So long have I just taken for granted that what resides in them is a mystery... no more.
In case you don't know, the svchost is an executable container used to launch services that are now implemented as dynamic link libraries (.dll). This is all well and good until you get virus paronia and want to know what they happen to be running inside that generic veneer.
Well it's easy to find out.
1. Open command prompt and enter
2. tasklist /SVC
3. All the running process are displayed, including any dependent services
Easy when you know how i suppose
... you could also use SysInternals ProcessMonitor available here, but the latter means you don't need to install any extra tools.