It is normal to see multiple instances of svchost.exe. Do you need all you
see? It depends on what services you have running on your computer and if
you want to use them all or not. You can use the command tasklist /svc to
enumerate the services you se in each instance of svchost or use a GUI
utility like the free Process Explorer form SysInternals to see the services
associated with an instance of svchost. The other thing I really like about
Process Explorer is that it will show in the general page of a process if
the executable for the process is verified or not. Verified means that it is
digitally signed by a certificate issued by a Certificate Authority that
your computer trusts and would mean almost certainly that the file is not
malware. However just because an executable is not signed does not mean that
it is malware.
I would NOT stop any instance of svchost.exe from running but instead
review the services running on your computer using services.msc and disable
those that you do not need after consulting credible documentation that
disabling the services will not cause you computer to malfunction. The
Windows XP Security Guide and the Threats and Countermeasures guide which
are free downloads from Microsoft are good resources to check on how to
manage services. The free Microsoft Baseline Security Analyzer will also
check for computer vulnerabilities and common services that you may want to
disable and is a great tool to run on any Windows computer. --- Steve
http://www.sysinternals.com/Utilities/ProcessExplorer.html -- Process
Explorer
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/default.mspx
--- XP security guide
http://www.microsoft.com/technet/security/topics/Serversecurity/tcg/tcgch00.mspx
--- Threats and Countermeasures
http://www.microsoft.com/technet/security/tools/mbsahome.mspx --- MBSA
2.0
