In an earlier blog, I spoke about Windows services and how they are hosted by svchost.exe so that functionality within these dll files can be executed. But what about non-Windows services? How do they execute functions within dynamic link libraries without the need to execute the program that it belongs to? By using the rundll32.exe process (commonly described as Run DLL as an App). An example can be easily demonstrated by opening any Control Panel extension such as the Internet Explorer options panel for IE (inetcpl.cpl).

When rundll32.exe starts, it looks into shell32.dll and launches the function (or executes the code) that is responsible for opening the Internet options panel with no need for Internet Explorer to open. You can see this by adding the Command Line column to the Windows Task Manager:
Read the rest of this entry »

Think of svchost.exe as a container for all the various services that run in Windows. An example of some these services are the Windows Task Scheduler, the DNS service, and the Plug & Play service. It use to be that all these services ran as programs (.exe) but Microsoft eventually decided to start moving all this functionality into the Dynamic Link Libraries (.dll), where they could run more efficiently. The only problem with this is that dlls cannot be launched like programs, they need to run from within an executable, hence the creation of the generic service host process.

Because svchost.exe is host to many services, you often see half a dozen or more svchost.exe’s running in the Windows Task Manager:
Read the rest of this entry »