[Ilizane]

I permanently have 5 instances of svchost.exe running, with the User Name field showing SYSTEM, LOCAL SERVICE and NETWORK SERVICE. None of them show up on a netstat -b listing. Is there a way to monitor what arguments they were launched with, which process launched them, and what they're trying to do?

 

[deleted122510]

CProcess is your friend.