PDA

View Full Version : SVC host.exe



demario
23-01-2004, 07:23 PM
Hi everyone,have a friend who just had a new pc built.P4 2.8,512 ram,windows 2kpro.Every time he logs on to the net after a few minutes he gets a dialogue box saying svc host.exe.-will be closed by windows,need to restart programme.ALso when this happens the cut and paste function ceases to work as well.He does not have any antivirus software installed or ad aware or anything.Is this a virus,worm,trojan??,or just an error,any one got any ideas???

stu140103
23-01-2004, 07:40 PM
> Is this a virus,worm,trojan??

Nope svchost.exe Is NOT a virus, worm, trojan, it is a system process.

Babe Ruth
23-01-2004, 07:41 PM
Could very well be a trojan (or a virus, or nothing at all !)... there have been a number of threads on this subject in this forum. However=>

Get a small av scanner to help with problem Stinger_av (http://vil.nai.com/vil/stinger)

Get a free antivirus program from AVG Antivirus (http://www.grisoft.com/us/us_dwnl_free.php) don't forget the updates for each of the above programs
Get a free firewall from FREE ZoneAlarm (http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=zadb_zadown)
Get Adaware from AdAware (http://www.lavasoftusa.com/)
Get Spybot Search & Destroy Spybot (http://www.safer-networking.org/index.php?page=download)
Get Spywareblaster SpywareBlaster (http://www.javacoolsoftware.com/spywareblaster.html)

Install and configure and update all the above and run each of them

and don't forget the updates for each of the above programs (especially ongoing), also see the FAQ page in particular 8b (upper right of this page)

Cheers, Babe.

godfather
23-01-2004, 07:44 PM
The symptoms suggest its infected with W32Blaster.Worm
That disables cut and paste as well as giving that error.

Simply put, you cannot now connect to the web with Windows 2k or XP without having the OS fully patched and up to date.

Babe Ruth
23-01-2004, 07:55 PM
Forgot to mention you need to install Service Pack 1 for Xp and the Security_Rollup_1 patch ... both available from MS. Of course if you have the MSBLASTer worm/trojan you may have a little troulbe .

Cheers, Babe.

dumdum
23-01-2004, 08:01 PM
Stu`s right...sVchost.exe. is part of system...BUT....sCvhost.exe. is a virus.
This subject was just covered in the last day or two.

DD.

demario
23-01-2004, 08:09 PM
I just had a look on my pc,as the one in question is a friend of mines and it says svchost is a windows generic system,so therefor its not a virus.So if not why would it be coming up in a the dialogue box saying it needs to restart?Maybe windows hasnt been installed properly??Cheers for your imput everyone!!!

stu140103
23-01-2004, 09:04 PM
>So if not why would it be coming up in a the dialogue box
> saying it needs to restart?

Has you friend applied any windows updates patches & server packs???? As that sounds like Blaster! See godfather post.....

godfather
23-01-2004, 09:27 PM
Some symptoms of infection by MSBlaster are:

1 Error message that svchost.exe (or other software) has generated errors and must be restarted.
2 Not being able to copy and paste in various applications
3 System instability - applications that stop suddenly with no error message and will not restart
4 Unusual network traffic
5 Virus software that will not function properly
6 Inability to install new software


The fact it happens when he connects to the web gives a very high probability its the virus.

Babe Ruth
23-01-2004, 09:37 PM
In addition to GF's reply, the following article {below} will help explain and give removal/fix instructions/information. You should read this from a non-infected pc and printout for reference. Download the appropriate fixes/updates etc as mentioned earlier in this thread.

How to Remove MSBLAST worm virus (http://www.pchell.com/virus/msblast.shtml)

Cheers, Babe.

drcspy
23-01-2004, 09:50 PM
blaster or nachi without a doubt

demario
23-01-2004, 11:49 PM
ok,cool.thanks for that godfather.Will endeavour to try and fix it for him... :)

metla
24-01-2004, 12:07 AM
All you need to do to avoid the blaster worm is enable the inbuilt windows firewall.

As a little experiment im currently running a complety unpatched install of XP,No anti-virus either.

No dervice packs.

No additional firewall.

Been like this for a month now.

metla
24-01-2004, 12:08 AM
*service packs