svchost error in win 2000 pro

[Maarten van Eerten]

I have found that "svchost.exe error" can be generated without any detectable virus / worm infection.  But it always occurred while online (by 56k modem) and was usually accompanied with the inability to disconnect the modem (needed to restart windows).  Other times, AVG would detect one of the following worms:
     Agobot in \WINNT\SYSTEM\WINHLP~1.EXE
     Lovsan.A in \WINNT\SYSTEM\MSLAUGH.EXE
     Nachi in \WINNT\SYSTEM\WINS\DLLHOST.EXE
However, I did not detect any MSBlaster at any time during my svchost errors.

These problems were all cleared by installing SP4 and Patch KB823980.

Maarten van Eerten

[crawl45]

[font=\"Arial\"][color=\"red\"]hey everyone. ok everyone's been posting about this svchost.exe error. And don't know about you but i got the same symptoms as ya'll but the error was said to be caused by a global c++ file. after installing the sp4 and all the latest patches. It seemed to have worked for me. I haven't had the error at all since i did this. Of course it took me 5 reformats to get it not to. so yeah. But in the end it looks like a hard code error that on dialup connections causes these errors. And not a viri. Atleast not one that my Norton 2003 Pro detected. Well best of luck to ya.[/color][/COLOR][/font] http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

[mattrez]

http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/ph34r.gif\' class=\'bbc_emoticon\' alt=\':ph34r:\' />  i have the same error popping up and doubt it is a virus.  I just formated my hard and put in a new modem.  I put on the old 98 o/s upgraded it to windows 2000 pro.  As soon as I went online with my 56K modem the pop-up came up saying there was a SVCHOST.EXE error.   I never never even went to my e-mail site.

Other than my internet not logging off.  When I use explorer and not my host MSN,  I cannot use liks within the web pages.

[britto]

[quote name=\'David Caulfield\' date=\'Nov 15 2003, 05:24 PM\']Great news have much searching I found a solution that works!

I was getting the svchost error whilst on the net like everyone else recently. It does seem to be due to the blaster worm. Here is what to do, it takes time but it did work.

Download and run service pack 4, or at least have service pack 3 installed. It takes upto 2 hours to download so be patient.
http://www.microsoft.com/windows2000/downl...s/servicepacks/

Next download and run the BlasterWorm patch for 2k:
http://www.microsoft.com/downloads/details...&displaylang=en

This really did work so its well worth giving it a go.

Let me know how you got on lovely people.

Cheers        http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />[/quote]
 yes I am also Having The Same Problem.The Problem sorce is Internet connection.The Anti blaster is not solving the problem.I am having  windows 2000 service pack 4.
Any solutions
PLZ Mail Me
britto_canEmail Removed

[Frustrated]

Ok here it goes:
Running Win2k Pro
Fdisked/formatted drive
Ran clean install from Win2k CD
Installed SP 4 from CD
Ran Blaster fix
Loaded latest upgrades from Symantec
Internet access via DSL
Connected... got SVCHOST error..................................

[Ivan]

Thanks David.  I tried it and it worked.  I actually had to restart my computer in safe mode so I could run SP4 and then the patch you suggested.  My computer is as good as new, and no more time will be spent watching the screen waiting for it to respond.
Thanks again!!

[JK]

I don't usually tell men this... I LOVE YOU DAVID.

It worked - it was driving me crazy.

Thanks for taking the time to let us all know!

jk

[Tomsyn]

I have had the exact same symptoms as everyone, connect via my dial up on 56k (sucks) and then after about 5mins browsing it would come up with that damn error...svchost.exe! my god i hate that file now.

after re-installing win2k sp2 on my machine, had previously sp3, still had the same problems. then re-installed my norton av, scanned and picked up the blaster virus. did the proper procedures for removing that.

then downloaded windows sp4 and followed the instructions by another kind helper on this site (cant remember name as am nearly asleep from trying to fix it) about editing regedit...

now i have been online for over an hour and no problems so davids solution is definately the way to go i reckon...if not i will have to pick up my laptop and smash it to pieces!!!

talkchye

[Maarten van Eerten]

There is a lot of discussion about fixing the svchost error with SP4, but you must remember to also install the patch from Microsoft: KB823980. MSBlaster fix alone won't prevent the problem from reocurring because there are many more hackers around trying to find PC's with security holes.  While you're at it, you should also install KB828028.

Maarten

[Guest_dennis]

[quote name=\'jay\' date=\'Oct 17 2003, 09:33 AM\']I keep getting a svchost.exe error popup, I run fix tools for worms but none found so I the dr watson and it says svchost c0000096 <no symbols>. how do I stop this from happening as I cannot access windows in c: drive as there is no icons showing and my control panel icons got to the left side of the screen. please help all info accepted and apreciated http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />[/quote]
 i have the same problem b4...try to remove the partition of your hadrive and then format it once again. it could be residing to your MBR. if you r using w2k pro, re-install it and intall service pack4 but before u can install sp4 you should install first sp2, then patches of microsoft for worm viruses. try it and it should help you. http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/cool.gif\' class=\'bbc_emoticon\' alt=\'B)\' />

[Joanne Huey]

[quote name=\'David Caulfield\' date=\'Nov 15 2003, 05:24 PM\']Great news have much searching I found a solution that works!

I was getting the svchost error whilst on the net like everyone else recently. It does seem to be due to the blaster worm. Here is what to do, it takes time but it did work.

Download and run service pack 4, or at least have service pack 3 installed. It takes upto 2 hours to download so be patient.
http://www.microsoft.com/windows2000/downl...s/servicepacks/

Next download and run the BlasterWorm patch for 2k:
http://www.microsoft.com/downloads/details...&displaylang=en

This really did work so its well worth giving it a go.

Let me know how you got on lovely people.

Cheers        http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />[/quote]
 I have Windows SP4 on disk if anyone wants a copy?

Email me details on [email protected]

 http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\'\' />

[jaxjazzy]

[quote name=\'Guest\' date=\'Oct 28 2003, 10:54 PM\']check under c:/winnt/system32/wins
see if there is a file there named SVCHOST.exe or DLLHOST.exe
check out teh properties, see if it has been signed anmarked with the author, version etc. and the size, a real svchost should be 4-6K, the virus version is usually 10K, also the virus one will not have proper authors/signature/version etc, find and run the msblast fix[/quote]
  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\'\' /> I review a few messages to see what some other people did or how the svchost.exe affected their w2kpro system and found one person that said look at the properties of svchost for the original signature and various other original properties.
I found that there were two svchost.exe files. The file that appeared to be from a virus was in caps, it was about 18kb, and the original file name was not svchost, it was something else.  I deleted the copy cat and got back online and I'm still waiting to see if I get an error.
I didn't run any virus clean up or nothing like that.

[Pounraj]

Hi  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'\' />

SVCHOST.exe error killing my computer... not able to work peacefully... have Windows 200 Pro with SP4 updation. even I have updated my Norton Antivirus 2004 version with blaster worm fix.. but no solution.. Tried FDISK option twice, but still the problem exist when i connect to the internet through the modem..

Any solution other than updation of SP4 and the patch files.. ?? pls mail me..

Is it advisable to do low level formating of the harddisk and try to connect to internet?

Not able to work at all... http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/sad.gif\' class=\'bbc_emoticon\' alt=\'\' />  pls suggest any ideas....

regards
Pounraj.K
[email protected]

[David]

It is caused by the blaster virus(msblast.exe)
These steps have to be taken to solve the problem:

1) goto start->run->msconfig->startup->uncheck msblast.exe and restart system

2) If this does not solve the problem, goto start->run->regedit->HKEY_LOCAL_MACHINE->current control set->software->Microsoft->Windows->Current Version->Run and delete any string with msblast.exe

3) goto c:\windows\system32 and delete msblast.exe file or folder and restart the computer

4) goto start->run->services.msc->RPC host->properties->recovery->select the three steps to take no action and restart the system

5) Download the patch from Microsoft web-site

[bill]

heres what i did to solve my problem on dial up.    go to modems click on modem properties , go to advance port settings  and there will be two sliding bar tracks top is for receiving bottom for trans mitting   , default wiill slide botth to the right  i put transmitting in middle and receiving at  1/4 from the right,  my modem is a lucent   everythings a ok no more svchost error .  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/cool.gif\' class=\'bbc_emoticon\' alt=\'B)\' />

[Jason]

[quote name=\'jay\' date=\'Oct 17 2003, 09:33 AM\']I keep getting a svchost.exe error popup, I run fix tools for worms but none found so I the dr watson and it says svchost c0000096 <no symbols>. how do I stop this from happening as I cannot access windows in c: drive as there is no icons showing and my control panel icons got to the left side of the screen. please help all info accepted and apreciated http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/rolleyes.gif\' class=\'bbc_emoticon\' alt=\':rolleyes:\' />[/quote]
  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/huh.gif\' class=\'bbc_emoticon\' alt=\':huh:\' /> Just install Service pack4 for 2000 you will be ok

[The Hacker]

Yeah, no kidding. It is the blaster worm, I just figured it out.


My suggestion is, though much of a pain in the ass as it may sound is to get anti virus software, install the sp4 service pak for win 2000 pro and the other patch that protects your ports or whatever.

The worst thing about this is you need the anti virus software running before you connect to the internet, well if you have a infected dialup server like mine, nocharge.com.

Otherwise you will probably be attacked within minutes, im not kidding. This is after a complete reinstallation of windows 2000 pro.

There seems to be a security hole i'm almost sure, 99% sure in windows 2000 pro that lets the virus in within minutes of a new install. Repeat , you need anti virus software monitoring your connection , even before you download and install service pak4 and the other port secure patch whatever it is, enu?.

Just from personal experience this blaster worm virus really sucks if your not educated about it.

Syptoms are svchost has errors, teekids.exe file is screwing with ya, everything goes haywire and all kinds all stuff starts happening, like notepad opens for no reason, system shuts down, search engine queries become useless because all the text in the results are crossed out and/or unreadable.

You need to do your homework and get use to total destruction of your system files before you can confront this horrible virus.

Fdisk, format c:, reinstall operating system, get anti virus software to monitor your connection before you connect, download service pak 4 for win 2000 pro, and the patch to fix port vulnabilities, sorry no details here, then your ready to conquer the world.

The Hacker
Oh by the way, don't be trying to hack into computers unless you follow my advice, or you will end up like i did. What's next? Who's Next?

[PABLO]

Hey guys! you are fantastic!! I have resolved this problem!!
Thanks you so much!!!!

[Guest]

OMG, people... 9/10ths of you ARE suffering from the blaster worm or some variation of it. Now, pay attention real close here. The blaster worm will download itself to your computer. No permission needed. You don't need to open an email, download infected warez or surf thousands of porn sites to get it. All you need is an internet connection and a OS that can be infected by the virus and WHAM! You're infected.

If you're infected or you seem to be having problems, COPY THIS into a text file and save it to your desktop.

I'd suggest downloading the two removal tools from Symantec.

BLASTER:
http://securityresponse.symantec.com/avcen...er/FixBlast.exe

WELSHIA:
http://www.symantec.com/avcenter/FixWelch.exe

Then download the security patch.

WINDOWS 2000:
http://www.microsoft.com/downloads/details...&displaylang=en

WINDOWS XP*:
http://www.microsoft.com/downloads/details...&displaylang=en

Anyway, it's all pretty basic. After you download all three files to your desktop, unplug any "always on" broadband connections you have (IE: Cable, DSL) and restart the computer. DO NOT RECONNECT TO THE INTERNET!!! Run the blaster worm fix and let it complete. When it asks you to download the patch, tell the program no. Do the same with the Welchia fix. Again, do not connect to the internet. Finally, run the windows update patch supplied for your OS. It's one of those really long url links up there. Once finished, you'll be asked to restart your computer. Go ahead and restart. You should be worm and reboot free from then on. If for some reason you still get problems, I'm incredibly sorry for coming off so stupid, but I've fixed dozens of win2k and xp machines infected with these worms and I know the symptoms pretty well.

*Note: If you're running Windows XP and your computer keeps getting shut down after ~10mins on the net, you'll either have to download each file sepertly and restart after each complete download or disable the computer from shutting down by typing "services.msc" in the Start => Run box and click OK. The Services Control Panel comes up. Select the entry for the RCP service, then right-click on it and click Properties. Open the Recovery tab. There are boxes there with options on what actions can be taken should the service fail. These are set by default to Restart. You must set all three actions to Take No Action.

[Nagarajan]

[quote name=\'zig\' date=\'Oct 29 2003, 10:43 PM\']okay. i checked svchost.exe. it was authored by microsoft. however. the file is 19.2kb. i did run the fixit and it said i had removed it. i have ran it again several times and now it tells me it does not find it. i seem to be having lasting effects though. hey dbageek, sorry, youre talking to the "non programmer sort" here. :-) what is MS003-026 QB823980? i don't remember opening any strange attachments. is that how you get the blaster? thanks for your help.[/quote]
 I have the when i start de Dial-UP conection  i get the SVCHOST.EXE error msg! and then i can´t copy/paste nor drag and drop...its really a big probelem to me. Pls Give the solution
Thanking u
nagarajan