What kind malware/spyware could someone put into a service that doesn't have it's own process on windows? I mean services that use svchost.exe for example, like this:
enter image description here

Could a service spy on my keyboard input? Take screenshots? Send/receive data over the internet? Infect other processes or files? Delete files? Kill processes?

  • 5
    Anything its programmed to do. A service could do all the things you mention if its programmed to do so.
    – Ramhound
    May 20, 2014 at 22:23

2 Answers 2


What is a service?

A service is an application, no more, no less. The advantage is that a service can run without a user session. This allows things like databases, backups, the ability to login, etc to run when needed and without a user logged in.

What is svchost?

According to Microsoft: “svchost.exe is a generic host process name for services that run from dynamic-link libraries”. Could we have that in english please?

Some time ago, Microsoft started moving all of the functionality from internal Windows services into .dll files instead of .exe files. From a programming perspective this makes more sense for reusability… but the problem is that you can’t launch a .dll file directly from Windows, it has to be loaded up from a running executable (.exe). Thus the svchost.exe process was born.

So, essentially a service which uses svchost is just calling a .dll and can do pretty much anything with the right credentials and/or permissions.

If I remember correctly, there are viruses and other malware that do hide behind the svchost process, or name the executable svchost.exe to avoid detection.

  • 1
    To take it one step further, if you use Process Explorer and you hover over the svchost instance it will tell you what services it is hosting. May 21, 2014 at 5:07
  • @ScottChamberlain You can also just right click and Go to Service(s) in the built-in task manager on any recent version of Windows (Vista+).
    – Bob
    May 21, 2014 at 12:22
  • 1
    The Windows 8 Taskmanager makes it even easier: 250kb.de/u/140522/p/ZFP0uJMz2yVJ.png
    – Forivin
    May 22, 2014 at 18:28
  • @Forivin I'm curious how you managed to get a PNG to load in an upwards direction. And how you managed to get that to 1.5 MB - a PNG of mostly flat colours like that should be a couple hundred kB, max.
    – Bob
    Jun 15, 2014 at 9:29
  • @Bob You're actually not the first one to ask me that. :p I'm too lazy to find out why, but I created this screenshot by using AltGr+Print (loads a bitmap screenshot of the current window in the clipboard) and then pasted into an empty png file using Paint, so it's likely that it still is a bitmap (with a wrong extension). That would explain the size and maybe also the upwards loading. ;)
    – Forivin
    Jun 18, 2014 at 12:45

One of the easiest ways to determine what processes are running under svchost is to use:

Tweaking.com - svchost.exe Lookup Tool V1.5.0


Works well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.