Security issues
Because svchost.exe is used as a common system process, some malware often uses a process name of "svchost.exe" to disguise itself. The original system file svchost.exe is located in C:\Windows\System32 folder. Any file named "svchost.exe" located in any other folder can be considered as malware.[11] Determining the image path of a process, and its invoking command line, can help identify software masquerading in this way, and help locate the actual program file which is running under the assumed process name of "svchost.exe" (Windows allows multiple processes to all display the same name). Some malware inject a .dll file into the authentic svchost process, for example Win32/Conficker worm, [12] and the Five Eyes attributed malware SNOWGLOBE[13]
vice na
https://malwaretips.com/blogs/svchost-exe-virus-removal/