|
svchost.exe problem
|
|
|
jeff415
Newbie
|
7. December 2007 @ 02:41 |
Link to this message
|
|
I have this problem and it's been bugging me and I'm getting ready to reformat, but thought I'd give it one last try to fix it. I've searched around for this problem and couldn't find anything on it. What basically happens is that the moment I start my computer up, I have to open up Task Manager, otherwise it won't last a few minutes before it starts make the error noise, and very rapidly too! One thing I noticed in the Task Manager is that the svchost.exe rapidly multiplies and ends up to have 20+ of them! Then, after a few minutes, it'll say "svchost.exe has encountered a problem...blah blah blah (you know the rest)". After that, there is no point it closing that window because the moment I close that window, an identical one will pop up and I can't do anything on the computer. I'm forced to restart as a last resort. HELP! Thanks in advance!
|
|
Advertisement
|
|
|
|
Senior Member
|
7. December 2007 @ 10:37 |
Link to this message
|
You are probably infected with blaster worm. In many cases your anti-virus can get rid of the problem, but to be on the safe side follow these steps.
Originally posted by velocityreviews.com:
Boot into Safe Mode and start your registry editor:
Start / Run / regedit
Navigate to:
HKEY_LOCAL_MACHINE
+Software
+Microsoft
+Windows
+CurrentVersion
+Run
In the right-hand pane, look for any entry/ies that include
MSBLAST.EXE, PENIS32.EXE or TEEKIDS.EXE and
DELETE it/them.
These are the files associated with the different variants:
Variant A - msblast.exe
Variant B - penis32.exe
Variant C - teekids.exe
You just disabled the worm from running at startup, so boot into
normal mode again, and turn off ALL system restores to purge
your system.
Open Windows Explorer to the ..\Windows\System32\ or
...\WinNT\System32\ folder and DELETE *any* of the
files named above.
Next, go to the ..\Windows\Prefetch\ or ..\WinNT\Prefetch\
and find the reference to the above file/s (any reference will
be similar to: <filename.exe>-<alphanumerics>.PF), for example,
msblast.exe-0235D8H6.pf, and DELETE it/them.
Now you can download and install the patch, configure your
firewall and update your virus scanner.
Virus Alert About the Blaster Worm and Its Variants
http://support.microsoft.com/default.aspx?kbid=826955
Microsoft Security Bulletin MS03-026
http://www.microsoft.com/technet/sec...n/MS03-026.asp
What you should know about the Blaster worm
http://www.microsoft.com/security/incident/blast.asp
Windows RPC DCOM Buffer Overflow Remote Exploit (MS03-026)
http://www.k-otik.com/exploits/07.25.winrpcdcom.c.php
How to Use The KB 823980 Scanning Tool to Identify Host Computers
That Do Not Have The 823980 Security Patch (MS03-026) Installed
http://support.microsoft.com/default.aspx?kbid=826369
W32.Blaster.Worm
http://www.symantec.com/avcenter/ven...ster.worm.html
W32.Blaster.B.Worm
http://www.symantec.com/avcenter/ven...er.b.worm.html
W32.Blaster.C.Worm
http://www.symantec.com/avcenter/ven...er.c.worm.html
W32.Blaster.Worm Removal Tool
http://www.symantec.com/avcenter/ven...oval.tool.html
If you do not know how to get into safe mode follow these steps. Start your computer and press F8 repeatedly and an options screen will come up. Select safe mode and give it a few minutes to boot. In safe mode startup programs will not run. This is the best place to run scans and get rid of problems. I would update your AV software and run that first. Then check your registry to make sure the problem is gone.
WARNING!! Editing the registry can cause problems. If you are inexperienced I would download the following program before doing it. Make sure to read the instructions so that you know how to replace the registry in case you make a mistake. http://www.larshederer.homepage.t-online.de/erunt/ These are free programs and work better than the system restore in Windows.
Good luck!!
|
|
jeff415
Newbie
|
7. December 2007 @ 14:35 |
Link to this message
|
|
Thanks syxguns! I'll go give it a try right now! If I run into any problems or if it doesn't work, I'll post back what happens. Thanks again!
|
|
jeff415
Newbie
|
7. December 2007 @ 14:45 |
Link to this message
|
Okay, so I did as you said, but unfortunately I didn't find any of those files you were talking about. This is what I saw under "Run":
(Default)
!AVG Anti-Spyware
DVDBitSet
DVDTray
iTunesHelper
mxomssmenu
SunJavaUpdateSched
SystemOptimizer
TkBellExe
UnlockerAssistant
Win Messenger
WindowsUpdateR
Please let me know if you have any other ideas! Thanks!
|
Senior Member
|
7. December 2007 @ 15:41 |
Link to this message
|
Did you update and run your virus scan in safe mode? Try that and see if the problem still exists. I would expect for you to have several svchost.exe files running on startup, but as you are describing, it seems that you have too many. This could be because of a W32.BlueCode.Worm, but the fact that you didn't have any files in the directory... Wait, you ran the regedit in safe mode didn't you? If you did then it is possible that the files did not start.
Boot in to normal mode and run the regedit again and see if you have different listings. Let me know, if the listings are the same then I will have to research a little more about the problem.
Try to update you AV service, and make sure that you have a good firewall. I would suggest COMODO. It is a free firewall that you may download at http://www.download.com
The firewall will not get rid of the problem, but it will help stop future attacks. We will get rid of the problem, we just need to troubleshoot it first. Keep me posted.
|
Senior Member
|
7. December 2007 @ 15:49 |
Link to this message
|
Here is something else I found.
Originally posted by PCHell:
I've encountered other issues with SVCHOST taking up 100% of the CPU Cycles. These issues are usually experienced with Windows Update in some form or another. To fix this frustrating problem, following these steps:
1) Download and install Update for Windows XP (KB927891)
2) Download and install an update for Windows Update Agent WSUS 3.0
3) Restart your computer and your computer should run better with slowing to a crawl because of SVCHOST.EXE
|
|
jeff415
Newbie
|
8. December 2007 @ 02:10 |
Link to this message
|
|
When I boot up in Normal mode and then run "regedit", it still has the same files I listed before. And where would I download the newest Update for XP? Just from the Windows Update thing? Hopefully it will work cuz I have a pirated version of XP. Keep me posted please! =P Thank you so much!
|
Senior Member
|
8. December 2007 @ 12:38 |
Link to this message
|
Originally posted by jeff415:
I have a pirated version of XP
I've never messed with a pirated version before, but the update could be what is causing the problem. There are a couple of other things that we could try, but I think that the update may be what is causing the problem.
Let's try something a little different to try to get to the root of the problem. Because as of right now I'm a little lost!! Download these programs. They are all free, and make sure to get them updated. After they are updated I would suggest booting into safe mode to run them.
Ad-Aware
Spybot Search & Destroy
A Squared
CCleaner
Just in case you need it!
ThreatFire
COMODO firewall
Anti Virus:
Avast
AVG free
Now you should only have one firewall, and one anti virus on your machine. ThreatFire you may leave running, to help protect your machine regardless of any firewall you are running.
Run the machine in safe mode and run each of those scans. This includes the AV scan. CCleaner along with Spybot will help clean your registry. I suggest all of these free tools because each one searches for different things. Remove the last updates that you got for your machine if you need to, but first run these and let's see if we can get rid of the problem.
Keep me posted!
Edit: The download link you were looking for is http://www.microsoft.com/downloads/detai...&displaylang=en You may not be able to download it because your copy is a pirated version.
Here is another link that may get you what you need. http://www.ntcompatible.com/Update_for_W...891_s87208.html
Let's see if it helps!
This message has been edited since posting. Last time this message was edited on 8. December 2007 @ 12:45
|
|
jeff415
Newbie
|
9. December 2007 @ 16:09 |
Link to this message
|
I just downloaded all the programs you listed except for the firewall ones. I will run all of them in Safe Mode later on today. Like I assumed, Windows XP Update wouldn't let me update because it said that I needed a Service Pack 1? Is it possible for me to install that? I will keep you posted once I run all those anti-spyware and anti-virus programs.
|
Senior Member
|
9. December 2007 @ 16:26 |
Link to this message
|
You don't have SP1? That means you don't have SP2!! Your security level is very low. See if this update will work for you.
SP1 Link
SP2 Link
SP1 does not take that long to download, but make sure you download it first. SP2 will take around 45 min. to download and install if you are on DSL. If you are on Dial up it will probably take an hour and a half to run. If you are on cable it will probably finish in 30 min.
I hope those links will work. They should work because they are not from Microsoft.
|
|
jeff415
Newbie
|
9. December 2007 @ 17:20 |
Link to this message
|
|
Oh man! I didn't realize my security level was so low! Thanks a million! I'm going to download them today and I'll keep you updated.
|
Senior Member
|
9. December 2007 @ 21:06 |
Link to this message
|
That is a very good idea. SP2 is full of security features that are must have on your machine. Your machine is too vulnerable at this time. After you get the updates installed I would suggest a good Firewall, Anti Virus, ThreatFire, and a few other pieces of software to keep your machine both safe and running at optimal performance. I can give you all the information and the best part is that you do not have to pay for anything.
Of course if you want the Pro packages then you will have to pay, but for the standard package it is free. That is why I suggest running multiple programs to find and get rid of errors. Let me know when everything is updated.
|
|
jeff415
Newbie
|
10. December 2007 @ 02:49 |
Link to this message
|
I ran all the Spyware programs (Ad-Aware, Spybot, A Squared, and CCleaner) you suggested and deleted all the known threats so far. I left my computer on the whole day while I was out and it didn't crash! I'm going to run the Anti-Virus programs you gave me, then install SP1 & SP2. I'll keep you updated. I can't thank you enough!
|
|
jeff415
Newbie
|
10. December 2007 @ 04:38 |
Link to this message
|
|
So I tried to install SP1 and it didn't let me due to the fact that I have a pirated version of XP. Is there anywhere I can get around that and install SP1 onto my pirated XP?
|
|
Advertisement
|
|
|
Senior Member
|
10. December 2007 @ 11:13 |
Link to this message
|
Originally posted by jeff415:
Is there anywhere I can get around that and install SP1 onto my pirated XP?
I'm not 100% sure. I didn't think the site I gave you would tell you that you couldn't download it. I will have a quick look and see if I can find anything. Here is a site that talks about the added security features in SP1 http://www.winsupersite.com/reviews/windowsxp_sp1_preview.asp
From reading most sites it looks like you are left without the updates. I do not recommend downloading from certain sites, however, by using google I found a site with cracked downloads. Because of forum policy I can not give you the site name. However, you may do your own search using google and find it. The additional security features are worth it, but if you do not get the updates you may still protect your computer, you will just need to run scans more often. It seems that the product key is what is not allowing you to download the service packs. Anyway, do a search and see if you can find the page. Let me know what happens.
|
