Svchost Blues + 1 Min restart.....need quick fix

T

TheBroker

Contributor
Yeah, I am getting errors for system files and there is a Local Instance of Svchost running on my computer.See sreenie



Also My AV shows viruses and deletes them but still the svchost persists and svchost is there running on the local process even after a compltete AV check(NAV 2k3)
Argus told me tht it was blaster virus.....if it true then any tools to remove.....downloads upto 15-20 mb are absolutely are fine ...cant get any win XP patching cds from anywhere...dont wanna but any Digit Cd's....no money:(
And for except argus from whom i can get and its too far to get from his home :(
Searched forums didnt find anythign to help...can anyone tell me

Looked up on symantec and got blaster removal tools but it didnt help.

PS:everytime I install a fresh copy of Windows,I get the same virus...the sharing is disabled even before the setup of the computer....so where could it be located...cant format thw whole HD...loads of data + songs.
 
read this page on svchost.....

http://ask-leo.com/svchost_and_svchostexe_crashs_cpu_maximization_viruses_exploits_and_more.html

Let me tell you what it is not: On Windows XP, 2000 and 2003, svchost is not a virus. On those systems svchost is a required system component. If you happen to successfully delete it, your system will not run. You'll be much worse off than before.
[Important: do not confuse svchost, which we are discussing here, with scvhost, which has two letters transposed. They are not the same thing. The presence of scvhost may indicate a virus.]
Click to expand...
 
hey here is a fix to prevent shutdowns
1) Go to run->services.msc

2) Right click on Remote Procedure Call (RPC) and then view its properties. Click on recovery tab and change "Restart computer" to "Take no action" at all the places. This will prevent the system from shutting down automatically. But leave the system open for viruses to be downloaded by the trojan (Blaster worm).

3) Now download the Blaster worm removal tool from symantec and run it. Disconnect the internet asap. After it finishes scanning restart ur system and start the removal tool again. Then it will ask whether you want to download the security patch and open the microsoft page for that patch. Download the patch and install.

The removal tool is very small and the patch is not more than a few MB's. So i hope it shouldnt be a problem.

Raghunandan.
 
what exactly is the problem you are facing ??

Dont tinker with the svchost files. they load the various services required by XP. and as KK has pointed out above svchost can be run as local service , nothing strange in it.

which or what system file errors you are getting ??

have you tried deleting / removing all the antivirus software from ur m/c. many times these AV packages are themselves the cause of m/c instability. and by "removing" i mean removing every trace of the AV program, manually removing it from the registry if needed.

ps: A copy of all the system files is found in the "dllcache" folder in the system32 folder. but i would not recommend replacing the files from there before you can pinpoint exactly which system files are corrupt or the nature of your problem in detail.
 
In msconfig...the file is located at C:\windows\svchost.exe

@blade will do that...reformatted yest
But the same 1 min restart even after i installed SP2 previously

@Raghu...did as u told...no blaster found....now installing SP2 :) and using your tool.Hopefully should help :)
The svchost still runs but I am not getting the 1 min restart...installing sp2

@deejay See i wouldnt be having a problem or doubts of svchost if they were running in 3-7 numbers....but it have been added to my Start Menu >> Startup so I am having doubts its a virus/trojan/spyware
 
Last edited by a moderator:
^^ ahem i never told u that svchost was a blaster virus...blaster kinda tampers with it...even without blaster..if u try to end the process...u will get teh RPC error and the 1 min shutdown.

try installing all the windows xp fixes that come with s.w like autopatcher...i.e try gettin ur lazy bum over to my place so that i will give u the cd:P
 
argus_smith said:
^^ ahem i never told u that svchost was a blaster virus...blaster kinda tampers with it...even without blaster..if u try to end the process...u will get teh RPC error and the 1 min shutdown.

try installing all the windows xp fixes that come with s.w like autopatcher...i.e try gettin ur lazy bum over to my place so that i will give u the cd:P
Click to expand...

I am coming tomorrow morning....no other option left...but if it doesnt work out...i am gonna........break ur cd :P
 
Well then, it is clearly a fake cos the real svchost is in Windows\system32

Delete this one, and any references to it in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
 
Back
Top