Investigating HOST PROCESS FOR WINDOWS SERVICES

GlassWire reports on (and can block, BAD idea) the totality of Host Process for Windows Services, svchost.exe. This is an ease-of-use, highly effective quality inherent in process blocking firewalls like GlassWire and this should not be construed as a negative in any way.

On my system, Task Manager shows 66 (!) instances of svchost.exe. While under the Processes tab, one can sort on the Process name column and then scroll into view however many instances can be viewed vertically in the window open on your desktop, 52 on my 32" 3840x2180 4K monitor, to watch the Network column. As well, not all 66 are network/internet related. And the data is in real time.

Here is the method I use to find out what the heck all those networked svchost.exes are doing…

Download ProcessExplorer.zip from:

Extract procexp64.exe to a location on your hard drive; the Program Files folder on your C; drive is a good choice. Or to a USB stick. (procexp.exe is for 32 bit Windows; do not use procexp64a.exe.)

procexp64 is not an installer, it runs all by itself, that is, it’s “stand-alone.” Optionally, right click on it and select “Run as administrator.” When done, click FIle and Exit.

In the View menu, for “Show lower pane,” if it’s checked, un-check it. (Newbies may play with that later.)

Right click on any column header and select “Select Columns.”

Check mark the items I’ve shown in the screenshot under the Process Network tab. Under every other tab, un-check whatever is checked.

One click on either the Network Receives or Sends column header will sort the column where in my example here shows this one svchost.exe is using the DNS Client. Only one instance of svchost.exe is present and the data values are low as PE was open just for the brief period of screenshooting.

Depending on your desktop and/or window sizing, you may have to scroll up to the top of the listings; pay attention to the scroll bar at the right.

This is the limit to which I detail on this method as Process Explorer is a complicated, feature heavy utility with a learning curve that’s almost vertical. Items under the Process menu item or a right click on a process should be avoided by casual users, otherwise you can be fearless in digging around.

And as you might observe, other network processes are displayed.

Cheers.