In Windows, the word "server" can mean a couple of different things. In addition to being a traditional internet server, like a web server or something, server can mean a local program or library that "serves" other local processes. So, for instance, when you embed an Excel spreadsheet in a Word document, you can edit it in the Word document as if you are in a mini-Excel window...that's because Excel is acting as a local "server" for Word. Well, many such servers are loaded or unloaded, including several at startup for basic Win2k functions, like windows networking, and they are broken into like groups...and each group gets it's own svchost.exe process, and that's why there are multiple instances of svchost.exe. I have 3 of them... Now, developers who do not work for Microsoft also write local "servers" that can be run in a svchost.exe process. And so, it's very possible that some application that you've installed has one of these local servers, and that that application has the leak (if none of the rest of us are seeing it, that's pretty likely). Trouble is, from what I know, it's kind of a pain to figure out which applications are running under which svchost.exe process. Double-check to see if you have installed any beta software or software froma company you might suspect might have been less thorough in their testing process. Also, Microsoft has some applications that might help you track down this problem: http://support.microsoft.com/?kbid=250320
I don't know if you found this information yet re. services. Select: "Start" "RUN" and type in "services.msc." This brings up a list of services. "SELECT" the "EXTENDED" TAB Look over with amazement at how much is actually running and take some time to understand what you are looking at. If you see something you think is likely to be a waste or not needed, go to : www.blackviper.com and read about the service and whether it can be disabled or not. Also spend some time reading this website, it has some good info. DougS
The point is that if you have these things in place and use them correctly and have logging turned on then nobody should have hacked into your systems or you would see this in the logs etc.... If all you want is to get more detail then you can write your own app to walk all processes and get lists of their associated resources or you can use the ones already written and provided at systeminternals.com ... unless you are writing system level stuff for windows the details really should be of no concern ....