Problem when connecting to Internet

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

 Patch : http://www.microsoft.com/downloads/details.aspx?FamilyId=C8B8A846-F541-4C15-8C9F-220354449117&displaylang=en


Sunray

Removal tool :  http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

Sunray

It's hard to believe that there are STILL users out there who have not installed the MSBLASTER worm patch!!

Yeah Jhance...  Even last week one of my friends installed the patch on a windows 2003 server.... Everything was fine untill he plugged the machine to the network. The moment he put it to the network card , system restarted ...

Sunray

Looks like something else fellas

Sys_Prog, Repair your Internet Explorer browser. Identical errors have been corrected by others in the past by performing and standard IE repair tool.
(Start>Settings>Control Panel>Add/Remove programs>Select "IEx">Repair>Click OK)

INSTRUCTIONS ON HOW TO DO THIS:
Reinstalling or repairing IE has solved this issue sometimes

Try this...

*********************************
Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

Repairing IE 6:
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6:
http://support.microsoft.com/?kbid=293907

Granted this is pulled nearly verbatim straight from another thread, but if it fixes the problem, who cares, right? =)

Or could be just a virus as Sunray mentioned. Let us know what it turns out to be

-Adam

Do a search for svchosthost.exe on your system
on your next post tell us where this file is found on your system.

*remember to enable viewing of hidden files and folders as well as system files before doing so.
My computer
Tools
Folder options

open regit
search for svchosthost.exe -- well kind of!

on your next post supply the information that is diplayed after each of the entries please
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


wtrmk74

Thanks for all your comments Guys,

I would just verify today and keep u informed

Thanks again

Amit

Hi wtrmk74

Here is the info u needed

svchost.exe is present in these folders, but the size differs

e:\winnt\system32                   8kb
e:\winnt\system32\wins                  20kb


>>>      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService                  carpserv.exe
Microsoft Inet Xp..            teekids.exe
Synchronization Manager            mobsync.exe /logon
TkBellExe                  "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent                  "C:\Program Files\Winamp\Winamp3\winampa.exe"      
windows auto update            msblast.exe
Windows Automation            mslaugh.exe


>>>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Yahoo! Pager                  C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet


>>>      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I do not have the Explorer\Run in the Policies heirarchy


>>>>Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


No, there is no such key










Hi webwackr,

I could not find the IE inmy Add and Remove programs .....any ideas




I have not been able to solve my problem. Any help would be greatly appreciated

Thnks in adv

Amit

      

Oh ya forgot

teekids.exe is a virus as well

you have three nasty viruses on your system!

wtrmk74
update you anti virus program :)

Hows it going!

:)

Hi wtrmk74,

Now, I am a problem,

The error I talked about is on Win 2000.

But my antivirus is installed on Win 98. [I have Win98 as well on my machine]

What should I do...? Do I have to install the antivirus on 2000 as well

regards

Amit

Yes,
I would assume you have seperate parttions set up for
WIN98
WIN2000

yes you will have to have an antivirus program for each system.

Remove fast..............
wtrmk74

after you install the anti virus program, update it , and run it....

then do a search on GOOGLE for removal tools just to be extra sure that these viruses are totally removed from your system.

I would do this on both machines:

UPDATE antivirus
FULL system scan
RUN removal tools

Let me know how it goes!
wtrmk74

Thanks wtrmk74,

I would do that in 1-2 days and let u know

Thanks

Amit

Did you get them removed safely ?

Hi wtrmk74,

Actually I tried the removal tool from symantec and it worked and cleared them the three viruses u mentioned.

It also cleaned up the registry entries.

But the problem is that the next time I connected to internet, it again gave me that error after some time.

Is it because I have not installed the Microsoft path -- actually I cannot do that because I am having SP1 (I guess) and the patch needs atleast SP2 on my machine

Any ideas

Amit

I don't understand what happens when you try to connect...
can you tell me more clearly

wtrmk74

After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc

that sounds like another virus!


lets look at your registry again! Post it again!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


did you update your antivirus yet or are you online unprotected!

ONline unprotected

No antivirus at all on Win2000, do have one on 98

I would let u know regading the entries once I am at home
Amit

can I talk you in to installing all the latest patches and upgrading your service pack to

********* AT LEAST SP3 *********

this security issue of yours will not go away without the latest patches!

sorry about the bad news !

SERVICE PACK DOWNLOADS
http://www.microsoft.com/windows2000/downloads/servicepacks/

you need to unplug this machine from the internet now.......
update your antivirus full system scan
install updates and service packs
then scan your system again!

then do a search on http://www.google.com for:

trojan horse removal tools
Anti-spy and ad-aware
worm detection tools

you will never get rid of this if you don't take action.
it will keep circling in your computer!

wtrmk74
talk to you in a few days when you have completed some of these tasks

try to stay possitive
:(

Thanks wtrmk74,

This would definietly take me atleast 3-4 days

I would try finishing it as soon as possible and keep u posted

Thanks for your great help

Amit

Problem not yet solved but seems to get solved

Yet to upgrade and will do it soon

Thnks for all your gr8 comments and help

Amit