Win XP problem - svchost.exe

L31mr0d

Ok my systems been spewing out errors for the last day or so. I managed to track down the solution to one of them (MSN 7.5 was causing an error by starting at boot time, I just turned that off)

I'm getting this other one in Event viewer
"Faulting application svchost.exe, version 5.1.2600.2180, faulting module netapi32.dll, version 5.1.2600.2180, fault address 0x0000a3c0."

Event ID: 1000

I replaced netapi32.dll with a new one I d/l'd but I still get the error. The error pops up after a few minutes of browsing online and causes me to not be able to open up "windows firewall" in control panel. This instantly set off virus warnings in my head, as only a virus would want to cause me to not get access to my firewall. So I ran AVG, HiJackThis, Ad-aware, Panda activescan, roguescan fix... to name a few. They all found nothing. So i'm guessing now it could just be a problem with svchost.exe, as a few other errors have popped up (samurize, Windows Firewall/Internet Connection Sharing (ICS)) which have both had "Faulting application svchost.exe" in them.

Is there any way of replacing svchost.exe or troubleshooting why its causing problems?

Also i've ran chkdsk at boottime which did nothing (does it ever do anything?) i'm thinking about running the repair off the XP CD, is this different to chkdsk? Also are there any possible ill effects from running the repair off the XP CD?

Ruu_Old

Do you use System Restore, maybe rollback to a few days back to when it wasn't happening?
The repair install will replace all the system files but leave your settings intact, however some updates might have to be reinstalled.

L31mr0d

right how do I roll back a couple of days with "system restore", i've checked in my computer properties and it says it is enabled but there is no option there for rolling back?

Ruu_Old

Start->Programs->Accessories->System->System Restore and it will give you the option of Creating/Restoring from a restore point. It will show you a calendar and just follow the on screen instructions from there.

-DuMbGuM-

mabye try start>Run>Msconfig>startup and disable svchost.exe and see what happens

angelofdeath

svchost.exe is a number of programs or services rolled up into one process, you can't disable it afaik

it could be a problem with your ram, try reseating your ram and running memtest86

Ruu_Old

You can disable some of the services related to svchost.exe through Control Panel->Administrative Tools->Services. Unfortunately the same file is registered or linked to a trojan.

Zillah

My PC is currently running seven versions of svchost spread evenly through user/system/network service. I know from experience that you can shut down some of them, but the wrong one will kill the system.

There's got to be a way I can safely limit their number?

Hobbes

svchost is part of windows. You can't do anything with it unless you like breaking windows even more.

You can use TCPVIEW to see what the command line was to run that particular svchost. You can get this from www.sysinternals.com

Sounds like you have been hit by some sort of trojan tbh.

Dooom

Aye, here's another vote for the trojan. Generally speaking, svchost doesn't act up, but when it does it usually means something other than Windows is fupping around with it.

Iirc, it's one of the Network System or System processes that kills your system if you end it. I remember playing around with it before.

Sam Vimes

coulf be a virus calling itself svchost.exe. there's usually a few copies of svchost running so calling it that would be a good way to hide. at the moment i have 5 svchosts

irlrobins

Process Explorer might provide more info than the Windows task manager.

Tobias Greeshman

As Ruu said SVCHost.exe is a process that incorporates a whole host of services, so you can't just shut it down. It spawns various instances of itself. Its not uncommon to have up to five or more instances of it. One thing it does handle is COM, if you kill it, you'll notice copy/paste no longer working, and windows becoming pretty much unusable.

I know the Blaster worm, infected svchost, I wonder could it be this or something similar to it. I remember getting infected with this at the time, major pain in the ass.

I'd try running a scan of your pc, see if anything turns up before doing a restore.

L31mr0d

Yeah but nothing seems to be finding any trojans? Usually Panda activescan throws out something in an attempt to get you to buy their software but its clean. I had a pretty bad virus about a month ago, but I cleared it out.

Anyway, I went through my event logs and found that the first instance of this error occured on the 12th, right after i'd been running diskeeper for a few hours (could a defragmenter have caused it?) So I did a system restore back to the 11th, I got nothing whilst browsing the net, so I went to bed and to alleviate any chance it was faulty RAM I ran the Blend torture test in Prime95. When I got up this morning the error was back on the screen, and prime95 was still running away. The fact its the same error over and over again leads me to believe it isn't random errors caused by faulty RAM.

When I restart the computer, windows firewall can be accessed fine, its only after an hour or so that this error pops up and doesn't allow me access to the firewall.

I'm going to try the repair off the windows XP cd, is there any chance I could lose any of my programs, settings or files doing this though?

EDIT: This is what I get under svchost.exe when I run tasklist /svc in cmd

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Leigh>tasklist /svc

Image Name PID Services
========================= ====== =============================================
System Idle Process 0 N/A
System 4 N/A
smss.exe 676 N/A
csrss.exe 740 N/A
winlogon.exe 780 N/A
services.exe 828 Eventlog, PlugPlay
lsass.exe 840 PolicyAgent, ProtectedStorage, SamSs
svchost.exe 992 DcomLaunch, TermService
svchost.exe 1052 RpcSs
svchost.exe 1192 Dnscache
svchost.exe 1224 LmHosts, RemoteRegistry, SSDPSRV, WebClient
spoolsv.exe 1548 Spooler
avgamsvr.exe 1676 Avg7Alrt
avgupsvc.exe 1692 Avg7UpdSvc
svchost.exe 1724 BthServ
cisvc.exe 1752 CiSvc
DkService.exe 1780 Diskeeper
LSSrvc.exe 1820 LightScribeService
MDM.EXE 1872 MDM
nvsvc32.exe 1896 NVSvc
StarWindService.exe 312 StarWindService
svchost.exe 344 stisvc
wdfmgr.exe 452 UMWdf
alg.exe 1208 ALG
explorer.exe 444 N/A
avgcc.exe 908 N/A
avgemc.exe 1356 N/A
nvraidservice.exe 2064 N/A
ctfmon.exe 2220 N/A
msnmsgr.exe 2264 N/A
LWEMon.exe 2308 N/A
Client.exe 2564 N/A
SysTool.exe 2588 N/A
unsecapp.exe 2636 N/A
cidaemon.exe 3076 N/A
svchost.exe 4044 EventSystem, helpsvc, Netman, Nla, RasMan,
Schedule, SENS, TapiSrv, Themes, winmgmt
wmiprvse.exe 1336 N/A
IEXPLORE.EXE 3024 N/A
IEXPLORE.EXE 2836 N/A
avgwb.dat 568 N/A
Prime95.exe 3792 N/A
cmd.exe 3968 N/A
tasklist.exe 3596 N/A

C:\Documents and Settings\Leigh>

irlrobins

L31mr0d wrote:

I'm going to try the repair off the windows XP cd, is there any chance I could lose any of my programs, settings or files doing this though?

There is always a chance. But in theory, it should leave all progs and data as is.