Wyoming | SVCHOST.EXE is started or forked whenever your networking stack wants to start a service for an incoming network connection, or an autonomous background task, etc.
Your firewall will start at least a couple, event logging, lmhosts, DNS caching, NTP/time-synchronization, etc, etc, etc.
Why are there so many running? Your system has a lot of background tasks configured.
Microsoft decided that if they had all these services packed into one process, loaded from .dll's and having their own thread inside a single process to reduce the footprint on the system, a single thread crashing could abort the whole process, and if you packed all these services into one process and it crashed, the system would either crash or be rendered unusable. So Microsoft broke apart these background services into individual processes, which can be restarted individually if there is an aborted process.
You can use Process Explorer to discover what is actually going on inside various SVCHOST.EXE processes:
http://technet.microsoft.com/en-us/sysinternals/bb896653
You can configure what services are allowed to run on your system, and whether they're started at boot time or upon first request by using the Control Panel->Administrative Tools->Services tool.
NB that you should do some reading on what these various services do before changing the defaults on your system. |