problemas with svchost.exe

[Guest]

Fiends
I have a problem with the svchost.exe en MS W2K sp4, sp3, sp2, the last
wednesday in two server and four pcs the exe svchost take the 100 % of CPU, i
can´t to kill this file with the task manager, only using the pcrview
program, all servers and pcs have the Antivirus Updated with last pattern.
The major problems is that the server with MSDTC (MS Dtata Transaction
Coordinator) was corrupted when killed this svchost.exe.
Some body help me about origin of this problems.
The windows update is disable in thus pcs.

Sorry by my English

TIA

 

[Dave Patrick]

These may help.

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.d.html

Windows 2000 Users: What to Do If Your Computer Has Been Infected by Sasser
http://www.microsoft.com/security/incident/sasser_print2000.mspx

Also these ones.

http://www.microsoft.com/technet/security/bulletin/MS03-043.mspx
http://www.microsoft.com/technet/security/bulletin/MS03-049.mspx
http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Fiends
| I have a problem with the svchost.exe en MS W2K sp4, sp3, sp2, the last
| wednesday in two server and four pcs the exe svchost take the 100 % of
CPU, i
| can´t to kill this file with the task manager, only using the pcrview
| program, all servers and pcs have the Antivirus Updated with last
pattern.
| The major problems is that the server with MSDTC (MS Dtata Transaction
| Coordinator) was corrupted when killed this svchost.exe.
| Some body help me about origin of this problems.
| The windows update is disable in thus pcs.
|
| Sorry by my English
|
| TIA
|

 

[Guest]

Thank´s but in these documents I don't find answers to my problem, the patron
find in my servers not match with any virus.
Using a tools FindMonitor i see that svchost.exe up 100 % trying to read a
file name nisuxm.exe in the disk drivers.
This scenario i dont see in the internet virus documents.

Thank's

 

[Guest]

My virus program did not detect blaster, either, but my servers had it. Run
the BlastFix and do the patches! If you reboot, then run blastfix, it will
not detect it either.

 

[epi4561]

I'm having a similar problem. Atleast with svchost.exe. I have three of
them running in task manager and they also can not be killed by task
manager. I noticed my problem when trying to log on to the internet. I am
one of those poor unfortunate souls that still has dial-up service, as DSL
is nat available in my area. I get connected, but my logon screen never goes
away and is always on top. So I went in to task manager and found 3
svchost.exe and 1 iexplorer.exe that cannot be killed.

Carlos, did you say you were able to kill svchost through some program
(pcrview)? What is pcrview?
thanks-epi

 

[Kerodo]

I'm having a similar problem. Atleast with svchost.exe. I have three of
them running in task manager and they also can not be killed by task
manager. I noticed my problem when trying to log on to the internet. I am
one of those poor unfortunate souls that still has dial-up service, as DSL
is nat available in my area. I get connected, but my logon screen never goes
away and is always on top. So I went in to task manager and found 3
svchost.exe and 1 iexplorer.exe that cannot be killed.

It is normal to have several Svchost.Exe's running. Windows needs them
to do a variety of things, including DNS lookups and other things. You
shouldn't kill the processes.

If you're having problems with Svchost using all your CPU% then it's
possible that you have a virus problem of some kind. I'd run your virus
scanner and perhaps also Ad-aware and Spybot to look for malware.

 

[epi4561]

Cool thanks.... Hey, why would I not be able to kill Iexplorer.exe with
Task Manager?

 

[Kerodo]

Cool thanks.... Hey, why would I not be able to kill Iexplorer.exe with
Task Manager?

No idea there.. Are you sure it's IE and not some other program naming
itself Iexplore.exe?

If it's Explorer.Exe then that's an intimate part of the operating
system and you should try to kill that either..

There's probably no cause for alarm about anything unless your CPU usage
goes way up or other weird things are happening... but run a virus scan
and scan for malware just in case...

 

[Dave Patrick]

This may help.

http://fr.trendmicro-europe.com/enterprise/security_info/ve_detail.php?VName=WORM_WOOTBOT.R

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
| Cool thanks.... Hey, why would I not be able to kill Iexplorer.exe with
| Task Manager?

 

[Gary Smith]

If what you're seeing is Iexplorer.exe with two r's, it's a parasite and
you need to take defensive measures. The IE program module is
IEXPLORE.EXE, and you should be able to kill it with no difficulty if you
want to. If you kill explorer.exe, your desktop will vanish. That's
useful only in ususual circumstances.