svchost.exe and DOS Exploit

[Guest]

I've been having a problem with my Toshiba Portege A200 laptop and I suspect
it's a virus. I have Windows XP Professional (without the Service Pack 2
update as I've heard horror stories about it causing more bad than good),
with only AOL and the preinstalled programmes on the harddisc.

My CPU usage has started running at full pelt (100%) and a look at the
processes revealed five separate instances of svchost.exe running.

I downloaded and ran SpyBot Seek and Destroy and it found 'DOS Exploit'
which I duly ran a 'Fix Problems'... or so I thought.

I rebooted my PC but unfortunately the CPU was still running at 100%, making
running any programmes a pain in the proverbials!

I re-ran the Spybot Seek and Destroy and surprise, surprise the same DOS
Exploit error came up. I checked the details and it seems to be located in
the registry settings. I ran the fix, making a note of the location of the
settings, and deleted and changed the relevant registry settings. No joy.

After a number of System Restores I'm at my wits end as to what to do. My
internet seems to work fine (AOL 8.0 at the moment, AOL 9.0 before).

My laptop appears to be working ok at the moment but I re-ran the SpyBot
programme and the 'virus' is still there.

When I installed the Microsoft Mouse on one of the System Resets it pushed
the CPU usage to 100% so as you can imagine I'm scared to install it again.

I'm loathe to try installing any more programmes until I can rid my PC of
this virus.

Any help would be gratefully appreciated.

Thanks.

 

[Ricky]

Some info here..
http://www.safer-networking.org/en/faq/36.html

message |
| I've been having a problem with my Toshiba Portege A200 laptop and I
suspect
| it's a virus. I have Windows XP Professional (without the Service Pack 2
| update as I've heard horror stories about it causing more bad than good),
| with only AOL and the preinstalled programmes on the harddisc.
|
| My CPU usage has started running at full pelt (100%) and a look at the
| processes revealed five separate instances of svchost.exe running.
|
| I downloaded and ran SpyBot Seek and Destroy and it found 'DOS Exploit'
| which I duly ran a 'Fix Problems'... or so I thought.
|
| I rebooted my PC but unfortunately the CPU was still running at 100%,
making
| running any programmes a pain in the proverbials!
|
| I re-ran the Spybot Seek and Destroy and surprise, surprise the same DOS
| Exploit error came up. I checked the details and it seems to be located
in
| the registry settings. I ran the fix, making a note of the location of
the
| settings, and deleted and changed the relevant registry settings. No joy.
|
| After a number of System Restores I'm at my wits end as to what to do. My
| internet seems to work fine (AOL 8.0 at the moment, AOL 9.0 before).
|
| My laptop appears to be working ok at the moment but I re-ran the SpyBot
| programme and the 'virus' is still there.
|
| When I installed the Microsoft Mouse on one of the System Resets it pushed
| the CPU usage to 100% so as you can imagine I'm scared to install it
again.
|
| I'm loathe to try installing any more programmes until I can rid my PC of
| this virus.
|
| Any help would be gratefully appreciated.
|
| Thanks.
|
| --
| It's time to burn........

 

[Bruce Chambers]

I've been having a problem with my Toshiba Portege A200 laptop and I suspect
it's a virus. I have Windows XP Professional (without the Service Pack 2
update as I've heard horror stories about it causing more bad than good),

Mostly unfounded or self-inflicted, but there were some compatibility
issues. Check with Toshiba to see if they know of any problems with SP2
and their specific OEM version of WinXP and/or their device drivers.

with only AOL

Almost always a major source of problems.

My CPU usage has started running at full pelt (100%) and a look at the
processes revealed five separate instances of svchost.exe running.

What specific process is consuming all of your CPU cycles? Primary
suspects: any other process(es) using more than 2 or 3%; any
process(es) (other than System Idle) pulling more than 10% is almost
definitely a problem. Odds are that you'll find that one or more of the
Svchost.exe processes are involved. It's perfectly normal to have
several instances of Svchost.exe running simultaneously.

A Description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

However, if Svchost.exe is using a large portion of your CPU
cycles, it has most likely been "hijacked" by a worm, Trojan, or
scumware.

I downloaded and ran SpyBot Seek and Destroy and it found 'DOS Exploit'
which I duly ran a 'Fix Problems'... or so I thought.

I rebooted my PC but unfortunately the CPU was still running at 100%, making
running any programmes a pain in the proverbials!

I re-ran the Spybot Seek and Destroy and surprise, surprise the same DOS
Exploit error came up. I checked the details and it seems to be located in
the registry settings. I ran the fix, making a note of the location of the
settings, and deleted and changed the relevant registry settings. No joy.

The DSO exploit was patched long ago by IE Cumulative Update
MS02-015, in March of 2002. If you've installed this specific patch,
or any subsequent IE Cumulative Updates, IE Service Pack 1, or WinXP
SP2, you're safe. It would appear that the latest version of SpyBot
S&D is only checking for Internet zone settings in the registry that
could be used as work-around protection, and not for the presence of
any corrective patches. Hopefully, the makers of SpyBot will soon fix
this bug.

MS02-015 March 28, 2002 Cumulative Patch for Internet Explorer
http://support.microsoft.com/default.aspx?scid=kb;EN-US;319182

If you like, you can test your system for this particular
vulnerability at this web site:
http://www.grey.com/security/advisories/gm001-ie/

The makers of SpyBot S&D have acknowledged the problem and will
fix it on their next update:
http://www.safer-networking.org/index.php?page=paragraphs&detail=currentfaqs

In the meantime, in SpyBot S&D, click Mode > Advanced > Settings >
Ignore Products > Security > DSO Exploit, to turn off the false alarm.

Some people have reported that the SpyBot Detection rules dated 30
Aug 04, or newer, when used with SpyBot S&D 1.3.1TX, will fix this
problem. However, I've had inconsistent results with that particular
detection update; sometimes it reads clean, then later it will once
again find the DSO problem, and then it will read clean again, all on
the same machine, with no other changes made.

Have you scanned for viruses? That should have been you're first step,
rather than using Spybot S&D.


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH