Suspicious Svchost

Question

I find many instances connected through as many as 7 ports in my system when I opened TCPView (Sysinternals). Could it be because of a malware? How to find it out without Antivirus tools.

Answer 1

Don't Panic! (yet) Svchost can have multiple instances.

At startup, Svchost.exe checks the services part of the registry to construct a list of services that it must load. Multiple instances of Svchost.exe can run at the same time. Each Svchost.exe session can contain a grouping of services. Therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services allows for better control and easier debugging.

You could read up some more at the HowToGeek page,
Svchost Viewer Shows Exactly What Each svchost.exe Instance is Doing

Answer 2

This indeed could be the result of malware. Svchost.exe is a commonly used to spawn malware processes. In some cases svchost can actually make it difficult to find the offending program without diving into a good bit of detail.

TCPView is handy to see what processes are talking across the wire, Process Explorer has an I/O history tab which is also quite useful for this process. I would also recommend using filemon to determine which files are open. Malware will in many cases attempt to prevent you from deleting/modyfying its runtime by locking the file.

The PIDs can be helpful in determining which processes spawned other processes.

Generally when I get to this point I already suspect there is malware and I kill processes one at a time until I find the offending program. If the program is talking across the wire, then a good indication you have terminated the right program would be cessation of suspicious network traffic. Some malware is designed to behave very badly, so in these cases, it is not hard to spot. Processes which do not consume all the system resources and are not "calling home" across the internet are the most challenging to spot in the wild.