Solved

Problem when connecting to Internet

Posted on 2003-11-22
27
3,647 Views
Last Modified: 2010-04-14
Hi Experts,

I have a problem with my PC when I connect to the internet

After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc


Any ideas

Amit
0
Comment
Question by:Sys_Prog
  • 10
  • 9
  • 5
  • +2
27 Comments
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 50 total points
ID: 9803472
Dear Sys_Prog,

Check for MS blaster worm

MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Thanks,
Sunray
0
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 50 total points
ID: 9803475
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9803489
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 49

Expert Comment

by:sunray_2003
ID: 9803490
0
 
LVL 32

Expert Comment

by:jhance
ID: 9804031
It's hard to believe that there are STILL users out there who have not installed the MSBLASTER worm patch!!
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9804055
Yeah Jhance...  Even last week one of my friends installed the patch on a windows 2003 server.... Everything was fine untill he plugged the machine to the network. The moment he put it to the network card , system restarted ...

Sunray
0
 
LVL 1

Expert Comment

by:webwackr
ID: 9804541
Looks like something else fellas

Sys_Prog, Repair your Internet Explorer browser. Identical errors have been corrected by others in the past by performing and standard IE repair tool.
(Start>Settings>Control Panel>Add/Remove programs>Select "IEx">Repair>Click OK)

INSTRUCTIONS ON HOW TO DO THIS:
Reinstalling or repairing IE has solved this issue sometimes

Try this...

*********************************
Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

Repairing IE 6:
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6:
http://support.microsoft.com/?kbid=293907

Granted this is pulled nearly verbatim straight from another thread, but if it fixes the problem, who cares, right? =)
0
 
LVL 1

Expert Comment

by:webwackr
ID: 9804547
Or could be just a virus as Sunray mentioned. Let us know what it turns out to be

-Adam
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9807403
Do a search for svchosthost.exe on your system
on your next post tell us where this file is found on your system.

*remember to enable viewing of hidden files and folders as well as system files before doing so.
My computer
Tools
Folder options

open regit
search for svchosthost.exe -- well kind of!

on your next post supply the information that is diplayed after each of the entries please
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9815501
Thanks for all your comments Guys,

I would just verify today and keep u informed

Thanks again

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9826197
Hi wtrmk74

Here is the info u needed

svchost.exe is present in these folders, but the size differs

e:\winnt\system32                   8kb
e:\winnt\system32\wins                  20kb


>>>      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService                  carpserv.exe
Microsoft Inet Xp..            teekids.exe
Synchronization Manager            mobsync.exe /logon
TkBellExe                  "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent                  "C:\Program Files\Winamp\Winamp3\winampa.exe"      
windows auto update            msblast.exe
Windows Automation            mslaugh.exe


>>>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Yahoo! Pager                  C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet


>>>      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I do not have the Explorer\Run in the Policies heirarchy


>>>>Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


No, there is no such key










Hi webwackr,

I could not find the IE inmy Add and Remove programs .....any ideas




I have not been able to solve my problem. Any help would be greatly appreciated

Thnks in adv

Amit

      
0
 
LVL 7

Accepted Solution

by:
wtrmk74 earned 75 total points
ID: 9827457
Hello there Sys_Prog

Well your problem is the   :      msblast.exe virus
and the                           :     mslaugh.exe virus

the information you have supplied is absolutely perfect! great job

>>>     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService               carpserv.exe
Microsoft Inet Xp..          teekids.exe
Synchronization Manager          mobsync.exe /logon
TkBellExe               "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent               "C:\Program Files\Winamp\Winamp3\winampa.exe"    
windows auto update          msblast.exe
Windows Automation          mslaugh.exe


for detailed instructions on these viruses go here
http://www.pchell.com/virus/msblast.shtml

thanks for the info and hope the removal goes well :)

wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9827481
Oh ya forgot

teekids.exe is a virus as well

you have three nasty viruses on your system!

wtrmk74
update you anti virus program :)
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9842930
Hows it going!

:)
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9855608
Hi wtrmk74,

Now, I am a problem,

The error I talked about is on Win 2000.

But my antivirus is installed on Win 98. [I have Win98 as well on my machine]

What should I do...? Do I have to install the antivirus on 2000 as well

regards

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9863262
Yes,
I would assume you have seperate parttions set up for
WIN98
WIN2000

yes you will have to have an antivirus program for each system.

Remove fast..............
wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9863286
after you install the anti virus program, update it , and run it....

then do a search on GOOGLE for removal tools just to be extra sure that these viruses are totally removed from your system.

I would do this on both machines:

UPDATE antivirus
FULL system scan
RUN removal tools

Let me know how it goes!
wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9863852
Thanks wtrmk74,

I would do that in 1-2 days and let u know

Thanks

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9900632
Did you get them removed safely ?
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9901854
Hi wtrmk74,

Actually I tried the removal tool from symantec and it worked and cleared them the three viruses u mentioned.

It also cleaned up the registry entries.

But the problem is that the next time I connected to internet, it again gave me that error after some time.

Is it because I have not installed the Microsoft path -- actually I cannot do that because I am having SP1 (I guess) and the patch needs atleast SP2 on my machine

Any ideas

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902196
I don't understand what happens when you try to connect...
can you tell me more clearly

wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902210
After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902260
that sounds like another virus!


lets look at your registry again! Post it again!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


did you update your antivirus yet or are you online unprotected!
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902290
ONline unprotected

No antivirus at all on Win2000, do have one on 98

I would let u know regading the entries once I am at home
Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902318
can I talk you in to installing all the latest patches and upgrading your service pack to

********* AT LEAST SP3 *********

this security issue of yours will not go away without the latest patches!

sorry about the bad news !

SERVICE PACK DOWNLOADS
http://www.microsoft.com/windows2000/downloads/servicepacks/

you need to unplug this machine from the internet now.......
update your antivirus full system scan
install updates and service packs
then scan your system again!

then do a search on http://www.google.com for:

trojan horse removal tools
Anti-spy and ad-aware
worm detection tools

you will never get rid of this if you don't take action.
it will keep circling in your computer!

wtrmk74
talk to you in a few days when you have completed some of these tasks

try to stay possitive
:(
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902343
Thanks wtrmk74,

This would definietly take me atleast 3-4 days

I would try finishing it as soon as possible and keep u posted

Thanks for your great help

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9949180
Problem not yet solved but seems to get solved

Yet to upgrade and will do it soon

Thnks for all your gr8 comments and help

Amit
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cursor typing problems 5 48
Windows 2003 Terminal Server licenses 3 362
Windows 8 in a W2K Domain 7 588
VBScript not processed at Windows 8.1 logon 2 8,013
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Building a successful professional career is a long and difficult journey, especially in case if your decisions are not chosen carefully. For example, if you think that you can get to the desired position without experience and apply for it, your ch…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question