWorkingSetPrivilege
Executable File Name c:\windows\system32\audiosrv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Audiosrv
Base Filtering Engine
Svchost Group LocalServiceNoNetwork Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork SeAuditPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\bfe.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
Background Intelligent Transfer Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeTcbPrivilege
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
Executable File Name c:\windows\system32\qmgr.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
Computer Browser Service DLL
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs
Executable File Name c:\windows\system32\browser.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser
Bluetooth Support Service
Svchost Group bthsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k bthsvcs
Executable File Name c:\windows\system32\bthserv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BthServ
Microsoft Smartcard Certificate Propagation Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeCreateGlobalPrivilege
SeTcbPrivilege
SeChangeNotifyPrivilege
SeImpersonatePrivilege
SeTakeOwnershipPrivilege
SeSecurityPrivilege
Executable File Name c:\windows\system32\certprop.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertPropSvc
Cryptographic Services
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k NetworkService SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\cryptsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
CSC Service DLL
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeTcbPrivilege
SeImpersonatePrivilege
SeIncreaseBasePriorityPrivilege
Executable File Name c:\windows\system32\cscsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CscService
Ole resource dll
Svchost Group DcomLaunch Privileges
Svchost Command C:\Windows\system32\svchost.exe -k DcomLaunch SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeTcbPrivilege
SeBackupPrivilege
SeRestorePrivilege
Executable File Name c:\windows\system32\oleres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch
DHCP Client Service
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\dhcpcsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
DNS Client API DLL
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k NetworkService SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\dnsapi.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
Wired AutoConfig Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
SeAuditPrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\dot3svc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc
WDI Diagnostic Policy Service
Svchost Group LocalServiceNoNetwork Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeAssignPrimaryTokenPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\dps.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS
Microsoft EAPHost service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeTcbPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\eapsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost
Windows Media Center Service Launcher
Svchost Group LocalServiceNoNetwork Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork SeChangeNotifyPrivilege
Executable File Name c:\windows\ehome\ehstart.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ehstart
ReadyBoost Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\emdmgmt.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMDMgmt
Event Logging Service
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wevtsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
COM+ Resources
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\comres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
WS Discovery Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\fdphost.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost
Function Discovery Resource Publication Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\fdrespub.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FDResPub
Group Policy Client API
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeImpersonatePrivilege
SeTcbPrivilege
SeTakeOwnershipPrivilege
SeIncreaseQuotaPrivilege
SeAssignPrimaryTokenPrivilege
SeSecurityPrivilege
SeChangeNotifyPrivilege
SeCreatePermanentPrivilege
SeShutdownPrivilege
SeLoadDriverPrivilege
SeRestorePrivilege
SeBackupPrivilege
Executable File Name c:\windows\system32\gpapi.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc
HID Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\hidserv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv
Key Management Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\kmsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc
IKE extension
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeAuditPrivilege
SeImpersonatePrivilege
SeTcbPrivilege
SeDebugPrivilege
Executable File Name c:\windows\system32\ikeext.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT
PnP-X IP Bus Enumerator DLL
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeLoadDriverPrivilege
Executable File Name c:\windows\system32\ipbusenum.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum
Service that offers IPv6 connectivity over an IPv4 network.
Svchost Group NetSvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetSvcs SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\iphlpsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc
COM+ Resources
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\comres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm
Server Service DLL
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs
Executable File Name c:\windows\system32\srvsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer
Workstation Service DLL
Svchost Group LocalService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalService
Executable File Name c:\windows\system32\wkssvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
Link-Layer Topology Discovery Resources
Svchost Group LocalService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalService SeImpersonatePrivilege
SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\lltdres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc
TCPIP NetBios Transport Services DLL
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\lmhsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts
Media Center Resources
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
Executable File Name c:\windows\ehome\ehres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mcx2Svc
Multimedia Class Scheduler Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeIncreaseBasePriorityPrivilege
Executable File Name c:\windows\system32\mmcss.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS
Windows Firewall API
Svchost Group LocalServiceNoNetwork Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
Executable File Name c:\windows\system32\firewallapi.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
iSCSI Discovery api
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePermanentPrivilege
SeImpersonatePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\iscsidsc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSiSCSI
Quarantine Agent Service Run-Time
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\qagentrt.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent
Network Connections Manager
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeImpersonatePrivilege
SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\netman.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
Network Profile Management UI
Svchost Group LocalService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalService SeImpersonatePrivilege
SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\netprof.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm
Network Location Awareness 2
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeAuditPrivilege
Executable File Name c:\windows\system32\nlasvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc
Network Store Interface RPC server
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\nsisvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi
Peer-to-Peer Services
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\p2psvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pimsvc
Peer-to-Peer Services
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\p2psvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2psvc
Program Compatibility Assistant Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeDebugPrivilege
Executable File Name c:\windows\system32\pcasvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc
Performance Logs & Alerts
Svchost Group LocalServiceNoNetwork Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork SeImpersonatePrivilege
Executable File Name c:\windows\system32\pla.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla
User-mode Plug-and-Play Service
Svchost Group DcomLaunch Privileges
Svchost Command C:\Windows\system32\svchost.exe -k DcomLaunch SeTcbPrivilege
SeSecurityPrivilege
SeAssignPrimaryTokenPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeImpersonatePrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeDebugPrivilege
Executable File Name c:\windows\system32\umpnpmgr.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
Peer-to-Peer Services
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\p2psvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPAutoReg
Peer-to-Peer Services
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\p2psvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPsvc
Policy Storage dll
Svchost Group NetworkServiceNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\polstore.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
ProfSvc
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\profsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc
Windows NT
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\qwave.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QWAVE
ActiveSync RAPI Manager
Svchost Group WindowsMobile Privileges
Svchost Command C:\Windows\system32\svchost.exe -k WindowsMobile SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\windowsmobile\rapimgr.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RapiMgr
Remote Access AutoDial Manager
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeImpersonatePrivilege
SeTcbPrivilege
SeIncreaseQuotaPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeAssignPrimaryTokenPrivilege
Executable File Name c:\windows\system32\rasauto.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
Remote Access Connection Manager
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeTcbPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeAssignPrimaryTokenPrivilege
Executable File Name c:\windows\system32\rasmans.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
Dynamic Interface Manager
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeChangeNotifyPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeAuditPrivilege
Executable File Name c:\windows\system32\mprdim.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess
Remote Registry Service
Svchost Group regsvc Privileges
Svchost Command C:\Windows\system32\svchost.exe -k regsvc SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\regsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Ole resource dll
Svchost Group rpcss Privileges
Svchost Command C:\Windows\system32\svchost.exe -k rpcss SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\oleres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
Smart Card Resource Management Server
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeCreateGlobalPrivilege
SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\scardsvr.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr
Task Scheduler Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeIncreaseQuotaPrivilege
SeChangeNotifyPrivilege
SeAuditPrivilege
SeImpersonatePrivilege
SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeRestorePrivilege
Executable File Name c:\windows\system32\schedsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
Microsoft Smartcard Certificate Propagation Service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeCreateGlobalPrivilege
SeTcbPrivilege
SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\certprop.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc
MicrosoftВ® Windows Backup Service
Svchost Group SDRSVC Privileges
Svchost Command C:\Windows\system32\svchost.exe -k SDRSVC
Executable File Name c:\windows\system32\sdrsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC
Secondary Logon Service DLL
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeTcbPrivilege
SeRestorePrivilege
SeBackupPrivilege
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\seclogon.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
System Event Notification Service (SENS)
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\sens.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS
Terminal Services Configuration service
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeImpersonatePrivilege
Executable File Name c:\windows\system32\sessenv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SessionEnv
Microsoft NAT Helper Components
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeLoadDriverPrivilege
SeTakeOwnershipPrivilege
Executable File Name c:\windows\system32\ipnathlp.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
Windows Shell Services Dll
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs
Executable File Name c:\windows\system32\shsvcs.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection
Software Licensing UI Notification Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\sluinotify.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SLUINotify
SSDP Service DLL
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\ssdpsrv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV
Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN).
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\sstpsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc
Still Image Devices Service
Svchost Group imgsvc Privileges
Svchost Command C:\Windows\system32\svchost.exe -k imgsvc SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wiaservc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc
MicrosoftВ® Volume Shadow Copy Service software provider
Svchost Group swprv Privileges
Svchost Command C:\Windows\System32\svchost.exe -k swprv SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePermanentPrivilege
SeImpersonatePrivilege
SeManageVolumePrivilege
SeRestorePrivilege
SeIncreaseBasePriorityPrivilege
SeManageVolumePrivilege
SeRestorePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\swprv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv
Superfetch Service Host
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeTcbPrivilege
SeProfileSingleProcessPrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
Executable File Name c:\windows\system32\sysmain.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain
Microsoft Tablet PC Input Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeTcbPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeAssignPrimaryTokenPrivilege
SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\tabsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletInputService
MicrosoftВ® Windows(TM) Telephony Server
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeAssignPrimaryTokenPrivilege
Executable File Name c:\windows\system32\tapisrv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
TBS Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeAuditPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\tbssvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBS
Terminal Server Remote Connections Manager
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
Executable File Name c:\windows\system32\termsrv.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
Windows Shell Services Dll
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeAssignPrimaryTokenPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\shsvcs.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes
Multimedia Class Scheduler Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\mmcss.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER
Distributed Link Tracking Client
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeRestorePrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\trkwks.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
Terminal Server Device Redirector Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeCreatePermanentPrivilege
SeLoadDriverPrivilege
SeDebugPrivilege
Executable File Name c:\windows\system32\umrdp.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmRdpService
UPnP Device Host
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\upnphost.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost
Desktop Window Manager
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeAssignPrimaryTokenPrivilege
SeCreateGlobalPrivilege
SeIncreaseQuotaPrivilege
SeSecurityPrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\dwm.exe
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms
Windows Time Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
SeSystemTimePrivilege
Executable File Name c:\windows\system32\w32time.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
IIS Resource DLL
Svchost Group iissvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k iissvcs SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeRestorePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\inetsrv\iisres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC
IIS Resource DLL
Svchost Group iissvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k iissvcs SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeBackupPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeDebugPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeRestorePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\inetsrv\iisres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WAS
ActiveSync Connection Manager
Svchost Group WindowsMobile Privileges
Svchost Command C:\Windows\system32\svchost.exe -k WindowsMobile SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\windowsmobile\wcescomm.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcesComm
Windows Connect Now – Config Registrar Service
Svchost Group LocalService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalService SeImpersonatePrivilege
SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\wcncsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc
WcsPlugInService DLL
Svchost Group wcssvc Privileges
Svchost Command C:\Windows\system32\svchost.exe -k wcssvc SeChangeNotifyPrivilege
Executable File Name c:\windows\system32\wcspluginservice.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService
Windows Diagnostic Infrastructure
Svchost Group wdisvc Privileges
Svchost Command C:\Windows\System32\svchost.exe -k wdisvc SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wdi.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost
Windows Diagnostic Infrastructure
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
SeTcbPrivilege
SeDebugPrivilege
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
SeProfileSingleProcessPrivilege
Executable File Name c:\windows\system32\wdi.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost
Web DAV Service DLL
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeImpersonatePrivilege
SeCreateGlobalPrivilege
Executable File Name c:\windows\system32\webclnt.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient
Event Collector Service
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k NetworkService SeAuditPrivilege
SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wecsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc
Problem Reports and Solutions
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k netsvcs SeImpersonatePrivilege
SeTcbPrivilege
Executable File Name c:\windows\system32\wercplsupport.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wercplsupport
Windows Error Reporting Service
Svchost Group WerSvcGroup Privileges
Svchost Command C:\Windows\System32\svchost.exe -k WerSvcGroup SeDebugPrivilege
SeTcbPrivilege
SeImpersonatePrivilege
SeAssignPrimaryTokenPrivilege
Executable File Name c:\windows\system32\wersvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc
Resource Module
Svchost Group secsvcs Privileges
Svchost Command C:\Windows\System32\svchost.exe -k secsvcs SeImpersonatePrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeChangeNotifyPrivilege
SeSecurityPrivilege
Executable File Name c:\program files\windows defender\msmpres.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
Windows HTTP Services
Svchost Group LocalService Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalService SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\winhttp.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
WMI
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs
Executable File Name c:\windows\system32\wbem\wmisvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt
WSMan Service
Svchost Group NetworkService Privileges
Svchost Command C:\Windows\System32\svchost.exe -k NetworkService SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wsmsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM
Windows WLAN AutoConfig Service DLL
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
SeAuditPrivilege
SeTcbPrivilege
SeDebugPrivilege
Executable File Name c:\windows\system32\wlansvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlansvc
WPC Filtering Service
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted SeImpersonatePrivilege
Executable File Name c:\windows\system32\wpcsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPCSvc
Portable Device Enumerator
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeAuditPrivilege
SeChangeNotifyPrivilege
SeCreateGlobalPrivilege
SeCreatePermanentPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wpdbusenum.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum
Windows Security Center Service
Svchost Group LocalServiceNetworkRestricted Privileges
Svchost Command C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted SeChangeNotifyPrivilege
SeImpersonatePrivilege
Executable File Name c:\windows\system32\wscsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
Windows Update Agent
Svchost Group netsvcs Privileges
Svchost Command C:\Windows\system32\svchost.exe -k netsvcs SeAuditPrivilege
SeCreateGlobalPrivilege
SeCreatePageFilePrivilege
SeTcbPrivilege
SeAssignPrimaryTokenPrivilege
SeImpersonatePrivilege
SeIncreaseQuotaPrivilege
SeShutdownPrivilege
Executable File Name c:\windows\system32\wuaueng.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
Windows Driver Foundation – User-mode Driver Framework Service
Svchost Group LocalSystemNetworkRestricted Privileges
Svchost Command C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted SeChangeNotifyPrivilege
SeAssignPrimaryTokenPrivilege
SeIncreaseQuotaPrivilege
Executable File Name c:\windows\system32\wudfsvc.dll
Registry Key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc
File Extension Database to learn about different file extensions and ways to open them.
File Extension DLL - extension of Windows library files
File Extension BIN - extension for binary files
File Extension DAT - extension for files with various data