Solved

Problem when connecting to Internet

Posted on 2003-11-22
27
3,644 Views
Last Modified: 2010-04-14
Hi Experts,

I have a problem with my PC when I connect to the internet

After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc


Any ideas

Amit
0
Comment
Question by:Sys_Prog
  • 10
  • 9
  • 5
  • +2
27 Comments
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 50 total points
Comment Utility
Dear Sys_Prog,

Check for MS blaster worm

MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Thanks,
Sunray
0
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 50 total points
Comment Utility
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
0
 
LVL 32

Expert Comment

by:jhance
Comment Utility
It's hard to believe that there are STILL users out there who have not installed the MSBLASTER worm patch!!
0
 
LVL 49

Expert Comment

by:sunray_2003
Comment Utility
Yeah Jhance...  Even last week one of my friends installed the patch on a windows 2003 server.... Everything was fine untill he plugged the machine to the network. The moment he put it to the network card , system restarted ...

Sunray
0
 
LVL 1

Expert Comment

by:webwackr
Comment Utility
Looks like something else fellas

Sys_Prog, Repair your Internet Explorer browser. Identical errors have been corrected by others in the past by performing and standard IE repair tool.
(Start>Settings>Control Panel>Add/Remove programs>Select "IEx">Repair>Click OK)

INSTRUCTIONS ON HOW TO DO THIS:
Reinstalling or repairing IE has solved this issue sometimes

Try this...

*********************************
Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

Repairing IE 6:
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6:
http://support.microsoft.com/?kbid=293907

Granted this is pulled nearly verbatim straight from another thread, but if it fixes the problem, who cares, right? =)
0
 
LVL 1

Expert Comment

by:webwackr
Comment Utility
Or could be just a virus as Sunray mentioned. Let us know what it turns out to be

-Adam
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
Do a search for svchosthost.exe on your system
on your next post tell us where this file is found on your system.

*remember to enable viewing of hidden files and folders as well as system files before doing so.
My computer
Tools
Folder options

open regit
search for svchosthost.exe -- well kind of!

on your next post supply the information that is diplayed after each of the entries please
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Thanks for all your comments Guys,

I would just verify today and keep u informed

Thanks again

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Hi wtrmk74

Here is the info u needed

svchost.exe is present in these folders, but the size differs

e:\winnt\system32                   8kb
e:\winnt\system32\wins                  20kb


>>>      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService                  carpserv.exe
Microsoft Inet Xp..            teekids.exe
Synchronization Manager            mobsync.exe /logon
TkBellExe                  "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent                  "C:\Program Files\Winamp\Winamp3\winampa.exe"      
windows auto update            msblast.exe
Windows Automation            mslaugh.exe


>>>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Yahoo! Pager                  C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet


>>>      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I do not have the Explorer\Run in the Policies heirarchy


>>>>Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


No, there is no such key










Hi webwackr,

I could not find the IE inmy Add and Remove programs .....any ideas




I have not been able to solve my problem. Any help would be greatly appreciated

Thnks in adv

Amit

      
0
 
LVL 7

Accepted Solution

by:
wtrmk74 earned 75 total points
Comment Utility
Hello there Sys_Prog

Well your problem is the   :      msblast.exe virus
and the                           :     mslaugh.exe virus

the information you have supplied is absolutely perfect! great job

>>>     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService               carpserv.exe
Microsoft Inet Xp..          teekids.exe
Synchronization Manager          mobsync.exe /logon
TkBellExe               "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent               "C:\Program Files\Winamp\Winamp3\winampa.exe"    
windows auto update          msblast.exe
Windows Automation          mslaugh.exe


for detailed instructions on these viruses go here
http://www.pchell.com/virus/msblast.shtml

thanks for the info and hope the removal goes well :)

wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
Oh ya forgot

teekids.exe is a virus as well

you have three nasty viruses on your system!

wtrmk74
update you anti virus program :)
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
Hows it going!

:)
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Hi wtrmk74,

Now, I am a problem,

The error I talked about is on Win 2000.

But my antivirus is installed on Win 98. [I have Win98 as well on my machine]

What should I do...? Do I have to install the antivirus on 2000 as well

regards

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
Yes,
I would assume you have seperate parttions set up for
WIN98
WIN2000

yes you will have to have an antivirus program for each system.

Remove fast..............
wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
after you install the anti virus program, update it , and run it....

then do a search on GOOGLE for removal tools just to be extra sure that these viruses are totally removed from your system.

I would do this on both machines:

UPDATE antivirus
FULL system scan
RUN removal tools

Let me know how it goes!
wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Thanks wtrmk74,

I would do that in 1-2 days and let u know

Thanks

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
Did you get them removed safely ?
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Hi wtrmk74,

Actually I tried the removal tool from symantec and it worked and cleared them the three viruses u mentioned.

It also cleaned up the registry entries.

But the problem is that the next time I connected to internet, it again gave me that error after some time.

Is it because I have not installed the Microsoft path -- actually I cannot do that because I am having SP1 (I guess) and the patch needs atleast SP2 on my machine

Any ideas

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
I don't understand what happens when you try to connect...
can you tell me more clearly

wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
that sounds like another virus!


lets look at your registry again! Post it again!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


did you update your antivirus yet or are you online unprotected!
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
ONline unprotected

No antivirus at all on Win2000, do have one on 98

I would let u know regading the entries once I am at home
Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
Comment Utility
can I talk you in to installing all the latest patches and upgrading your service pack to

********* AT LEAST SP3 *********

this security issue of yours will not go away without the latest patches!

sorry about the bad news !

SERVICE PACK DOWNLOADS
http://www.microsoft.com/windows2000/downloads/servicepacks/

you need to unplug this machine from the internet now.......
update your antivirus full system scan
install updates and service packs
then scan your system again!

then do a search on http://www.google.com for:

trojan horse removal tools
Anti-spy and ad-aware
worm detection tools

you will never get rid of this if you don't take action.
it will keep circling in your computer!

wtrmk74
talk to you in a few days when you have completed some of these tasks

try to stay possitive
:(
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Thanks wtrmk74,

This would definietly take me atleast 3-4 days

I would try finishing it as soon as possible and keep u posted

Thanks for your great help

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
Comment Utility
Problem not yet solved but seems to get solved

Yet to upgrade and will do it soon

Thnks for all your gr8 comments and help

Amit
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Veeam Backup & Replication has added a new integration – Veeam Backup for Microsoft Office 365.  In this blog, we will discuss how you can benefit from Office 365 email backup with the Veeam’s new product and try to shed some light on the needs and …
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.
This video demonstrates how to create an example email signature rule for a department in a company using CodeTwo Exchange Rules. The signature will be inserted beneath users' latest emails in conversations and will be displayed in users' Sent Items…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now