装windows defender，用里面的软件浏览器察看到底哪些是正常的，哪些是病毒

http://www.microsoft.com/athome/ ... ftware/default.mspx

svchost有几个都正常，比如现在我机器上有7个，分别是
DCOM Server Process Launcher, Terminal Services
TCP/IP NetBIOS Helper, Remote Registry, SSDP Discovery Service, Universal Plug and Play Device Host, WebClient
Remote Procedure Call (RPC)
IPv6 Helper Service, Windows Audio, Background Intelligent Transfer Service, Computer Browser, Cryptographic Services, DHCP Client, Logical Disk Manager, Error Reporting Service, COM+ Event System, Fast User Switching Compatibility, Help and Support, Server, Workstation, Network Connections, Network Location Awareness (NLA), Remote Access Auto Connection Manager, Remote Access Connection Manager, Task Scheduler, Secondary Logon, System Event Notification, Windows Firewall/Internet Connection Sharing (ICS), Shell Hardware Detection, Telephony, Themes, Distributed Link Tracking Client, Windows Time, Windows Management Instrumentation, Security Center, Automatic Updates, Wireless Zero Configuration
DNS Client
HTTP SSL
Windows Image Acquisition (WIA)

系统服务开的多了就会多，禁用的话就是禁用了相应的服务，而那些伪装成svchost的病毒就是利用数目不特定的特点而已