cancel
Showing results for 
Search instead for 
Did you mean: 

SVChost Problems

N/A

SVChost Problems

Hi, recently and for no reason i can think of, both my Pc's have started to give me SVChost errors, saying they are closing down, then both my Pc's start to lock up etc.
This only happens when i use my router to connect with DHCP aid.
Ive looked for solutions, but in the end have ended up re -installing win2k on both machines.
thats my 1st problem, ive sussed out that if i go back to the old way of connecting, by specifying what IP's both machines have and what DNS they connect to the problem goes away, but my old problem resurfaces, which is after about 1 min of me connecting my 2nd machine, it knocks my internet connection off, i can still use the LAN but cant get to the internet.

One of the NIC cards in machine is a 10/10 and the other is a 10/100. Does this matter?

also, should i be using a workgroup or a domain, couls this be why its knocking it off?

My router is a netgear RP114 connected to a D-link 300G+ dsl modem


any help would be well appreciated.
ta
j
12 REPLIES
N/A

SVChost Problems

Sounds like the W32/Lovsan or MSBLAST virus. This causes the SVCHOST.EXE to crash and then reboots or locks the pc.

You may need to download the patch and then go to McAfee or such to remove the virus.
Community Veteran
Posts: 6,983
Thanks: 8
Registered: 10-04-2007

SVChost Problems

Do that the other way round. You need to remove the virus first with a removal program and then install the patch.
Mark_Dowd
Grafter
Posts: 102
Registered: 08-08-2007

SVChost Problems

A friend of mine copied me on the following instructions:

Manual Removal Instructions
To remove this virus "by hand", follow these steps:

Apply the MS03-026 patch. (From http://support.microsoft.com/?kbid=823980)

Terminate the process msblast.exe

Delete the msblast.exe file from your WINDOWS SYSTEM32 directory (typically c:\windows\system32 or c:\winnt\system32)

Edit the registry (run REGEDIT from the Start -> Run option)
Careful here
Delete the "windows auto update" value from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

For added peace of mind you can then protect your internet connection by using the Windows XP firewall (assuming that you have Windows XP).

(Windows HELP is quite good at describing how to do this.)[/url]
Community Veteran
Posts: 6,983
Thanks: 8
Registered: 10-04-2007

SVChost Problems

You will have great difficulty downloading the patch if the machine is closing down or locking up ever minute.
You need to do the removal first.
Mark_Dowd
Grafter
Posts: 102
Registered: 08-08-2007

SVChost Problems

Fair comment Smiley
Simon_M
Grafter
Posts: 684
Registered: 05-04-2007

SVChost Problems

Oddly enough, it is apply the patch first, then remove the virus. Probably because if you remove the virus first, you could be infected again by the time you get the patch installed.

Full details at http://www.microsoft.com/security/incident/blast.asp
N/A

SVChost Problems

thing is i dont think its a virus, ive completly cleaned my drives and ran virus checks on them, they came back clean.
anymore ideas
N/A

SVChost Problems

What virus scanner are you using, and what date are the updates marked as.

When you say it is going to shutdown, do you see a screen like:


Or do you see a different one.
N/A

SVChost Problems

Im using win2k pro, i just get a normal error message that reads, SVChost has performed errors, and will be shut down, then my machine wont send emails etc, as it says it has not enough memory to perform the actions, then the machine behaves as if it is using all its memory, the graphics on desktop half disapear.
The Virus checker i was using was AVG by grisoft, which is fully updated.
Any ideas?
as i said earlier this happens if i use DHCP to connect, one machine flips out if i connect whatever way.

Regards
j
N/A

SVChost Problems

Are you behind a router?

If so, this sounds like a issue iwth either the firmware of the router sendind invalid DHCP responces or the way Microsoft interpets them (either in my experience).

Try assigning them manaualy to the computer and disabling DHCP.
jberry
Grafter
Posts: 1,886
Registered: 08-06-2007

SVChost Problems

Hi there,

The following from f-secure.com may be able to help you:
Quote
1. Boot up the infected computer

2. If you keep getting the "Shutdown in 60 seconds" dialog, click Start / Run, and execute command 'shutdown -a'

3. Download and save the F-LOVSAN tool to your desktop from: ftp://ftp.f-secure.com/anti-virus/tools/f-lovsan.zip

4. If you're running Windows XP, Windows System Restore might restore the infection afterwards. Disable it by following these rules: http://www.f-secure.com/v-descs/sfc_dis1.shtml

5. Download and run the Microsoft patch to close the RPC hole.

Download for Windows 2000 from www.microsoft.com:
http://www.f-secure.com/dl-w2k/

Download for Windows XP from www.microsoft.com:
http://www.f-secure.com/dl-wxp/

Download for Windows NT4 from www.microsoft.com:
http://www.microsoft.com/security/incident/blast.asp

6. The patch installer will reboot the machine in the end. When the machine reboots, enter SAFE MODE by keeping F8 pressed when the computer screen goes black for a moment, then choose "1) Safe mode"

7. When the computer has booted up in Safe Mode, log in and execute the F-LOVSAN tool you downloaded in step 3.

8. Reboot normally - and you're done.


This should get you back online and lovsan free Cheesy
N/A

SVChost Problems

Well that worked a treat,
Thanks Very Much
Regards
j