svchost.exe dieing repeatedly: HELP!

  • Thread starter Thread starter Tom D
  • Start date Start date
T

Tom D

HELP! Every few minutes I get the error message:

svchost.exe has generated errors and will be closed by
Windows. You will need to restart the program.

And in the event viewer I have the following entries:

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BA from line
42 of .\eventsystemobj.cpp. Please contact Microsoft
Product Support Services to report this error.

The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 92 time(s). The following
corrective action will be taken in 60000 milliseconds:
Restart the service.

I've reformatted my hard drive, reloaded Win2k, applied
service pack 4, installed the latest version of ie, and
still get the message. There were only 2 articles with
this error message in the Win knowledgebase and they were
useless.

Any help will be appreciated.

Tom
 
You could be getting hit by the W32.Blaster.Worm or one of its mutations.
You will need to apply the MS03-026 security hotfix available through
Windows Update or
http://www.microsoft.com/downloads/...46-f541-4c15-8c9f-220354449117&displaylang=en
(link does wrap) for Windows 2000. Once this is done, head over to Symantec
(http://www.sarc.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html)
and run the repair tool.

Cheers,
/Neo

PS - I will assume that your virus defintions are up to date, but if they
are not -- make sure to get this done + consider installing a personal
firewall like zonealarm.
 
Tom D said:
HELP! Every few minutes I get the error message:

svchost.exe has generated errors and will be closed by
Windows. You will need to restart the program.

And in the event viewer I have the following entries:

The COM+ Event System detected a bad return code during
its internal processing. HRESULT was 800706BA from line
42 of .\eventsystemobj.cpp. Please contact Microsoft
Product Support Services to report this error.

The Remote Procedure Call (RPC) service terminated
unexpectedly. It has done this 92 time(s). The following
corrective action will be taken in 60000 milliseconds:
Restart the service.

I've reformatted my hard drive, reloaded Win2k, applied
service pack 4, installed the latest version of ie, and
still get the message. There were only 2 articles with
this error message in the Win knowledgebase and they were
useless.

Any help will be appreciated.

Tom
Click to expand...

This appears to be a symptom of the blaster worm attempting to access
your Windows 2000 system. You need to install the security update or
otherwise close the port.

http://www.microsoft.com/security/incident/blast_faq.asp

A good explanation can be found at:

http://www3.ca.com/virusinfo/virus.aspx?ID=36265

"The worm attempts to infect both Windows 2000 and Windows XP systems.
One of the offsets used by the worm must be different for each of
these operating systems, in order for the exploit it uses to work.
Since the worm does not know what operating system the target machine
is running, it guesses. There is an 80% chance it will attempt to
exploit Windows XP, and a 20% chance it will attempt to exploit
Windows 2000.

If the worm guesses incorrectly and the remote machine is vulnerable,
the process svchost.exe on the target machine will crash. The system
may become unstable, but the infection will fail. "

==-=-==
Note to bypass spam filter put NOSPAM in the SUBJECT line of e-mails.
 
Back
Top