I suggest you to use Mark Russinovich's Process Monitor. http://technet.microsoft.com/en-us/sysinternals/bb896645 Look for "Process Tree" and you can see wich process run under svchost.exe process. Good Luck
Microsoft is conducting an online survey to understand your opinion of the Technet Web site. If you choose to participate, the online survey will be presented to you when you leave the Technet Web site.