Svchost.exe Generates Errors When Dial-Up Connection Open

[James]

My OS is:
Windows 2000 Pro 5.00.2195 Service Pack 3

I just recently began using the Internet on this
computer. I installed a modem from an old computer that
never had any problems, but on this computer after I have
been online for 1-2 minutes, an error message appears:

Svchost.exe has generated errors and will be closed by
windows.
An error log is being created.

After this I cannot paste information, or look at the
status of my dial-up connection, or disconnect the dial-up
connection.

When I first had this problem I reformatted my hard drive
and did a clean install of Win 2K Pro, but even after this
I got the same errors as before. I have scanned the hard
disk twice with Norton Antivirus 2003 with current virus
definitions but it has reported no viruses.

Is this a hardware issue or a software issue? What can I
do to fix it?

Thanks for the help.

 

[Mike]

I have the same problem! Only difference is that it
occurs every two hours or so. I've done the same as you
in trying to get a fix, but nothing ha worked.

 

[Chuck]

I have the same problem! Only difference is that it
occurs every two hours or so. I've done the same as you
in trying to get a fix, but nothing ha worked.

I have seen several discussions about your symptoms being caused by
Blaster (msblast.exe) or its variants.

If you are using a modem to connect to the internet, and have not yet
updated with MS03-039, you are a sitting duck apparently. I have seen
various reports of setting up new computers, and being infected by
Blaster after connecting to the internet, but before MS03-039 could be
applied.

You need to:
1) Install a firewall, or get a NAT router that supports PPP
(assuming your ISP provides PPP compatible dialup), to protect you
from reinfection.
2) Remove the infection. Check out these articles:
http://www.sophos.com/support/disinfection/blastera.html
http://www.visualante.org/msblast/
3) Go to http://WindowsUpdate.Microsoft.com and apply all updates
(including MS03-039 / MS03-026).

I can't tell you why NAV didn't identify Blaster, but read the
articles. Google for "msblast svchost" and read some of the articles
you find there too. Do that while you have lots of spare time, as
Google will return you a long list of articles (1,260 I was presented
with).

Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Marina Roos]

You've been blasted.
Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to www.sophos.com\support\desinfection to get
the removaltool. After that install ms03-039 from microsoft to prevent from
happening again.

Marina

 

[Keith Henderson]

I'm Having the same problem. I did a clean install after
formating my drive and am still recieving the error. I
manually restarted the service by using the component tool
in the administrative tool folder. Within 30 seconds it
errored again. I cannot cut and paste or click on certain
links with Internet explorer. I did notice before I
formatted that I had the msblast.exe virus. I understood
that XP was the system that was vulnerable to this virus.
I also understood that formatting would remove viruses. I
also understood that viruses do not normally cross into
other partitions. I do have a second partition that I
keep my personal files on that I did not partition. Does
anyone know if this is my problem? Iv'e ran win2000 pro
on many computers, and consider it very stable, so I dont
believe its a issue with the operating system. Any
responce would be appreciated

 

[Guest]

Hi!

Blast virus causes your problem. As soon as you connect
the Internet Blast gets in and and mess the computer. You
can not copy, past even can not cancel the connection.
Connecting speed will be extremly slow. Formating will not
help to you.

I had same problem many times. How did I solved it?

1. Copied patch for Blast from Windows site
2. Downloaded Windows SR packets from Windows Update site
3. Whenever svhost.exe genereted error shot down system
and remove it by blast.
4. Connect again and keep downloading whole SR packages.

My computer is working now. I am not expert but somewhere
Mr Gates' boys corrected it.

Good luck.

I Koc

-----Original Message-----

 

[mike]

I looked at taskmaster and there is no reference to the
blast files you mentioned. I'm totally up to date with
all fixes and patches and stay current with Norton
Systemworks foir virus scanning and definition updates.

Any other suggestions?

-----Original Message-----
You've been blasted.
Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to

www.sophos.com\support\desinfection to get

 

[James]

I looked for those processes, but I didn't find them.
Also, I have scanned twice with Norton antivirus 2003 with
1 day old virus definitions. This problem started even
before I had visited any pages except MS windows update,
and I had not downloaded ANY emails.

Any other suggestions?

Thanks.

-----Original Message-----
You've been blasted.
Open Taskmanager and look for the msblast.exe, mspatch.exe or
teekids-proces. Kill it and go to

www.sophos.com\support\desinfection to get

 

[James]

Why won't formatting help you, I did a complete reformat
of the drive, it was FAT32, I then formatted it in NTFS,
then in FAT32 again and did a completely new clean
installation of Windows 2000 Pro. I don't know of any way
the blast virus could have survived that, but maybe it
did. I also scanned with Norton and it found nothing.

-----Original Message-----
Hi!

Blast virus causes your problem. As soon as you connect
the Internet Blast gets in and and mess the computer. You
can not copy, past even can not cancel the connection.
Connecting speed will be extremly slow. Formating will not
help to you.

I had same problem many times. How did I solved it?

1. Copied patch for Blast from Windows site
2. Downloaded Windows SR packets from Windows Update site
3. Whenever svhost.exe genereted error shot down system
and remove it by blast.
4. Connect again and keep downloading whole SR packages.

My computer is working now. I am not expert but somewhere
Mr Gates' boys corrected it.

Good luck.

I Koc

 

[Chuck]

Why won't formatting help you, I did a complete reformat
of the drive, it was FAT32, I then formatted it in NTFS,
then in FAT32 again and did a completely new clean
installation of Windows 2000 Pro. I don't know of any way
the blast virus could have survived that, but maybe it
did. I also scanned with Norton and it found nothing.

Formatting will help you get rid of the immediate problem. But, in
order for you to apply the necessary updates after reinstalling the
OS, you'll need to go online again. If Blaster is hitting your
network, you'll be reinfected before you can get updated.

Get a firewall or NAT router. It's a lot easier in the long run.
Then go online and get updates.

Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Chuck]

Hi!

Blast virus causes your problem. As soon as you connect
the Internet Blast gets in and and mess the computer. You
can not copy, past even can not cancel the connection.
Connecting speed will be extremly slow. Formating will not
help to you.

I had same problem many times. How did I solved it?

1. Copied patch for Blast from Windows site
2. Downloaded Windows SR packets from Windows Update site
3. Whenever svhost.exe genereted error shot down system
and remove it by blast.
4. Connect again and keep downloading whole SR packages.

If you don't mind taking days to apply updates, this is a great way to
save $50. In the short term.

How long does it take you to earn $50? This way of getting the
updates would cost me at least that much.

Get a firewall or router. It'll pay off immediately in the short
term, and repeatedly in the long term.


Chuck
I hate spam - PLEASE get rid of the spam before emailing me!
Paranoia comes from experience - and is not necessarily a bad thing.

 

[Marina Roos]

Hi Mike,

You won't always find those processes and Norton won't always find this worm
neither.
Get the removaltool and run it. Install ms03-039.

Marina

 

[mike]

After looking at my install record from the MS updates
site, I find that I've had the Blaster patch installed
since the day it was released. I use a cabel modem rather
than a dial-up. HELP!

-----Original Message-----

 

[Michael Johnston [MSFT]]

Are the event logs on these systems reporting any errors? Check the system and application logs. If SVCHOST is crashing, a
log will give us more detail as to what caused the failure.

Thank you,
Mike Johnston
Microsoft Network Support
--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the
terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from
which they originated.