np, just a stab in the dark really. hope you get it worked out. also hope I'm wrong about the poss. of it being a virus. anyway, I wouldn't worry too much about svchost, it's actually a host proccess for applications that run from dll's, so it's pretty normal to have more than one of them. what I mean you should look for is something like this..(very generic example)
outlook.exe - spelled right
0utl00k.exe - spelled with zeros
at a glance you may not think anything of it, but subtle differences in files names are a common trick by the creators of viri to keep them hidden.
good luck.