Seems like a kneejerk reaction. The reason services are bundled into SVCHOST is that it offers reduced memory footprint and lower startup costs, which is still

Seems like a kneejerk reaction. The reason services are bundled into SVCHOST is that it offers reduced memory footprint and lower startup costs, which is still significant on resource constrained systems (which Windows embedded still targets)[0]. If malware didn't copycat SVCHOST they would just copycat one of a dozen other common Windows processes like conhst, dllhost, csrss, etc. As an aside, in Task Manager if you go to the details tab, select columns, command line. You'll see exactly what each instance of SVCHOST is running. Process Explorer gives you even more information than that. Process Explorer allows you to turn on Digital Signature checking. Run it as administrator. Select Columns -> Verified Signer. Options -> Verify Image Signatures. But also check your CA store to make sure no custom CA has been injected into the OS. [0] https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=42423 https://blogs.msdn.microsoft.com/oldnewthing/20030918-00/?p=...