A lot of spyware/malware is known to create it's own illegit copies of svchost.
Do a search for SVCHost.exe and see where they are all stored on your HD. If any show up in a folder besides \Windows\System32 or \Windows\ServicePackFiles\i386 it's probably an illegitimate copy.
Do a search for SVCHost.exe and see where they are all stored on your HD. If any show up in a folder besides \Windows\System32 or \Windows\ServicePackFiles\i386 it's probably an illegitimate copy.