4.13.1. Win32 services hosting

The services.exe process host many services, which can be identified looking for services.exe in the following registry value of each service service_name:

Key: HKLM\SYSTEM\CurrentControlSet\Services\service_name\
Value: ImagePath

Three instances of svchost.exe processes can be found on a Windows 2000 system. Among them, one instance (netsvcs instance) typically hosts different services. Services hosted in svchost.exe processes appear in the registry:

Key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\
Values: netsvcs, rpcss, tapisrv 

More precisely, on Windows 2000 systems, the following Win32 services run in the following processes:

On Windows XP systems, Win32 services run in the following processes:

On Windows Server 2003 systems, Win32 services are organized as follow:

To determine which services are hosted by which services on a running system, the following tools can be used: