svchost.exe not found or missing sub components on logon

[Guest]

Hi

I have a Windows 2000 machine previously infected with the MS-Blast and Sasser viruses. The machine has been scanned and cleaned by Stinger, Ad-Aware, all security updates installed including SP4 and is generally working well

However, on login with any user, I get an error message telling me that the svchost file is missing or corrupt. I have had a look in %systemroot%\system32\ and there it is. I have also searched the registry and the file locations match

When accessing Task Manager, svchost.exe is present, and in addition is a file called svcshost.exe. Any ideas what this is??

The bottom line is that I would like to rid of this error on logon, as it is driving me up the wall

Any advice gratefully appreciated

MrMar

 

[Alphonse]

Quoting someone EdK:
"that is a trojan file...IN ADDITION to using an AV to kill it, go to the
mfg
web site and look for instructions to make sure all traces are removed from
your system...some AVs do a better job than others....."

Hi,

I have a Windows 2000 machine previously infected with the MS-Blast and
Sasser viruses. The machine has been scanned and cleaned by Stinger,
Ad-Aware, all security updates installed including SP4 and is generally
working well.

However, on login with any user, I get an error message telling me that the
svchost file is missing or corrupt. I have had a look in
%systemroot%\system32\ and there it is. I have also searched the registry
and the file locations match.

When accessing Task Manager, svchost.exe is present, and in addition is a
file called svcshost.exe. Any ideas what this is???

The bottom line is that I would like to rid of this error on logon, as it is
driving me up the wall.

Any advice gratefully appreciated.

MrMark

 

[Jason Hall [MSFT]]

--------------------

From: "Alphonse" <[email protected]>
Subject: Re: svchost.exe not found or missing sub components on logon
Date: Fri, 21 May 2004 12:56:27 +0200

Quoting someone EdK:
"that is a trojan file...IN ADDITION to using an AV to kill it, go to the
mfg
web site and look for instructions to make sure all traces are removed from
your system...some AVs do a better job than others....."

Hi,

-----------------------

NOOOO!!!

It is perfectly normal to have more than one instance of svchost.exe
running at any particular time.
Svchost.exe is the process that hosts many of the services that run on your
machine.
These many services are grouped together into multiple instances of
svchost.exe (you can actually control the groupings if you edit a few
registry keys)

I think that what Alphonse is referring to (in regards to this "trojan") is
SVCHOST.EXE (not svchost.exe), if you see this process, kill it and delete
the file.

It is IMPORTANT that you do not kill svchost.exe, or else you will see a
lot of your services disappear.

In regards to MrMark's error, I would recommend running SFC /SCANNOW to
rectify any possible corruption issue.
Also, check in the Run registry key and disable any startup apps that could
be causing this error.
(A quick way to find out if it is a startup app that is causing the error
is to boot into Safe Mode, which loads no startup apps)

It's also probably a good time to scan for spyware.

--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.

 

[Guest]

Hi Jason Hall
I also facing the same problem in 3 PCs in my SOHO.At first these systems
are infected by Sesser & Blaster warm & i have cleaned these viruses with the
removal tool And Stringer then i have updateed my windows.Now the Symantec
Enterprice Eddition is installed and updated Still The massege comes at the
startup "svchost.exe is not found"
In the news you have writen about the changes in the Registry,
Can you explain me which steps should i follow to kill this problem.
Regards
Sumit (MCSE) from India.