CommandLine issue

[nici22]

I checked svchost.exe on both Task Manager and System Informer
2 of them have no CommandLine value on TaskManager, but available on SystemInformer
Is there any reason for that?

[diversenok]

Most likely it's Task Manager failing to retrieve information about protected processes. You can check if that's the case by enabling the Protection column in System Informer or checking the down-left corner of the General tab for given processes.

[dmex]

The commandline of every process can be queried via infoclass and Windows supports protected processes as it only requires query_limited access.

[nici22]

Okay, thank you for replying

[dmex]

System Informer removes null terminators from the command line which are used by some services.