Svchost Process Analyzer

[AtYourService]

free and portable (no installation required) tool lists all svchost instances and checks the services they contain.
http://www.neuber.com/free/svchost-analyzer/svchost.gif
Features

* 100% freeware
* doesn't require runtimes
* doesn't require installation
* doesn't write to the registry
* doesn't modify files outside of its own directories
* isn't adware


System requirements

* Windows Vista, XP, 2000, 2003, 2008 (64 Bit too)
* 400 KB free disk space

http://www.neuber.com/free/svchost-analyzer/index.html

[Fixedathome.com]

Nice find ;)

[TimeCode]

I'll have to check it out. Thanks!

[stevenamills]

Thanks! Could be really useful.

[rusty.nells]

Works on Windows 7 RC as well.

[PatrickB]

I tried SvcHostAnalyzer. It quickly identified a couple of "atypical" SvcHost entries using files that did not belong to Microsoft. I searched further and it turned out to be some of my security software.

I went on to trial the recommended Security Task Manager. It rated all of my running processes with a percentage probability of being malware. While several were shown at over 50%, none of them are malware/adware/viruses/worms.

These two tools may be helpful in identifying evil programs, but the user needs to engage brain and not blindly follow the information given.

Another tool to view the services contained in instances of SvcHost is Process Monitor from Microsoft's http://www.sysinternals.com/. It, however, does not indicate whether the SvcHost instance is normal or atypical. You would have to decide for yourself. Of course, with SvcHostAnalyzer, you will also have to decide for yourself since "atypical" does not mean "bad". SvcHostAnalyzer does make it easier to focus on the atypical entries though.

-- Patrick B.