svchost rootkit

[jolin wong]

I have ten svchost.exe process running in the computer,  process explorer shows all of them coming from c:\windows\system32 directory, so looks like no malware, but is there any chance that  rootkit can do process injection to svchost, any tool can detect it? thanks

[Maria Yukie]

I you can make a clean install of your operating system. you can see how many svchost.exe are running. Also what kind of rootkit are you talking about? is it Userland or Ring-0 Rootkit? 😁