How can I determine what processes like svchost or rundll are doing? Not necessarily in great detail, but I want to understand how and why such processes are used by Windows.

As a novice admin, I find it extremely difficult to search on internet every time I see a process entry in the Task Manager that I don't recognize.

  • Welcome to Super User! We consider questions asking for book or website recommendations off topic, so I removed that part from your question.
    – Daniel Beck
    Apr 2 '13 at 11:44
  • Thanks. I see the question is completely re worded. If this gets me what I want (which is really books and/or websites) then so be it!
    – Dirt
    Apr 2 '13 at 12:13

There are some sites out there like file.net or processlibrary.com where you can get information about a process/file but don't just go after the name as any malware can be named anything - so you should check where the files of the running processes are located on your disk. If a "non-Microsoft" .exe file is located in the C:\Windows or C:\Windows\System32 folder, then there is a high risk for a virus, spyware, trojan or worm infection!

To get more detailed information about the processes I recommend the use of SysInternals Process Explorer.

If you are not sure if your system is safe or not I advice you install an anti virus software and perform a thorough scan.

  • Thanks for the answer. The question was only partly about an infection. The other part, and greater motivation, was about understanding "under the hood" kinda thing, which is why I needed a book of sorts. It is more about learning than tracking really.
    – Dirt
    Apr 2 '13 at 9:44
  • @Dirt It is hard to see what you want. Do you want to have insight in how the processes work in detail? Do you want to understand Windows better? In order to give you advice on what could be what you are looking for, you need to give more details about what you want to know and what you know already.
    – Simon
    Apr 2 '13 at 10:24
  • Yes, I want an insight into how the processes work and how/why they are used by windows.
    – Dirt
    Apr 2 '13 at 10:26
  • @Dirt as I don't know your background (experience, training) I recommend you use the mentioned SysInternals Process Explorer and ask a more detailed questions if you have any.
    – Simon
    Apr 2 '13 at 10:32

I usually use process Explorer. To see what services are running under a scvhost.exe process, just hover your mouse over the process name, and a bubble message pops up telling you which services are running inside it.

for rundll, I just look at the command line used to start the process, which tells me which dll is executing. that is usually enough to tell me generally what it is.


I did the same as you a few weeks ago, tried to figure out what the different processes where, I always had a good idea of which I could close, and which I couldn't, simply from trial and error. But I had no idea what the processes where.

I can recommend the howtogeek.com site, they have good, easy to understand explanations regarding these kind of things, and in general loads of interesting articles for people like you and me, who are interested, but don't quite know enough yet.

They often use good answers from superuser.com as sources for their articles.

  • I often end up in these sites you mentioned but that is very frustrating to actually ask a question every time. I can't believe there isn't a simpler website or a book to help us by just enumerating such stuff - a documentation of sorts. Or is it a closely guarded secret I wonder. :P
    – Dirt
    Apr 2 '13 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.