Just for fun, I would drop to a command line and do a tasklist /SVC and look at what all the svchost processes are doing.