Advice needed - svchost crashes

  • Thread starter Thread starter Falco98
  • Start date Start date
F

Falco98

A few days ago after some random crash / reset, my PC seems to have started
having some strange problems.
First off, I'm running XP sp1 on an Athlon XP 2000 system with 512 megs of
ram, Audigy2, ATI video card.
It started reporting that some essential system process had failed (SVChost,
i think), and that it would restart in 59 seconds. I figured out how to
disable that mandatory restart in System Management, but that only seems to
buy me time and not stability. At some point, after one restart, Windows
reported that I should throw in the XP cd, since some system files didn't
match the originals (this is after the one time it did a ScanDisk during
start up). I, being hasty, told it to 'ignore', but now I can't run windows
for more than a few minutes without svchost crashing (it simply reports the
error over and over again, as I told it to "restart on fail" in windows
management). This seems to do all kinds of inconvenient things to the file
system, too.
Now, my primary question is, How can I get back to the thing that asks me to
insert my XP cd so it can patch damaged system files? I've tried putting
the CD in anyway and fishing through the obvious options, but that didn't
really work. And, my secondary question is, could this error be caused by
something else? (the SVChost crash errors are always accompanied by a
memory address read error. it's rather intriguing).
Thanks to anyone who can help.
~Mike
 
Falco98 said:
A few days ago after some random crash / reset, my PC seems to have started
having some strange problems.
Click to expand...


It just happened again.
The error message says, specifically,
"Generic Host Process for Win32 Services has encountered a problem and needs
to close. We are sorry for the inconvenience."

An interesting fact is, it'll throw this error at me about 4 or 5 times,
separated by a random number of seconds ranging from 10 to 30.. and perhaps
also encountered by a memory address read error. If I click the link to see
what "data" one of these error reports contains, i get this error signature:
szAppName : svchost.exe szAppVer : 5.1.2600.0 szModName : rpcrt4.dll
szModVer : 5.1.2600.1106 offset : 00078333

If anyone has any insight, it'd be appreciated.
 
Virus mate.
Microsoft has a patch for it tho. (to keep it out)
Read up here for starters. Might have to do it from another comp?
Newsgroup called "microsoft.public.windowsxp.basics" & look for thread "the
way to fix the rpc error message" by "mike" on 12/08/2003 7:19AM
BruceM
 
thanx. this seems to have at least put me onto some useful info. it's not
quite smooth sailing of course, but i'm glad it's not an isolated error, or
an indicator of equip. failure of some sort..
~Mike
 
One problem with this theory is, my system does not contain the file
"msblast.exe", or anything similar AFAIK... and this has been a primary
indicator in all the other stuff i've read so far.
 
Hrmmmm...
I just followed those directions (generally the concensus everywhere)
---except---
at no point in any of my searches did i turn up a file named "msblast.exe",
and in fact, no entries in msconfig (even in safe mode), and none in the
registry EXCEPT -one-, only when i was in safe mode, in some obscure
location (promptly deleted, of course). My worry is, of course, that i may
have a different, more sly strain -- one that avoided detection by McAfee
DATs updated not half an hour ago (in this very boutique) - and which
doesn't run from quite the same EXE's.
I've rebooted after updating micro$oft's patch, and things are running
alright
-so far ...

thanx to everyone, tho.
~Mike
 
I started experiencing this yesterday also and after doing everything
from reinstalling to blowing my brains out I finally found the answer.

You are infected with the new Blaster Worm

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html

Easiest way to see if you have it is to search on your C: drive for a
file called MSBLAST.EXE.

I initially renamed this to msblast.exe.001 then rebooted.
Everything back to normal. To protect yourself update virus table and
run all critical updates from micrososft.

Troy
 
Howdy!

Falco98 said:
One problem with this theory is, my system does not contain the file
"msblast.exe", or anything similar AFAIK... and this has been a primary
indicator in all the other stuff i've read so far.
Click to expand...

The SVCHOST crashing can also be caused by the exploit ATTEMPT -
that is, the ATTEMPT to infect you with MSBLAST.

That's what typically causes the "RPC Shutdown" symptom.

RwP
 
Boot from the XP CD. Ensure your BIOS is set to look for bootable devices
in the following order FDD, CD, HDD (floppy, CD hard drive).

When the message appears on the screen:

Press any key to boot from CD.....

Press a key.... any key, even the spacebar.

Let it run... ignore the F2 for the Recovery Console... go through the F8 to
accept the EULA. When Windows looks for and finds itself on thehard drive,
it will ask if you'd like to do a Repair Installation.

All the remainder of your files, folders, documents, MP3s, videos, whatever
else you have on there will be just fine. However you will have to download
and install SP1 and the rest of the Updates since the release of XP.

Cari
www.coribright.com
 
Back
Top