On Windows XP, 2000, and 2003, svchost is not a virus. On those systems svchost is a required system component. If you happen to successfully delete it, your system will not run. You'll be much worse off than before.
Do not delete svchost.exe. Don't even think about it. [Important: do not confuse svchost, which we are discussing here, with scvhost, which has two letters transposed. They are not the same thing. The presence of scvhost may indicate a virus.]
Svchost, which is short for "service host", is a core part of the operating system that provides support to many of the required services that are Windows. You can see all the copies of svchost and what services they are running by typing "tasklist /svc" in a command window. If you don't have tasklist, or just prefer not to use the command shell, you can use SysInternals Process Explorer instead. (Check out my previous article "What is Tasklist.exe, and why don't I have it?" for details.) On my machine one copy of svchost is responsible for 30 separate services, another is hosting 4, and the remaining 3 host one service apiece.
Do any of these symptoms sound familiar?
* Your system becomes sluggish and you find that something called svchost or dllhost is taking nearly 100% of your CPU.
* Your system reports that svchost has performed an illegal operation and will be terminated. After that various things fail to work properly, if at all.
* After you log in, your system automatically reboots in one minute.
What are the reasons to caused these symptoms?
* You have a virus on your computer.
* You are under an attack caused by an outside source attempting to exploit your RPC vulnerabilities.
What to do?
* Block the vulnerability.
If you're running Windows XP, you can turn on the Internet Connection Firewall. In Control Panel, select Network Connections, select the connection that corresponds to your internet connection, right click on that and select Properties, select the Advanced tab, and make sure that Protect my computer and network by limiting or preventing access to this computer from the Internet is checked.
If you're running behind a NAT router you're probably already safe, but make sure that ports 135, 139 and 445 are not being forwarded to any computer on your network.
If you have some other kind of firewall ensure that those same ports are blocked.
* Install all of the latest service packs and patches. For Windows 2000, that means getting the latest service pack, as well as any additional patches. For Windows XP that also means getting the latest service pack and any additional patches. (Note: if you've installed Windows XP Service Pack 1, Microsoft now recommends installing Service Pack 1a that corrects a couple of problems.) The whole process can be simplified to this: visit Windows Update, let it analyze your system, and then download and install all the updates suggested.
The single, most important update relating to our svchost / rpc problem is this one: A Buffer Overrun in RPCSS Could Allow an Attacker to Run Malicious Programs. Make certain that the patches listed there have been installed.
* Scan for viruses (update your virus database or signatures)
* Scan for spyware