First when looking in the taskmanager's processes count how many instances there are of the svchost.exe seen there. If you see more then the typical 4 or 5 you most likely are infected with an older malware that poses as a system file. The actual file is found in the "C:\Windows\system32" folder. Other locations are signs of a virus. The following links can help on those.
http://www.processlibrary.com/directory/files/scvhost/
http://www.kephyr.com/spywarescanner/library/scvhost.worm/index.phtml
http://www.auditmypc.com/process/scvhost.asp
Information on the actual system file is described below.
Svchost.exe
Wikipedia, the free encyclopedia -
Cite This Source
In
software Svchost.exe is a generic host
process name for services that run from
dynamic-link libraries (DLLs) within modern versions of the
Microsoft Windows operating system.
At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging, but it also causes some difficulty for end users wishing to see the memory usage or vendor legitimacy of individual services and processes. End users in
Windows XP (Professional edition only) can run the following command at the system prompt to get a breakdown:
C:>tasklist /svc /fi "imagename eq svchost.exe"
Users may then run
tasklist with no arguments and match the reported
PIDs with the previously shown Svchost instances. If memory usage appears abnormal, the user can look up the service names shown by the sample command in one of the many websites devoted to Windows OS management to see if it is a known buggy service or
malware. If no such website comes readily to mind, a search of, for example,
windows service ISEXEng in an Internet search engine will lead to the needed information (
ISEXEng in this example being the name of the suspicious service). The Svchost.exe file is located in the %SystemRoot%System32 folder. The main
registry key involved at bootup is
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionSvcHost (values in this key will show the user at least a partial list of the actual processes behind instances of svchost).
http://www.reference.com/search?q=svchost.exe
There are different versions of the I-Worm type virus that poses as a system file. Running a good antivirus tool will show if you have an infection by virus or other malware.
