A Window keeps popping up.

[Frank Martin]

I have Windows XP pro with the SP3 added.

Whenever I start up the computer, and sometimes when
connecting to the internet I get a small window appearing
called "Just In Time Debugging".

Further down this small window is the comment "New Instance
of Microsoft Script Editor."

Then it asks "Do you want to debug using the selected
debugger?" Yes/No.

If I press "No" the window goes away. If I press "Yes" the
following happens....

I get another window called "Microsoft Script Editor
(Design)"

In the body of this window is a smaller one called "Step
into Remote Procedure Call". Also in this smaller one
is a field containing
"[964]C:\Windows\System32\sychost.exe", the next field down
contains "Script", and the next one down contains "Script".
If I press "OK" on this window I then get another one...

This one is called "Miscellaneous Files Script Editor
[break] http//www (unintelligable web address)".

This seems to be referring to "Program [964]svchost.exe.
Script [2992] Thread 000" Also: StackFrame JScript -
anonomous function.

The body of this window contains some html code.

Then another window appears called "Microsoft JScript
runtime error: object expected.
Break/continue/ignore/help.


All this has been going on for several months.
Please help,
Frank

 

[Malke]

In the body of this window is a smaller one called "Step
into Remote Procedure Call". Also in this smaller one
is a field containing
"[964]C:\Windows\System32\sychost.exe", the next field down

Did you type this *exactly* as it appears? "Sychost.exe"? If yes, then your
computer is infected because the correct name of the executable is
"svchost.exe". If it really says "sychost.exe":

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

If you made a typo and the message says "svchost.exe" then you need to
manage your Startup to see what's running then.

Start>Run>msconfig [enter]

This brings up the System Configuration Utility. Look on the Startup tab and
find the probable culprit. Uncheck the box next to its name, Apply and OK
out. You don't need to restart immediately, but the next time you do you'll
get a dialog saying you've used the Utility. Just tick the box that says in
effect, "don't bother me about this again".

Important - Do not use the System Configuration Utility to stop processes.
Instead, use Start>Run>services.msc [enter] and do not stop any services
unless you really, really know what you're doing.

How to Troubleshoot By Using the Msconfig Utility in Windows XP -
http://support.microsoft.com/?id=310560
The free Autoruns program is very useful for managing your Startup -
http://www.microsoft.com/technet/sysinternals/default.mspx - Autoruns

How to determine what services are running under a SVCHOST.EXE process
http://www.bleepingcomputer.com/tutorials/tutorial129.html

Malke

 

[Frank Martin]

In the body of this window is a smaller one called "Step
into Remote Procedure Call". Also in this smaller
one
is a field containing
"[964]C:\Windows\System32\sychost.exe", the next field
down

Did you type this *exactly* as it appears? "Sychost.exe"?
If yes, then your
computer is infected because the correct name of the
executable is
"svchost.exe". If it really says "sychost.exe":

Go through these general malware removal steps
systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

If you made a typo and the message says "svchost.exe" then
you need to
manage your Startup to see what's running then.

Start>Run>msconfig [enter]

This brings up the System Configuration Utility. Look on
the Startup tab and
find the probable culprit. Uncheck the box next to its
name, Apply and OK
out. You don't need to restart immediately, but the next
time you do you'll
get a dialog saying you've used the Utility. Just tick the
box that says in
effect, "don't bother me about this again".

Important - Do not use the System Configuration Utility to
stop processes.
Instead, use Start>Run>services.msc [enter] and do not
stop any services
unless you really, really know what you're doing.

How to Troubleshoot By Using the Msconfig Utility in
Windows XP -
http://support.microsoft.com/?id=310560
The free Autoruns program is very useful for managing your
Startup -
http://www.microsoft.com/technet/sysinternals/default.mspx
- Autoruns

How to determine what services are running under a
SVCHOST.EXE process
http://www.bleepingcomputer.com/tutorials/tutorial129.html

Malke

Thanks, the problem occurs intermittently, just like the
csrss.exe virus I removed once before, therefore I haven't
been able to check the spelling.

Again, as before, it was by running various virus-removal
software that the problem was pinpointed (though not
removed). The latest software I tried was "STOPzilla" which
has found some viruses that "AdAware" and "Spybot" missed.
Whether it has removed the one in question remains to be
seen. I'll report back when and if the problem occurs
again.

|Regards, Frank

 

[Malke]

Thanks, the problem occurs intermittently, just like the
csrss.exe virus I removed once before, therefore I haven't
been able to check the spelling.

Again, as before, it was by running various virus-removal
software that the problem was pinpointed (though not
removed). The latest software I tried was "STOPzilla" which
has found some viruses that "AdAware" and "Spybot" missed.
Whether it has removed the one in question remains to be
seen. I'll report back when and if the problem occurs
again.

I'm rather astonished that you would continue to run your system when it is
possibly infected rather than make sure it is virus/malware-free. Since it
is very common for infected Windows machines to be part of botnets so they
can spew spam all over the world and/or have their owner's data stolen, you
might consider being proactive in this case rather than passively waiting
for an error message to appear.

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke

 

[Frank Martin]

I'm rather astonished that you would continue to run your
system when it is
possibly infected rather than make sure it is
virus/malware-free. Since it
is very common for infected Windows machines to be part of
botnets so they
can spew spam all over the world and/or have their owner's
data stolen, you
might consider being proactive in this case rather than
passively waiting
for an error message to appear.

http://www.elephantboycomputers.com/page2.html#Removing_Malware

Malke

I know about the botnets and the csrss.exe was an example of
these and this was the one I found by monitoring internet
traffic with the Windows Task Manager. So far there has
been no unusual traffic from my machine.

 

[Randem]

Well there is a sign that something NO GOOD is happening. Be pre-emptive
http://www.randem.com/virusproblems.html

--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
http://www.randem.com/installerproblems.html
http://www.randem.com/vistainstalls.html
http://www.financialtrainingservices.org