Topic created on: April 1, 2011 13:50 CDT by charlie .

Hi all,
I was investigating a malware , it injects into svchost.exe but i'm not able to find which svchost.exe its injecting into as the machine has several svchost threads.
I'm using sys internal process explorer , but i can only search on dllname and handle, which i wouldn't be knowing in this case.
Any other tools,tricks or easy ways to do this ?

thanks in advance
Charlie