Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
Hi,
I have been fighting this "svchost.exe crashing" problem for past couple of days now. And I thought I would share some findings with you. Searching the net for any type of fix was pretty much "It's a Blaster, here are the steps to remove it...." answer.
So here it is:
Apparently, KB823980 patch did not really fix the problem with RPC vulnerability - or it fixed that but broke some other things (not sure what the right answer is).I have done a little bit of homework on this issue and here are some causes and behaviors:
Cause 1: Patched computer gets hit by another, infected computer.
Cause 2: Patched computer is scanned - the fun part - with Microsoft's KB823980Scan tool.
Behavior:
1. svchost.exe generates errors and crashes.
2. Remote Procedure Call (RPC) service stops and logs it in System Log with the Event ID 7031.
3. Cut, Copy and Paste does not work.
4. Drag and Drop does not work.
5. Add/Remove Programs is not being displayed properly.
6. Some functionality of IE is gone.
7. Missing icons from Network and Dial-up Connections.
8. "Web view" on folders does not work (WINNT folder, System32 folder, Control Panel etc.)If you start Remote Procedure Call (RPC) back, Cut, Copy and Paste will be restored, but that's about it. If you need to, let's say, remove a program, you have to reboot and try it before svchost crashes again.
The only thing that has worked for me so far, is running a firewall on the affected computers. Just to clarify, those symptoms did not appear on all tested machines (about 30-35) but only on about 4-5. Tested machines are running Windows 2000 either Server or Pro.
Personally, I see another patch coming from Microsoft to fix this issue. The question is: WHEN?
Hope this helps for all you researchers out there that are looking for the same answers/possible resolution to this problem.Regards,
MikePS. I did not even have Blaster/Welchia/Whatever virus/worm on my computers. It all happened after installing KB823980 fix.
Search the affected computers for msblast.exe or msblaster.exe and detele it if found. You may not think you have it, but better to be safe than sorry. This is probably the case, as copy/paste will disappear once svchost.exe and a few other things have crashed.
Reinstall the MS update on the computers that were affected and try again.
0 
Mike,
Have you actually read my post? I appreciate you taking the time and responding to it, but that's not the answer. Like I've explained before - there are no viruses. Also, re-installing MS patches does not work.
Does anyone know when MS will release another patch?
0
I too have your problem, in that I've done the blastfix and scanned my comp about 3 times- no ms blast worm to be found. Have you reently installed a service pack as I just installed Win 2000 service pack 4 and I reckon that caused svchost to corrupt. Oh well.
0
I have that problem too!
I don't say it a know virus.. i can't belive.
I have dowload today all know antivirus software, and none dectect anythings.I have 3 PC's networked, and only 1 have that problem.
After many format's; install; etc; the problem appears.
I tryed to substitute the PC.
I take another PC, with no problems, put the Secundary Disk that only have backups, in that PC, and change CD-RW too.
I started, no problems. Instaling a CD from a ISP for ADSL access.
A fewer minutes later, I have the same problem.
If the CD are new, i think that CD have some virus, but the CD have about one year! This problem a few days.
I am now instaling the PC with other CD from MicroSoft, and connect my Secundary disc.
Until now I have no problem..
But i can't connect the PC to the internet..
I beliave that is a virus, but some thing new
Anyone can help?
Tks in advance
0
Hi,
I understand that you don't have the blaster.worm virus anymore but I bet that you had it few days ago.
Your problem is a direct consequence of the virus, I had the same troubles.
What you have to do is to install three microsoft updates.
Go to windows update and install:
- windows 2000 service pack 4
- MS03-026: 823980 - Windows protection
- 822925 Internet Explorer 6 Service Pack 1This will solve your problems.
0
but before you download the update, you may want to get a firewall installed to block the blaster worm.
0
I am facing the same problems as initially observed by funlandrobot. I downloaded the fixbalster for symantec and then the MS patch but that gave rise to svchost.exe problems. i downloaded SP4 but that intensified the problems.
I have reloaded W2k with Sp1. Running Sp3. Then I checked for blaster. Finally, I downloaded the KB823980 Patch --- and guess what, the svchost probelem reappeared.
I am at my wits end (being a non-IT person). so if any of you have discovered the solution, please do let me know.
cheers and best of luck
0
I have same problem. I have instaled W2K sp4, KB823980, IE6 sp1, and after that symantec wrote that there is a Blaster Worm in the system and was removed. But problems with svchost.exe is not solved.
0
Hi all,
Same problem found in my company and we are still trying to deal with it.
We have automatically updated no less than 300 machines and at least in 13 of them we are experiencing those problems with cut, copy, paste, drag and drop, etc. Of course it was after installing the patch on them.
Don't know if its a brand new virus but what I think is that the *** patch has corrupted some windows stuff.
0
I had (have) the "svchost.exe problem". After reading the above, I found "msblast.exe" (but not "msblaster.exe"). I could not delete it (the system would not allow this), but I moved it to the desktop, renamed it, restarted and then deleted it. It seems that I still have the svchost problem, however. I'll keep trying...
0
Hi Again!
I'm the same from Response nš4.
I follow all that procediments, Win2000, SP4, ALL MS updates. I donwload from other machine, put on CD, and installed in the win2000 PC.
Also donwload Antivirus, all updates, and Firewall.
It works!!!
Finally, the PC start working, and i have blocked all "svchost" connections for out.
Past 48 hours, PC started again with problems, and this time don't "see" the ASDL, neither other PC's on the network!!
I dosen't know what more can do..
Intalling all PC every 24 hours?
0
Figured it all out, well for the most part anyways - can't get on the network, but I can copy and paste again, as well as open up property windows, programs that wouldn't run before, links on iexplorer!!
IT was actually really easy once I found the right info.
type in services.msc in the run window
make sure that the RPC service is started
mine was turned to manual and was not started.
I turned it on and there you go!
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
