How "DCOM server process launcher" works?

[Chintoo723]

In WinXP SP2, there is a service called "DCOM server process launcher" run via svchost.exe. Today I noticed in Process Explorer that there is a "iexplore.exe" process running as a child of this svchost.exe, and tracking back how I started this instance of Internet Explorer, I had clicked on "2 new email messages" in the MSN Messenger (6.2). This is very interesting and I dont know why internet explorer does not show up as a child process of MSN Messenger itself. Anyone any ideas? I was curious, I then attached windbg to this svchost.exe and put a breakpoint on NtCreateProcessEx, and you know what, the breakpoint is hit even if I start IE from the Windows Explorer shortcuts. Infact, the breakpoint is hit for every process that I start from windows explorer. The difference, however, is that the process is still created as a child of explorer.exe and not as a child of svchost.exe when I start from Windows explorer. The questions I have are: 1. How exactly does this DCOM server process launcher work? 2. How do you communicate with it to start a new process? 3. What decides on who is going to launch the new process? svchost or calling process? I'm not sure if this is good forum to ask this question, if it is not and you know an alternate forum, please let me know. thanks! --s

[jamseyang]

that confused me too，have you got the answer?