IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice

[SOLVED] svchost.exe keeps crashing!

8317 Views 5 Replies 2 Participants Last post by ~Candy~, Oct 1, 2003

kenbattou

Discussion Starter · Sep 29, 2003

Hello! I've been searching countless forums and have done almost everything they told me to. I don't have blaster or welchia or fizzer virus. Downloaded the removal tools but it came up empty. The weird thing with mine is that immediately upon startup my svchost crashes and not in 5-10 mins like what others report. Norton antivirus doesn't start up also (which I initially thought to be fizzer) nor can i copy+paste or do any office applications. I've had this problem for days now and am finally at a loss. Can any guru help me?? Pls?? Your help will be greatly appreciated.

My Hijack log gave me this:Logfile of HijackThis v1.97.2
Scan saved at 5:40:00 PM, on 9/29/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\Program Files\HHVcdV5Sys\VC5SecS.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Mixer.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\HHVcdV5Sys\VC5Play.exe
C:\Program Files\Virtual CD v5\System\VC5Tray.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\winnt\googletoolbar_en_2.0.95-big.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\winnt\googletoolbar_en_2.0.95-big.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [VC5Player] C:\Program Files\HHVcdV5Sys\VC5Play.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://c:\winnt\GoogleToolbar_en_2.0.95-big.dll/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37878.1170833333
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

One more thing to add. I recently discovered about 10 bad sectors in my drive. These are new. I ran Gibson's SpinRite 5 and hopefully had these fixed or at least marked so it won't be used. Can this be the cause of svchost generating errors? my pc is dual boot and only Windows 2000 has problems while Win 98 is fine. Please please, if anyone out there knows the solution, I badly need your help. Much thanks in advance. ^_^

See less See more

Save

Status: Not open for further replies.

1 - 6 of 6 Posts

kenbattou

Discussion Starter · #2 · Sep 29, 2003

Just installed the patch microsoft provided. It runs better now but I still get the svchost error. Norton AV is working again and I did a full system scan again (w/ the latest definitions) and came up empty. Copy + paste works as well as microsoft office (as far as i tested it which was very little. before it would generate an error message in starting it up but now it doesn't) I find this very weird because after installing the patch things worked better but I was never connected to the net. How come so many things got screwed up? Anyway, I still don't have a network connection to my local lan nor an internet connection. When i click on the dialer (I use RasPPoE for Adsl) the svchost message pops up again and another message saying that the connection to my realtek adapter can't be found. the svchost error pops up intermettently even when I'm not doing anything. My W2k had sp4 long before this svchost fiasco. Any ideas??

Save

~Candy~

· #3 · Sep 30, 2003

I've split you into your own thread, and here is a cut and paste from a response you had in the thread you posted to:

Originally posted by buckaroo:

kenbattou....nothing going on with your log either. I'm going to ask a mod to split your problem off onto it's own thread so you;ll have a better chance of folks seeing it.

Save

kenbattou

Discussion Starter · #4 · Sep 30, 2003

My apologies to everyone who was confused and for piggy-backing onto an existing thread. I wasn't aware of what I was doing.

AcaCandy gracias por su ayuda. Buckaroo, thank you for your reply.

Anyway i was reviewing the events and found what was happening. I still don't know WHY it's happening or How. My remote access control manager (RasMan) terminates unexpectedly and denies access (I have administrator privelages). i try to manually start it but it doesn't and stops the telephony and sometimes the Com+ and system event notifier services along with it. It doesn't start up either when the computer restarts because it says it can't create a buffer. Then every 5 minutes it tries to start itself and then terminates unexpectedly again taking out the telephony, etc etc services. I've disabled the RasMan temporarily and I don't get a svchost error...that is until i try to start it again. As of now, i'll keep it disabled until i can find a solution. Might anyone know what is going on and know a solution? Thank you very much.

See less See more

Save

kenbattou

Discussion Starter · #5 · Oct 1, 2003

To all those who might have this problem in the future, I was finally able to fix it. I redownloaded the network installation of W2k Service Pack 4, burnt it to cd and ran it onto my computer. Now I'm finally able to go back onto the internet and my computer is back to the state it was before. I'm going to go to Windows Update to download the latest hotfixes and patches so this doesn't happen again.

:up: :up:

Save

~Candy~

· #6 · Oct 1, 2003

Cool, thanks for letting us know

Save

1 - 6 of 6 Posts

Status: Not open for further replies.

Top Contributors this Month