This seems to belong on this thread. I was chasing the continual low risk ZA alerts to "svchost". Seems this is a benign Microsoft switch engine pulling a string of DLL files into use...in computer usage it's a .exe file aggregating the DLLs. There can be several in use at the same time under different file numbers (I think). So, do I get rid of this alert which is bugging me?