Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Problem when connecting to Internet

Posted on 2003-11-22
27
Medium Priority
?
3,650 Views
Last Modified: 2010-04-14
Hi Experts,

I have a problem with my PC when I connect to the internet

After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc


Any ideas

Amit
0
Comment
Question by:Sys_Prog
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 10
  • 9
  • 5
  • +2
27 Comments
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 200 total points
ID: 9803472
Dear Sys_Prog,

Check for MS blaster worm

MS blaster worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Thanks,
Sunray
0
 
LVL 49

Assisted Solution

by:sunray_2003
sunray_2003 earned 200 total points
ID: 9803475
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 49

Expert Comment

by:sunray_2003
ID: 9803490
0
 
LVL 32

Expert Comment

by:jhance
ID: 9804031
It's hard to believe that there are STILL users out there who have not installed the MSBLASTER worm patch!!
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 9804055
Yeah Jhance...  Even last week one of my friends installed the patch on a windows 2003 server.... Everything was fine untill he plugged the machine to the network. The moment he put it to the network card , system restarted ...

Sunray
0
 
LVL 1

Expert Comment

by:webwackr
ID: 9804541
Looks like something else fellas

Sys_Prog, Repair your Internet Explorer browser. Identical errors have been corrected by others in the past by performing and standard IE repair tool.
(Start>Settings>Control Panel>Add/Remove programs>Select "IEx">Repair>Click OK)

INSTRUCTIONS ON HOW TO DO THIS:
Reinstalling or repairing IE has solved this issue sometimes

Try this...

*********************************
Description of the Internet Explorer Repair Tool
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1

How to Reinstall or Repair Internet Explorer and Outlook Express in Windows XP
http://support.microsoft.com/?kbid=318378

Repairing IE 6:
http://www.theeldergeek.com/repair_ie6.htm

How to Uninstall Internet Explorer 6:
http://support.microsoft.com/?kbid=293907

Granted this is pulled nearly verbatim straight from another thread, but if it fixes the problem, who cares, right? =)
0
 
LVL 1

Expert Comment

by:webwackr
ID: 9804547
Or could be just a virus as Sunray mentioned. Let us know what it turns out to be

-Adam
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9807403
Do a search for svchosthost.exe on your system
on your next post tell us where this file is found on your system.

*remember to enable viewing of hidden files and folders as well as system files before doing so.
My computer
Tools
Folder options

open regit
search for svchosthost.exe -- well kind of!

on your next post supply the information that is diplayed after each of the entries please
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9815501
Thanks for all your comments Guys,

I would just verify today and keep u informed

Thanks again

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9826197
Hi wtrmk74

Here is the info u needed

svchost.exe is present in these folders, but the size differs

e:\winnt\system32                   8kb
e:\winnt\system32\wins                  20kb


>>>      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService                  carpserv.exe
Microsoft Inet Xp..            teekids.exe
Synchronization Manager            mobsync.exe /logon
TkBellExe                  "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent                  "C:\Program Files\Winamp\Winamp3\winampa.exe"      
windows auto update            msblast.exe
Windows Automation            mslaugh.exe


>>>      HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Yahoo! Pager                  C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet


>>>      HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

I do not have the Explorer\Run in the Policies heirarchy


>>>>Does this key exist -- if so it's a variant of "svchost virus" or known as "Backdoor.Beasty"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\
Installed Components\{44CC0112-AB51-22EF-BA32-20AA12E6115C}


No, there is no such key










Hi webwackr,

I could not find the IE inmy Add and Remove programs .....any ideas




I have not been able to solve my problem. Any help would be greatly appreciated

Thnks in adv

Amit

      
0
 
LVL 7

Accepted Solution

by:
wtrmk74 earned 300 total points
ID: 9827457
Hello there Sys_Prog

Well your problem is the   :      msblast.exe virus
and the                           :     mslaugh.exe virus

the information you have supplied is absolutely perfect! great job

>>>     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


CARPService               carpserv.exe
Microsoft Inet Xp..          teekids.exe
Synchronization Manager          mobsync.exe /logon
TkBellExe               "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
WinampAgent               "C:\Program Files\Winamp\Winamp3\winampa.exe"    
windows auto update          msblast.exe
Windows Automation          mslaugh.exe


for detailed instructions on these viruses go here
http://www.pchell.com/virus/msblast.shtml

thanks for the info and hope the removal goes well :)

wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9827481
Oh ya forgot

teekids.exe is a virus as well

you have three nasty viruses on your system!

wtrmk74
update you anti virus program :)
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9842930
Hows it going!

:)
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9855608
Hi wtrmk74,

Now, I am a problem,

The error I talked about is on Win 2000.

But my antivirus is installed on Win 98. [I have Win98 as well on my machine]

What should I do...? Do I have to install the antivirus on 2000 as well

regards

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9863262
Yes,
I would assume you have seperate parttions set up for
WIN98
WIN2000

yes you will have to have an antivirus program for each system.

Remove fast..............
wtrmk74
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9863286
after you install the anti virus program, update it , and run it....

then do a search on GOOGLE for removal tools just to be extra sure that these viruses are totally removed from your system.

I would do this on both machines:

UPDATE antivirus
FULL system scan
RUN removal tools

Let me know how it goes!
wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9863852
Thanks wtrmk74,

I would do that in 1-2 days and let u know

Thanks

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9900632
Did you get them removed safely ?
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9901854
Hi wtrmk74,

Actually I tried the removal tool from symantec and it worked and cleared them the three viruses u mentioned.

It also cleaned up the registry entries.

But the problem is that the next time I connected to internet, it again gave me that error after some time.

Is it because I have not installed the Microsoft path -- actually I cannot do that because I am having SP1 (I guess) and the patch needs atleast SP2 on my machine

Any ideas

Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902196
I don't understand what happens when you try to connect...
can you tell me more clearly

wtrmk74
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902210
After I connect to the internet, after say around 20-30 minutes [or may a hour], I get a windows error message with title

svchosthost.exe - Application Error

and the message being The exception priviledged instruction ( hex value ) occured in application..........
OK, Cancel



I can work for some time without respnoding to this message but aftre some time, it forces me to respond because it behaves strangely. does not let me open new application etc

And if I say OK to terminate the program, Then windows does function properly, I cannot Open the Internet Connection Status window, cannot copypaste anything etc
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902260
that sounds like another virus!


lets look at your registry again! Post it again!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run


did you update your antivirus yet or are you online unprotected!
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902290
ONline unprotected

No antivirus at all on Win2000, do have one on 98

I would let u know regading the entries once I am at home
Amit
0
 
LVL 7

Expert Comment

by:wtrmk74
ID: 9902318
can I talk you in to installing all the latest patches and upgrading your service pack to

********* AT LEAST SP3 *********

this security issue of yours will not go away without the latest patches!

sorry about the bad news !

SERVICE PACK DOWNLOADS
http://www.microsoft.com/windows2000/downloads/servicepacks/

you need to unplug this machine from the internet now.......
update your antivirus full system scan
install updates and service packs
then scan your system again!

then do a search on http://www.google.com for:

trojan horse removal tools
Anti-spy and ad-aware
worm detection tools

you will never get rid of this if you don't take action.
it will keep circling in your computer!

wtrmk74
talk to you in a few days when you have completed some of these tasks

try to stay possitive
:(
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9902343
Thanks wtrmk74,

This would definietly take me atleast 3-4 days

I would try finishing it as soon as possible and keep u posted

Thanks for your great help

Amit
0
 
LVL 10

Author Comment

by:Sys_Prog
ID: 9949180
Problem not yet solved but seems to get solved

Yet to upgrade and will do it soon

Thnks for all your gr8 comments and help

Amit
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
A while back, I ran into a situation where I was trying to use the calculated columns feature in SharePoint 2013 to do some simple math using values in two lists. Between certain data types not being accessible, and also with trying to make a one to…
This is my first video review of Microsoft Bookings, I will be doing a part two with a bit more information, but wanted to get this out to you folks.
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question