Seventh, close and partly true. Svchost is a special windows service that controls several vital services including the Remote Proceadure Call. If you try and close one of the svchost processes running under SYSTEM, you will get that Rmote shutdown error which the msblast virus causes. The reason that happens is cos it assigns ports, controls other services etc etc. The Svchost.exe is only a part of 2k/XP. Altho other windows systems have an rpc process. That RUNDLL thing, seventh, im not sure bout that. RunDll is used for every dll launch as far as I know. But, whatever it does, it isn't a virus. BUT, if something called svshost is running, be worried. It is a trojan, but svchost isnt!