A few days ago after some random crash / reset, my PC seems to have started
having some strange problems.
First off, I'm running XP sp1 on an Athlon XP 2000 system with 512 megs of
ram, Audigy2, ATI video card.
It started reporting that some essential system process had failed (SVChost,
i think), and that it would restart in 59 seconds. I figured out how to
disable that mandatory restart in System Management, but that only seems to
buy me time and not stability. At some point, after one restart, Windows
reported that I should throw in the XP cd, since some system files didn't
match the originals (this is after the one time it did a ScanDisk during
start up). I, being hasty, told it to 'ignore', but now I can't run windows
for more than a few minutes without svchost crashing (it simply reports the
error over and over again, as I told it to "restart on fail" in windows
management). This seems to do all kinds of inconvenient things to the file
system, too.
Now, my primary question is, How can I get back to the thing that asks me to
insert my XP cd so it can patch damaged system files? I've tried putting
the CD in anyway and fishing through the obvious options, but that didn't
really work. And, my secondary question is, could this error be caused by
something else? (the SVChost crash errors are always accompanied by a
memory address read error. it's rather intriguing).
Thanks to anyone who can help.
~Mike

"Falco98" <(E-Mail Removed)> wrote in message
news:-(E-Mail Removed)...
> A few days ago after some random crash / reset, my PC seems to have
started
> having some strange problems.


It just happened again.
The error message says, specifically,
"Generic Host Process for Win32 Services has encountered a problem and needs
to close. We are sorry for the inconvenience."

An interesting fact is, it'll throw this error at me about 4 or 5 times,
separated by a random number of seconds ranging from 10 to 30.. and perhaps
also encountered by a memory address read error. If I click the link to see
what "data" one of these error reports contains, i get this error signature:
szAppName : svchost.exe szAppVer : 5.1.2600.0 szModName : rpcrt4.dll
szModVer : 5.1.2600.1106 offset : 00078333

If anyone has any insight, it'd be appreciated.

Virus mate.
Microsoft has a patch for it tho. (to keep it out)
Read up here for starters. Might have to do it from another comp?
Newsgroup called "microsoft.public.windowsxp.basics" & look for thread "the
way to fix the rpc error message" by "mike" on 12/08/2003 7:19AM
BruceM


"Falco98" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> "Falco98" <(E-Mail Removed)> wrote in message
> news:-(E-Mail Removed)...
> > A few days ago after some random crash / reset, my PC seems to have
> started
> > having some strange problems.
>
>
> It just happened again.
> The error message says, specifically,
> "Generic Host Process for Win32 Services has encountered a problem and
needs
> to close. We are sorry for the inconvenience."
>
> An interesting fact is, it'll throw this error at me about 4 or 5 times,
> separated by a random number of seconds ranging from 10 to 30.. and
perhaps
> also encountered by a memory address read error. If I click the link to
see
> what "data" one of these error reports contains, i get this error
signature:
> szAppName : svchost.exe szAppVer : 5.1.2600.0 szModName : rpcrt4.dll
> szModVer : 5.1.2600.1106 offset : 00078333
>
> If anyone has any insight, it'd be appreciated.
>
>

thanx. this seems to have at least put me onto some useful info. it's not
quite smooth sailing of course, but i'm glad it's not an isolated error, or
an indicator of equip. failure of some sort..
~Mike

"BruceM" <(E-Mail Removed)> wrote in message
news:3f3873a2$(E-Mail Removed)...
> Virus mate.
> Microsoft has a patch for it tho. (to keep it out)
> Read up here for starters. Might have to do it from another comp?
> Newsgroup called "microsoft.public.windowsxp.basics" & look for thread
"the
> way to fix the rpc error message" by "mike" on 12/08/2003 7:19AM
> BruceM

You may have been infected with the MSBLAST worm. See the following for
patch/removal details:

http://support.microsoft.com/?kbid=823980

http://vil.nai.com/vil/content/v_100547.htm

"Falco98" <(E-Mail Removed)> wrote in message
news:VYidnWX-(E-Mail Removed)...
> thanx. this seems to have at least put me onto some useful info. it's
not
> quite smooth sailing of course, but i'm glad it's not an isolated error,
or
> an indicator of equip. failure of some sort..
> ~Mike
>
> "BruceM" <(E-Mail Removed)> wrote in message
> news:3f3873a2$(E-Mail Removed)...
> > Virus mate.
> > Microsoft has a patch for it tho. (to keep it out)
> > Read up here for starters. Might have to do it from another comp?
> > Newsgroup called "microsoft.public.windowsxp.basics" & look for thread
> "the
> > way to fix the rpc error message" by "mike" on 12/08/2003 7:19AM
> > BruceM
>
>

One problem with this theory is, my system does not contain the file
"msblast.exe", or anything similar AFAIK... and this has been a primary
indicator in all the other stuff i've read so far.


"John E. Carty" <(E-Mail Removed)> wrote in message
newsi%Za.158054$(E-Mail Removed)...
> You may have been infected with the MSBLAST worm. See the following for
> patch/removal details:

Hrmmmm...
I just followed those directions (generally the concensus everywhere)
---except---
at no point in any of my searches did i turn up a file named "msblast.exe",
and in fact, no entries in msconfig (even in safe mode), and none in the
registry EXCEPT -one-, only when i was in safe mode, in some obscure
location (promptly deleted, of course). My worry is, of course, that i may
have a different, more sly strain -- one that avoided detection by McAfee
DATs updated not half an hour ago (in this very boutique) - and which
doesn't run from quite the same EXE's.
I've rebooted after updating micro$oft's patch, and things are running
alright
-so far ...

thanx to everyone, tho.
~Mike


"Ed_" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> You have the latest and greatest worm. I just spent a few hours cleaning
out my
> daughter's computer, it's a lot of fun. BTW.....it's spreading like
wildfire.
>
> http://www.bigblackglasses.com/Article.aspx?Article=342

I started experiencing this yesterday also and after doing everything
from reinstalling to blowing my brains out I finally found the answer.

You are infected with the new Blaster Worm

http://securityresponse.symantec.com...ster.worm.html

Easiest way to see if you have it is to search on your C: drive for a
file called MSBLAST.EXE.

I initially renamed this to msblast.exe.001 then rebooted.
Everything back to normal. To protect yourself update virus table and
run all critical updates from micrososft.

Troy



"Falco98" <(E-Mail Removed)> wrote in message news:<(E-Mail Removed)>...
> Hrmmmm...
> I just followed those directions (generally the concensus everywhere)
> ---except---
> at no point in any of my searches did i turn up a file named "msblast.exe",
> and in fact, no entries in msconfig (even in safe mode), and none in the
> registry EXCEPT -one-, only when i was in safe mode, in some obscure
> location (promptly deleted, of course). My worry is, of course, that i may
> have a different, more sly strain -- one that avoided detection by McAfee
> DATs updated not half an hour ago (in this very boutique) - and which
> doesn't run from quite the same EXE's.
> I've rebooted after updating micro$oft's patch, and things are running
> alright
> -so far ...
>
> thanx to everyone, tho.
> ~Mike
>
>
> "Ed_" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > You have the latest and greatest worm. I just spent a few hours cleaning
> out my
> > daughter's computer, it's a lot of fun. BTW.....it's spreading like
> wildfire.
> >
> > http://www.bigblackglasses.com/Article.aspx?Article=342

Howdy!

"Falco98" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> One problem with this theory is, my system does not contain the file
> "msblast.exe", or anything similar AFAIK... and this has been a primary
> indicator in all the other stuff i've read so far.

The SVCHOST crashing can also be caused by the exploit ATTEMPT -
that is, the ATTEMPT to infect you with MSBLAST.

That's what typically causes the "RPC Shutdown" symptom.

RwP

Boot from the XP CD. Ensure your BIOS is set to look for bootable devices
in the following order FDD, CD, HDD (floppy, CD hard drive).

When the message appears on the screen:

Press any key to boot from CD.....

Press a key.... any key, even the spacebar.

Let it run... ignore the F2 for the Recovery Console... go through the F8 to
accept the EULA. When Windows looks for and finds itself on thehard drive,
it will ask if you'd like to do a Repair Installation.

All the remainder of your files, folders, documents, MP3s, videos, whatever
else you have on there will be just fine. However you will have to download
and install SP1 and the rest of the Updates since the release of XP.

Cari
www.coribright.com

"Falco98" <(E-Mail Removed)> wrote in message
news:-(E-Mail Removed)...
> A few days ago after some random crash / reset, my PC seems to have
started
> having some strange problems.
> First off, I'm running XP sp1 on an Athlon XP 2000 system with 512 megs of
> ram, Audigy2, ATI video card.
> It started reporting that some essential system process had failed
(SVChost,
> i think), and that it would restart in 59 seconds. I figured out how to
> disable that mandatory restart in System Management, but that only seems
to
> buy me time and not stability. At some point, after one restart, Windows
> reported that I should throw in the XP cd, since some system files didn't
> match the originals (this is after the one time it did a ScanDisk during
> start up). I, being hasty, told it to 'ignore', but now I can't run
windows
> for more than a few minutes without svchost crashing (it simply reports
the
> error over and over again, as I told it to "restart on fail" in windows
> management). This seems to do all kinds of inconvenient things to the
file
> system, too.
> Now, my primary question is, How can I get back to the thing that asks me
to
> insert my XP cd so it can patch damaged system files? I've tried putting
> the CD in anyway and fishing through the obvious options, but that didn't
> really work. And, my secondary question is, could this error be caused by
> something else? (the SVChost crash errors are always accompanied by a
> memory address read error. it's rather intriguing).
> Thanks to anyone who can help.
> ~Mike
>
>