tasklist /svc /FI "IMAGENAME eq svchost.exe"
The above command will list all the svchost.exe processes and display the programs (DLL's) that have been started by svchost.exe.
Below is the output from my Computer (I have formatted so it can be viewed easily):
C:\Users\wtn>tasklist /svc /FI "IMAGENAME eq svchost.ex"e
Image Name PID Services
=========== ==== ========
svchost.exe 768 DcomLaunch, PlugPlay
svchost.exe 828 RcSs
svchost.exe 856 WinDefend
svchost.exe 1012 Audiosrv, Dhcp, Eventlog, lmhosts, wscsvc
svchost.exe 1036 AudioEndpointBuilder, Netman, PcaSvc,
SysMain, TrkWks, UxSms, WdiSystemHost,
Wlansvc, WPDBusEnum, wudfsvc
svchost.exe 1048 AeLookupSvc, BITS, EapHost, gpsvc,
LanmanServer, MMCSS, ProfSvc, RasMan,
Schedule, seclogon, SENS, ShellHWDetection,
Themes, Winmgmt, wuauserv
svchost.exe 1224 EventSystem, fdPHost, FDResPub,
LanmanWorkstation, netprofm, nsi, SSDPSRV,
upnphost, W32Time, wcncsvc, WebClient
svchost.exe 1404 CryptSvc, Dnscache, KtmRm, NlaSvc, TapiSrv
svchost.exe 1608 BFE, DPS
svchost.exe 2000 stisvc
svchost.exe 340 WerSvc
참고 : http://www.watchingthenet.com/how-to-identify-what-programs-started-svchostexe-in-windows.html
