Problem when connecting to Internet

Hi Experts,

I have a problem with my PC when I connect to the internet

After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc


Any ideas

Amit
LVL 10
Sys_ProgAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

sunray_2003Commented:
Dear Sys_Prog,

Check for MS blaster worm

MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Thanks,
Sunray
0
Cloud Class® Course: CompTIA Cloud+

The CompTIA Cloud+ Basic training course will teach you about cloud concepts and models, data storage, networking, and network infrastructure.

jhanceCommented:
It's hard to believe that there are STILL users out there who have not installed the MSBLASTER worm patch!!
0
sunray_2003Commented:
Yeah Jhance...  Even last week one of my friends installed the patch on a windows 2003 server.... Everything was fine untill he plugged the machine to the network. The moment he put it to the network card , system restarted ...

Sunray
0
webwackrCommented:
Looks like something else fellas

Sys_Prog, Repair your Internet Explorer browser. Identical errors have been corrected by others in the past by performing and standard IE repair tool.
(Start>Settings>Control Panel>Add/Remove programs>Select "IEx">Repair>Click OK)

INSTRUCTIONS ON HOW TO DO THIS:
Reinstalling or repairing IE has solved this issue sometimes

Try this...

*********************************
Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

Repairing IE 6:
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6:
http://support.microsoft.com/?kbid=293907

Granted this is pulled nearly verbatim straight from another thread, but if it fixes the problem, who cares, right? =)
0
webwackrCommented:
Or could be just a virus as Sunray mentioned. Let us know what it turns out to be

-Adam
0
wtrmk74Commented:
Do a search for svchosthost.exe on your system
on your next post tell us where this file is found on your system.

*remember to enable viewing of hidden files and folders as well as system files before doing so.
My computer
Tools
Folder options

open regit
search for svchosthost.exe -- well kind of!

on your next post supply the information that is diplayed after each of the entries please
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


wtrmk74
0
Sys_ProgAuthor Commented:
Thanks for all your comments Guys,

I would just verify today and keep u informed

Thanks again

Amit
0
Sys_ProgAuthor Commented:
Hi wtrmk74

Here is the info u needed

svchost.exe is present in these folders, but the size differs

e:\winnt\system32                   8kb
e:\winnt\system32\wins                  20kb


>>>      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService                  carpserv.exe
Microsoft Inet Xp..            teekids.exe
Synchronization Manager            mobsync.exe /logon
TkBellExe                  "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent                  "C:\Program Files\Winamp\Winamp3\winampa.exe"      
windows auto update            msblast.exe
Windows Automation            mslaugh.exe


>>>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Yahoo! Pager                  C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet


>>>      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I do not have the Explorer\Run in the Policies heirarchy


>>>>Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


No, there is no such key










Hi webwackr,

I could not find the IE inmy Add and Remove programs .....any ideas




I have not been able to solve my problem. Any help would be greatly appreciated

Thnks in adv

Amit

      
0
wtrmk74Commented:
Hello there Sys_Prog

Well your problem is the   :      msblast.exe virus
and the                           :     mslaugh.exe virus

the information you have supplied is absolutely perfect! great job

>>>     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService               carpserv.exe
Microsoft Inet Xp..          teekids.exe
Synchronization Manager          mobsync.exe /logon
TkBellExe               "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent               "C:\Program Files\Winamp\Winamp3\winampa.exe"    
windows auto update          msblast.exe
Windows Automation          mslaugh.exe


for detailed instructions on these viruses go here
http://www.pchell.com/virus/msblast.shtml

thanks for the info and hope the removal goes well :)

wtrmk74
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
wtrmk74Commented:
Oh ya forgot

teekids.exe is a virus as well

you have three nasty viruses on your system!

wtrmk74
update you anti virus program :)
0
wtrmk74Commented:
Hows it going!

:)
0
Sys_ProgAuthor Commented:
Hi wtrmk74,

Now, I am a problem,

The error I talked about is on Win 2000.

But my antivirus is installed on Win 98. [I have Win98 as well on my machine]

What should I do...? Do I have to install the antivirus on 2000 as well

regards

Amit
0
wtrmk74Commented:
Yes,
I would assume you have seperate parttions set up for
WIN98
WIN2000

yes you will have to have an antivirus program for each system.

Remove fast..............
wtrmk74
0
wtrmk74Commented:
after you install the anti virus program, update it , and run it....

then do a search on GOOGLE for removal tools just to be extra sure that these viruses are totally removed from your system.

I would do this on both machines:

UPDATE antivirus
FULL system scan
RUN removal tools

Let me know how it goes!
wtrmk74
0
Sys_ProgAuthor Commented:
Thanks wtrmk74,

I would do that in 1-2 days and let u know

Thanks

Amit
0
wtrmk74Commented:
Did you get them removed safely ?
0
Sys_ProgAuthor Commented:
Hi wtrmk74,

Actually I tried the removal tool from symantec and it worked and cleared them the three viruses u mentioned.

It also cleaned up the registry entries.

But the problem is that the next time I connected to internet, it again gave me that error after some time.

Is it because I have not installed the Microsoft path -- actually I cannot do that because I am having SP1 (I guess) and the patch needs atleast SP2 on my machine

Any ideas

Amit
0
wtrmk74Commented:
I don't understand what happens when you try to connect...
can you tell me more clearly

wtrmk74
0
Sys_ProgAuthor Commented:
After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc
0
wtrmk74Commented:
that sounds like another virus!


lets look at your registry again! Post it again!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


did you update your antivirus yet or are you online unprotected!
0
Sys_ProgAuthor Commented:
ONline unprotected

No antivirus at all on Win2000, do have one on 98

I would let u know regading the entries once I am at home
Amit
0
wtrmk74Commented:
can I talk you in to installing all the latest patches and upgrading your service pack to

********* AT LEAST SP3 *********

this security issue of yours will not go away without the latest patches!

sorry about the bad news !

SERVICE PACK DOWNLOADS
http://www.microsoft.com/windows2000/downloads/servicepacks/

you need to unplug this machine from the internet now.......
update your antivirus full system scan
install updates and service packs
then scan your system again!

then do a search on http://www.google.com for:

trojan horse removal tools
Anti-spy and ad-aware
worm detection tools

you will never get rid of this if you don't take action.
it will keep circling in your computer!

wtrmk74
talk to you in a few days when you have completed some of these tasks

try to stay possitive
:(
0
Sys_ProgAuthor Commented:
Thanks wtrmk74,

This would definietly take me atleast 3-4 days

I would try finishing it as soon as possible and keep u posted

Thanks for your great help

Amit
0
Sys_ProgAuthor Commented:
Problem not yet solved but seems to get solved

Yet to upgrade and will do it soon

Thnks for all your gr8 comments and help

Amit
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.