svchost

brandnewspoon

howdy, are there any fixes or service packs for win2000 to cover that feckin windows svchost program? every time i try to use the net it goes kapoodle and loads of links and the copy and paste function hit the fan. any advice?

Dun

Sounds like you may have gotten the blaster virus. You can go to the Microsoft site and download a patch, though if you're running XP you need Service Pack 1 installed (SP3 if you're running Windows 2000). The most user friendly-ish way of doing it is through Windows Update, though if you've never used it, it's likely it will have another update for it. Search this forum for blaster, as it's come up umpteen times, and you'll find links to the specific MS patches, and the Symantec removal tool.

ColmOT [MSFT]

If you go to Windows Update, and look for a patch with KB 824146 in the title, this is the one you're after.

You can get this by going to http://v4.windowsupdate.microsoft.com
Click on the Personalise Windows UPdate link on the left hand side of the page
Check the Display the link to the Window sUpdate catalog check box
Click Save settings button
Click on the Windows Update Catalog link
Click the link Find Updates for Microsoft Windows operating systems
Select your OS & Service PAck level from the list
Click the Advanced Search options button and in the COntains these words textbox enter: 824146
Then click search.

ChipZilla

You have to quick with this after you log in:

START -> RUN

Type compmgmt.msc and hit enter.

Go into "Services And Applications" and then "Services".

Find "Remote Procedure Call (RPC)" and disable it, or go to the recovery tab and change the "First Failure" response to "Take no action".

Download McAfee Stinger (You'll probably need to download this on another machine, but it fits on a floppy):

http://vil.nai.com/vil/stinger/

Once you're clean, enable the above service again, or change the recovery response back to what it was before.

Reboot and make use of Windows Update now that you can get on the internet again. And buy some some AV software...:ninja:

brandnewspoon

thankingyou...

cubix

Lads not sure if it is the same problem but running Xp and every time I connect to the net(with netsmart) after about 4-5mins I get these msg's in this order

The standard pop up from MS saying there was a problem and do I want to send a report:"generic host processer for win32 services

And then I get just a square 1x2" pop saying
"Nt Authority Rpc and I have 59sec to save all info before machine closes down, which it does.Also I have macafee firewall and AV software on it

The only thing is when I use another dialer (Eircom) I do not get this problem

Any ideas

Thnks

ColmOT [MSFT]

Cubix, that Blaster as well...follow the instructions above...

cubix

Cheers, any reason it would affect one net connection(netsmart) and not the other (Eircom)?

Ponster

I thought having a firewall up would stop Blaster from 'working' until you got the patch to get rid of it, but cubix has Macafee firewall installed yet still get's the error?

Mutant_Fruit

well, obviously he either got it from an infected .exe of similar, or (more likely) he has a misconfigured firewall.

I recommend Kerio Personal Firewall. I never got the blaster virus (or simliar ones) when i've had this running, even with no service packs or patches installed. Its a great firewall.

That reminds me, if your firewall allows it, deny ALL incoming connections to SVChost, but allow it to make outgoing connections. If you can't do that, switch firewall now, to kerio.

cubix

The strange thing is I downloaded Macafee's virus checker from "http://vil.nai.com/vil/stinger/" like Chipzilla suggested but nothing was found, granted some of the MS updates are not installed so it well be one of them. But am still curious whay it only shuts the pc down when I use netsmart(iol) but yet when I dial in eircom no problems.Could a virus be that smart?. I first thought the netsmart was to blame but when problems mirror what other people where getting I had second thoughts

Mutant_Fruit

its not that smart, it probably just latched on to one connection. Also, there are multiple SVCHost instances (press ctrl-alt-del in XP and you'll see em). It could be each dialup connection has it's own instance of SVChost, and so when the virus latched onto one, it ignores the others.