Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
Hi all,
Well last week i had that bloody msblast.exe. I downloaded the patch from Symantec and then Microsoft, but yet im left with the svchost.exe. I have followed all the instructions on the net, and there is nothing that will cure this bummer. I have my anti-virus live updates all updated but nothing is detecting this one. Has anyone got any clues to get rid of it??
I have tried opening Task Manager and end process tree, but it wont allow it. It gives me the error, Access denied.
Any clues as this is urgent now?
that may be w32.welchia.worm.
get "fixwelch.exe" from symantec or:http://www.computing.net/windows2000/wwwboard/forum/50853.html
0 
Are you sure it is a virus? svchost.exe is a legitimate process. See:
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q250/3/20.ASP&NoWebContent=1
0
svchost Problem
Press ALT+Ctrl+Del , open task manager , click the processess option , Now observe.
Is there a SVCHOST.exe and/or SERVICES.DLL
In Upper Case , The case is important.
running along with svchost.exe / services.dll
in lower case ?If yes ,say AHA! 'cause we have nailed the problem .
The lower case ones are vital windows files while the upper case ones are the culprits .
now the 2nd part i.e. if I heard U say AHA!Search for these two SVCHOST.exe /SERVICES.DLL files
They are usually resident in WINNT/System 32 directory / sub directoryNow cut the files or the complete folder if they are in a separate folder and paste them some where say on the desktop.
Restart the system .
Delete the folder / files .
check again the task manager for their presence.
Note :
You cannot stop these services and You cannot delete the files directly from WINNT/System 32 as they are already active.
In these turbulent times you must use a firewall
0
svchost Problem
Press ALT+Ctrl+Del , open task manager , click the processess option , Now observe.
Is there a SVCHOST.exe and/or SERVICES.DLL
In Upper Case , The case is important.
running along with svchost.exe / services.dll
in lower case ?If yes ,say AHA! 'cause we have nailed the problem .
The lower case ones are vital windows files while the upper case ones are the culprits .
now the 2nd part i.e. if I heard U say AHA!Search for these two SVCHOST.exe /SERVICES.DLL files
They are usually resident in WINNT/System 32 directory / sub directoryNow cut the files or the complete folder if they are in a separate folder and paste them some where say on the desktop.
Restart the system .
Delete the folder / files .
check again the task manager for their presence.
Note :
You cannot stop these services and You cannot delete the files directly from WINNT/System 32 as they are already active.
In these turbulent times you must use a firewall
0
OK... does this hold true for the filename SERVICES.exe or SETUPAPI.DLL ???
These both have the same date/time stamp.
ScottL
0
It is the Welchia worm. I was getting the svchost.exe error on one of our remote computers. The results were that I lost ability to open Office files and also lost ability to cut/paste. I formatted C drive, reinstalled 2K and connected to internet (had to do this so I could pcanywhere over norton). In the meantime, the svchost.exe error came up again! How could this happen so fast I thought? Well, it turned out to be the Welchia worm. I ran the symantec removal tool and installed SP4 and all security updates. Now everything is A-OK.
0
High i'm atawi
if you encounter problem with cut and paste
the press the CTL-ALT-SHIFT to view the task manger if you see the capital "SVCHOST.EXE" which is the "BUG" [ do not confused with the
"svchost.exe" which is essential file]
shut-down re-start in save mode go to sys32
there is "wins" subdir [ contain SVCHOST.exe , DLLHOST.exe ], remove this subdirectory ---- it works
0
I have 5 SVCHOST.exe processes running on my PC. None of them are lower case. 3 User Names are SYSTEM, 1 is LOCAL SERVICE and 1 NETWORK SERVICE. I did a search and did not find any SERVICES.DLL files. They are using about 25,000K memory. Are these some of the "problem" svchost files?
0
Is there a NEW VARIANT to the Welchia worm!!!
I have MS XP updated, Symantic updated, run 'fixwelch.exe'. In task manager svchost.exe is never in uppercase.
When I first boot, and prior to logging on the ethernet connection to my ADSL modem is constantly flashing (every half second).After logging on, Task manager shows 100% CPU usage, I then kill the topmost svchost.exe (in lowercase) and CPU returns 2 to 6% usage and the ethernet returns to normal.
Any ideas?
0
Further to my last message, Norton anti-virus 2003 is now nobbled, I can no longer alter it's settings and it no longer 'auto-protects'(wont load at start-up).
The rampant svchost.exe file will have 21000 threads in about 5 minutes, over 60000 after 10 mins
0
I have no SVCHOST.exe process running on my PC, I have scanned the PC with TrendMicro, Also, with the Welchia.Worm.Fix.Tool and nothing found. However, when I go on the internet, I still get the next error: "svchost.exe...., It could not "read" the memory". When the pc is not conected to the internet, I have no problems at all. At the moment, the PC isolated, I have 2 svchost.exe processes running. Could anyone tackle the problem? I will give you all more detail if needed!.
Greetings
0
I am experiencing some problems with the svchost.exe. Is it a virus? When my Windows 2000 PC is connected to the internet, an error message appears, and my cut & paste functions are disabled.
If not connected, then it is fine.
Does anyone know or seen this error message?
"svchost.exe has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created."
Much appreciated for any advice - thanx!
SMB
0
I recently installed an ADSL cable modem and since then when I connect to the internet, a few minutes later, one of my two svchost.exe processes ends with a 'could not read memory' and after that I'm unable to copy-paste and access office apps and the media player says it's 'out of memory'.
I have w2k, tried the fixwelch from Symantec but it found no viruses... any ideas?
0
Hi all,
to answer the previous persons problem just go to Symantec's web site and dl the FixBlast Tool then patch yourself up with the new security update from microsoft you should be fine after that.
Ok my problem is the following it once again involves...yes you guessed it the svchost.exe progy....my firewall seems to be being targeted by this file and i get over 900 attempts at an "apparent hack" which all involve the svc.exe file.
Anybody else hav or had the same problem? if so let me know how to get rid of it cause its starting to get to irritate me a little now.
Thanks all appreciate your ideas
0
I run Win XP since a few days. First discovered that I took over the msblast.exe problem from my old win98. Removed it and installed tne MS patch. Now I still have problems getting on the internet under XP, under Win98 (other partition) no problem.
When I stop svchost.exe (lower case) with user name Network service (may be different in English, I use a Dutch version of XP) I can connect to the internet without any problem. By the way, Zonealarm blocks the outgoing traffic of this Generic Host Process. Now I will look for a way to get rid of this svchost.exe Network service completely.
0
Svchost.exe was never capitalized in my task manager; however, my firewall was being hit up to 1500 times in a matter of minutes. Finally, went to http://www.symantec.com/avcenter/FixWelch.exe and downloaded. Sure enough had the Welchia worm. Removed it - no more problems.
0
This is a follow up on the message posted by "wambo". I had the welchia worm and using fixwelch.exe solved my problem quickly and easily. I would recommend this solution to anyone. You can get this symantic removal tool at: http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
Just download it and follow their instructions. It should solve the problem - it solved mine!Good luck,
Heidi
0
Took Shirley's and Heidi's advice and downloaded FixWelch.exe from www.symantic.com. Ran the fix and it reportedly found and removed the virus. I'm running Windows 2000. After restarting my computer and running the fix again it tells me the W32.Welchi.Worm was not found. But when I get on the internet and try to download I'm still getting "Svchost.exe has generated errors and will be closed by Windows. You will neet to restart the program. An error log is created."
Any advice?
0
I got the same pop-up(svchost.exe)
I have download msblasterfix,service pack 4,welchia fix.i'm running 2000 pro.
I got no svchost.exe in capital letter.
Is there anyone can help us ?
0
I think I have this worm, but I'm not sure. I am running the Symanetc Welchia Worm removal as we speak though.
My internet has become immensely unstable for some reason. It will randomly shut off every few minutes, and then come back a minute later. While trying to figure out what was wrong, I saw several svchost.exes running. I knew there were supposed to be a few running, but there was an exact duplicate (ran by the same "user." Plus it was eating up a little CPU (not 100% like some have said). So, I shut that one off. Windows popped up with a message saying that the computer would shut down in one minute... this reminded me of blaster. Just for kicks, I tried stopping another svchost, but it did not come up with that dialog, instead it said, "This cannot be turned off by the Task Manager." I am guessing that this has to be some virus... if not this worm. Any ideas?
By the way, after shutting off that duplicate, my internet is seemingly running smoothly.
Thanks,
-Dr. Zoop
0
For the svchost problem, if you don't detect anymore virus, you need to dl the microsoft secutity patch from :
http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe
(for win2000)It must exist the same for XP. See here :
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/msblaster.aspThis security patch have fixed my svchost problem. I still have 3 svchost in the task managerbut it seems normal. I didn't had blaster or welchia and I don't know why i had this problem.
PM
0
i have tried patching the system with microsoft patch, also ran fiblaster, and did a stinger check on my system (xp home, no viruses found, but still no joy, svchost is still hogging all the process power when i go onto the internet, using norton antivirus which has been updated, any ideas
0
The svchost.exe virus file in the system32\wins directory runs as a system service and can be disabled from the services list from within "administrative tools" in "control panel". It calls itself "Network Connections Sharing" and describes itself as "Coordinates transactions that are distributed across two or more databases, message queues, file systems, or other transaction protected resource managers." Right click and select "properties", press the stop button and change the start-up type to "disabled"
The dllhost.exe in the system32\wins directory also runs as a system service and calls itself "WINS Client".
You have to stop the services before you can delete the files!
Each service's "properties" page shows the path to the file being used so you can check for any service which points to the dodgy location. That's how I found them. Your version of the virus might call itself something else though.
0
Here is how to end svrhost.exe process.
right click on the process select debug.
if you have VC++ debug window will show up. Just close without saving if not the process just die (both SVRHOST.exe and SEVICES.DLL)
now you can delete the file and get an other svrhost.exe and sevices.dll from MS (recomend down load it first before deleting so you can install it before restart in case the system need the file to bring up window properly) good luck
0
I had more than 4 SVCHOST.exe (without distinction between lower or upper case) running on my pc. Searching "svchost" on the file system directory I found more than 1 examplaire on c:\windows\system and c:\windows\system32.
Each pc has to get 1 svchost.exe weighting 13ko.I,
deconnected my pc from the net,
desactivated the restauration of the system:
Run>My computer>right click properties>system restauration>click for desactivation.
removed all recent svchost files (svchost.exe (15ko), svchost32.bat and svchost32.cfg).You can have an online virus detection on
http://securityresponse.symantec.com/ > check for security risksI activated then the restauration
And have no more problems ...
good luke
0
Hey all
i got the same thing i have win2k server
and i formated couse my control panel icons where all moved too one side..
now i get the svchost.exe running in triple
but thats part of microsoft... what i read so far seems too be,,
but i get DLLHOST.exe that s soppesed to me microsoft but i don t think it is
i get smurf attacks like crazy when this sucker is in mem and my cpu usage is very high...
anyone know more on that thank
0
Hello,
Thanks for your reply and suggestion. I looked into the patch info for Win 2000 . My machine has windows professional 5.00.2195. I like to know which patch set works for me.
After fixing the worm, I have two (2) svchost.exe processes running on my machine as follows:
svchost.exe 2008K
svchost.exe 12816KIs it ok to have as above?
Thanks in advance.
Ram
0
As Pepe Malin Says in response number 23, i had the same problem and i followed his instructions and my computer is working very well...i gonna paste his procedures again: Thanks
For the svchost problem, if you don't detect anymore virus, you need to dl the microsoft secutity patch from :
http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe
(for win2000)
It must exist the same for XP. See here :
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/msblaster.aspThis security patch have fixed my svchost problem. I still have 3 svchost in the task managerbut it seems normal. I didn't had blaster or welchia and I don't know why i had this problem.
Thanks Pepe
0
the very same story as Judd's from the response 19.
then followed Pepe's advice from the response 22.
the problem seems to be resolved now.
thanks all.
0
I have 4 copies of SVCHOST.exe running and SERVICES.exe is running 1 time. When I end the SVCHOST.exe processes I get the 30 second till shutdown RPC error.
I scanned with FixWelch.exe and FixBlast.exe
I have up-to date PCCillin, scanned with Norton, SP and patch (on my XP machine)Windows sucks!
0
I've got DLLHOST.exe and SVCHOST.exe at task manager. It's w32.welchia virus. After doing the following, the virus seems gone.
1. Restart the PC in safe mode, Delete the 2 files from the directory : window/system32/wins
2. Download the microsoft secutity patch from :
http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe
(for win2000)3. Get the symantic removal tool at: http://www.symantec.com/avcenter/venc/data/w32.welchia.worm.removal.tool.html
Good luck!
hate_virus
0
Hey...been trying to solve this problem for a couple days, and think I may have found a solution. I am not a computer person, so please don't jump in and follow my adivice...although it has seemed to work for me. I had four versions of SVCHOST.exe (All Caps) running (also icon-ed as zip files - but labled with igim?). I right clicked on each to find the associated programs - which were bigfix, AOL, etc - In my windows folder, these files were also icon-ed as winzip files. I moved them to a floppy disk (just in case), and the deleted them from my folder. Everything is working fine now, without anymore SVCHOST.exe programs running...Did I do the right thing???
I ran virus scan prior, and the fixwelch (which said I was unaffected) also there were no files by the names of SVCHOST.exe, SERVICES.exe, or DLLHOST.exe in sys32
Zach
0
after several attempts of removing the svchost virus which had several running and would cause the system to shutdown with a timed warning i decided to delete the svchost files of which since the virus has been removed but windows will not boot in correctly and i cannot get my cable modem to recognise the network, also i cannot install any software as it says windows installer not working correctly !! any ideas grateful
0
If the lower case svchost.exe files are important system files, why when i try to end process on them does the blaster window come up with the "windows will shut down in 60 seconds" message!? I've had and deleted msblast.d. and nachi. Again, any advice is appreciated (btw i'm running XP)
0
I experienced the same problem on a friends computer!!! Desktop did not respond!!
Could not copy or paste !!
Norton couldn't auto update!!
I did everything from (remove-tools)to
FDISK repartisioning his harddrive and reinstalling win2000!! AFTER-
As I was trying to auto-update Norton,
"BAM"!! there it was again (svchost.exe)
So i trashed NORTON and the problem disappeared!! Installed(MCAFEE)!!
NO PROBLEMS !! Could it possibly be some
people use unlicensed copies of NORTON???
STRANGE !!!! something to CHEW on!!!
0
I am getting the svchost.exe problem and when I try to close it in task manager I get the the little box with 1 minute countdown to restarting computer.
I ran welchiafix..got nothing
Ran fixblast...got nothing, ran stinger...
Put in the patch anyway....I have Mcafee virus scan which is constantly coming up with a list of visuses just deleted yet still when I run virus scan on the entire c-drive it says c-drive had no viruses.I beleive the existance of the svchost.exe virus is a portal through which other viruses can get onto the computer evenm when the computer is visus protected.
I also think it's not just a simple portal but more like a portal that gives viruses direction..such that it's like calling viruses on the internet to enter.
I deleted the WINS folder when I had the SVCHOST problem but it just continues with svchost.
Either my hard drive or some hardware is making alot of ticking noises but this may not be related to the svchost stuff since hardware failure shoudl not be related to software issues like viruses...however if the svchost uses up so much memory it may be overworking some device which is now starting to fail...I think it's the hard drive.
Is it ok to totlally delete all svchosts form the computer and what's the significance of svchost with NETWORK and SYSTEM?
How do I fix this virus problem?
0
Ok...This virus thing is driving me crazy. I`m not a computer person by any means, and I really need some help. I live in Japan, and no one around me can read my computer, because its in English. I`ve deleted the files that everyone says to delete, and I got the Microsoft patch, but after that, my laptop just got worse! My registration to the internet was deleted, and I can no longer connect. My visuals for java are still jacked up, and I can`t cut-paste like everyone else. So, being that I cannot use the internet to help, what should I do? I have a lot of very, very important information on my laptop, and I really don`t want to reformat - which doesn`t seem like would help anyway....please someone help me!!!! Thanks....
0
I think I got rid of the virus using FixWelch, but I'm a bit worried because I have 5 svchost.exe running:
svchost.exe SYSTEM 4,500K
svchost.exe SYSTEM 19,000K
svchost.exe SYSTEM 4,200K
svchost.exe NETWORK SERVICE 3,400K
svchost.exe LOCAL SERVICE 4,100KIs it okay to have 5 of them running at the same time. I thought it was strange that I have 3 SYSTEM ones that total up to about 27,000K. Any advice is appreciated.
0
To those of you who are asking about the svchost.exe's, and after running fixwelch.exe, fixblast.exe, or stinger did not find any worms: svchost is a service windows requires. In many cases, svchost.exe is called many times by different dlls. This is why when you shut these down, windows will autorestart; Windows cannot funtion anymore if these are gone. If there's nothing wrong, don't be like a psychosematic patient and fix something that was never broken.
Also to #39, i believe you're svchost.exes are legit, but i have not heard of system running more than once. you should look into that as the problem.
0
Hi
I also have the same problem as #31 & #39. I am running xp home edition and have followed all procedures, dowloaded patches, run fixes and updated the latest anti virus software (mcafee, norton, stinger). I have deleted the wins directory and checked the registry for offending entries.
Incidently in task manager all svchost.exe will restart after 'end process' apart from one labelled as SYSTEM and is consistently between 4.2k and 4.3k in size - this one will immediatly launch the 1min countdown nt authority box and log me out.
I would be grateful if anyone has managed to solve this or if anyone running with multiple svchost.exe processes gets the same bug but may have a machine working normally.
thanks
0
hey guys,
i've had this svchost.exe virus for acouple of days, looked into tonight and for me it seemed alright enough to fix
i had downloaded the KB823980 file from MS (that should fix up the blaster virii and subsidiaries)
also got the Q815021_WXP_SP2_x86_ENU.exe from the microsoft site, which fixes the Welchia Worm (well the WebDAV exploit)
see this link for solutions:
http://www.pchell.com/virus/welchia.shtmlnamely, remove (if running XP) the files in the subdirectory c:\windows\system32\wins
wins shouldnt be a directory thereof coz you have to kill these processes (should be exe files in there)
for me it was lower case svchost.exe, im not sure if this does differ amongst computers or not.
as for having several processes of the same variant, i am currently having one svchost run in LOCAL SERVICE, another in NETWORK SERVICE and two in SYSTEMthe problem i was having before was my uploads were going like crazy and ididnt know to where - this is now solved for me.
hope it helps all,
Jon
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
