svchost.exe errors

[Peter Colovas]

When my laptop is undocked I get svchost.exe errors
constantly. When it is docked they don't happen. when I
get the svchost errors I cannot browse my network
properties, the window is blank. Also, when this is
happening I cannot cut/paste between applications or
windows.

I have an up to date antivirus program which shows no
signs of the blaster worm, I have also run the symantec
fixblast and fixwelch tools and they also come up empty.
Anybody have any other ideas? I am running service pack 4
and I just ran windows update last friday.
Thanks,
-Pete

 

[Marina Roos]

You might be blasted.
Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to www.sophos.com to get the removaltool.
After that install ms03-039 from microsoft to prevent from happening again.

Marina

 

[Guest]

I've checked for blaster. I've run two different removal
tools and found nothing. I wonder why it only happens when
I'm undocked.

 

[Marina Roos]

Anything in the eventlogs?

Marina

I've checked for blaster. I've run two different removal
tools and found nothing. I wonder why it only happens when
I'm undocked.

 

[Peter Colovas]

Which logs?

-----Original Message-----
Anything in the eventlogs?

Marina




.

 

[Marina Roos]

On your laptop. Control Panel, Adminstration Tools (or something like that),
Eventviewer.

Marina

 

[Peter Colovas]

There are tons of errors in the log. A lot of RPC service
failures, a lot of DCOM service failures. These are blaster
signatures, no? so how can I fix this problem. I've run
these removal tools to no avail.
Thanks,
Pete

 

[Marina Roos]

Hi Peter,

Looks like it, yes.

Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to www.sophos.com\support\desinfection to get
the removaltool. After that install ms03-039 from microsoft to prevent from
happening again.

Marina

 

[Peter Colovas]

Hi Marina,
None of these processes show up in my task manager. I have
run multiple cleaning tools in both normal and safe mode,
but no viruses are showing up. however, I still have this
svchost problem when my PC is out of its docking station.
Is there anything else I can try? this is really annoying.
Thanks,
-Pete

-----Original Message-----
Hi Peter,

Looks like it, yes.

Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to

www.sophos.com\support\desinfection to get

 

[Marina Roos]

Hi Peter,

Sjeesh, I don't know. How about those errors in your eventlogs? Can you give
some more details about them?

Marina

 

[Peter Colovas]

Here are some of the log messages. Note that these are just
examples, there are a lot more of them.
-Pete


Error Log

The COM+ Event System detected a bad return code during its
internal processing. HRESULT was 80070005 from line 42 of
..\eventsystemobj.cpp. Please contact Microsoft Product
Support Services to report this error.

System Log

The FLEXlm License Manager service terminated unexpectedly.
It has done this 1 time(s). The following corrective
action will be taken in 0 milliseconds: No action.

The value named IRPStackSize in the server's Registry key
LanmanServer\Parameters was invalid. The value was
ignored, and processing continued.

The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not
register with DCOM within the required timeout.

The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not
register with DCOM within the required timeout.

The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 1 time(s). The following
corrective action will be taken in 60000 milliseconds:
Restart the service.

Application popup: svchost.exe - Application Error : The
instruction at "0x915a0400" referenced memory at
"0x915a0400". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

Access denied attempting to launch a DCOM Server. The
server is:
{D3580208-D4E1-46D4-876C-B45A328AF25A}
The user is pcolovas/COLOVASPC,
SID=S-1-5-21-2025429265-1383384898-1060284298-1001.

 

[Marina Roos]

Are these the errors you only get when not in the dockingstation?
Can you give me the ipconfig/all when not docked?
Do you have the error-numbers, event id's? You could have a look at
www.eventid.net to see if there are solutions.

Marina