Svchost.exe groups are identified in the following registry key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
During system initialization, Windows 2000 creates several threads in the System process, called system worker threads that exist solely to perform work on behalf of other threads.
There are three types of system worker threads:
Delayed worker threads execute at priority 12, process work items that aren't considered time-critical, and can have their stack paged out to a paging file while they wait for work items.
Critical worker threads execute at priority 13, process time-critical work items, and on Windows 2000 Server installations have their stacks present in physical memory at all times.
A single hypercritical worker thread executes at priority 15 and also keeps its stack in memory. The process manager uses the hypercritical work item to execute the thread "reaper"
Function that frees terminated threads.
