Svchost.exe error

My computer (XP 2002 SP3) recently locked up and I had to hard boot. When I powered up the machine, I received the following error dialogue box (msg displays over the top of the Windows login screen):

The instruction at "0x7d4caa9b" referenced memory at "0x00000010". The memory could not be "read" ...with options to "Click OK to terminate" and "Click Cancel to debug".

I've tried clicking both in subsequent shut downs and power ups of the computer with nothing seeming to happen (other than the error msg disappears). Upon shutdown, I receive an additional "Runtime" error msg, with reference to the following path: "C\:Program\TrendMicro\SfCtlcom.exe"

Notes:

1. When I power up the computer, I can't tell whether it's booting in Safe mode (I'm not asked whether I want to); and after getting past the scvhost error my desktop eventually displays (after 2-3 minute delay). I can run desktop apps like Word, Excel, etc. but have also lost my ability to access the internet (i.e. I can't send/receive from Outlook, or access other websites. I believe I lost internet access from the time the first svchost error message occurred.

2. I have another computer here in the office on the same router that CAN access the internet successfully (hence my ability to post this topic); so I think it's a corollary issue with the scvhost error on the computer in question.

3. I believe I may have originally rec'd the scvhost error as my computer began shutting down / rebooting following a MS auto-update(?)

Any help greatly appreciated.

G'day Killem123:

Please pm me w/your system & application event logs by performing the following steps:
1) Go to control panel > administrative tools > event viewer;
2) Right click the applications log, click "save as" from the popup, & select text as the type;
3) Do likewise for the system log;

Next, please do the following:
1) Go to a command prompt by clicking start > run & typing cmd, then press enter;
2) type cd\my documents & press enter (your backslash key is generally below the bakspace);
3) type ipconfig > ip.txt & press enter;
4) PM me the output of the file;

Lastly, please go to
www.trendmicro.com
& download a program called hijackthis. Download the installer.

Install it up, then choose scan & save a logfile & pm me that as well.

Thanks for your cooperation regarding those tedious steps.

Following all that, & when you're ready to shut down for the night, open my computer, right click your c: drive, select properties, then "check disk for errors, checking both the fix errors & recover bad sectors options. You'll be told it can't do that now & you'll be asked to schedule the check when windows starts. Confirm that, then restart your machine & hit the hay. Log off & on again when u get up & let's see what happens w/that.

Again, thanks for your cooperation w/this tedium.

Killem123:

Sorry--all I got is the application log. So, could u send the system log & the hjt log again? U might wanna do each separately. Yes, pm=private message. Should have been clearer about that--sorry.

We've definitely got some errors going here.

Wonder how I got demoted to a "rookie surfer"--I was an advisor. O, well. Lol!

Killem123:

a) Did u do the chek disk for errors per my 1st post? If not, please do so at this time. Please refer to my original post for instructions. This is pretty standard operating procedure following a hard reboot.

b) Because u believe this to be a consequence of an auto-update, perhaps restoring your computer to a time before that update may fix this. Your event log only goes to Mar. 25, & I don't know if this occured prior to that or not. U didn't specify.

c) I never received your system log as requested, & this might well help me diagnose the problem, especially if hardware errors are being thrown.

D) HighjackThis showed no evidence of malware, but that is by no means conclusive. Still, if some1 were to put a gun to my head & ask if there were malware on that box, I'd pray a lot cuz I'm really very attached to my brains but I'd answer "no".

E) It may also prove instructive for u to watch the machine as it's booting to see if it throws any errors. This is 1 of the best ways to spot hardware failures.

If I am correct, the primary apps throwing event errors are MS Office ones, which may well have gotten corrupted during an autoupdate, as u suspect. Still, there are other causes which must be considered.

I realize I'm throwing an awful lot at u at once. I am trying to resolve your difficulty as quickly as possible.

Obviously a rebuild may be in the offing, &, whether it is or not, I suggest strongly that u back up anything important on that machine. I'd really like to see confirmation from u that this recommendation has been folowed, if the machine will permit your doing a backup.

Keep in touch.

Warm regards,
AbleTec

Killem123:

Now that your winsock has been restored, please send me another applications & system log & let's see which of those errors go away & which remain.

I've read your hijackthis log & I see no evidence of malware, but, as I said earlier, that is not conclusive evidence. Rootkits can hide from programs like hjt but usually bring some of their buddies along that don't. I still cannot rule out file corruption. Starting up in safe mode by pressing f8 just prior to windows startup might be interesting to see if u can type in stuff, etc., though again not conclusive.

1 last thing:
1) Click start > run, type in cmd, & click ok.
2) At the command prompt, type cd\ (backslash) my documents & press enter.
3) type netstat -B > connections.txt & press enter. Note: the capital b is important!
4) Please send me the output.

Let's see how we're doing w/some new logs & netstat. I know--it's a pain in the a$$. Thanks again so much for all your hard work & cooperation.

Guys Guys! I've scoured the internet for this exact problem... I tried every single fix out there to no avail. You Don't Have to RE-INSTALL WINDOWS!

But now! YES it's a winsock error too... So go out there and get a winsock fix update it's called WINSOCKFIX by a company called Explicit Software Solutions sorry don't have the link and then most importantly make a batch file with this in it... Copy and paste to FixSVCHOST.bat
regsvr32 comcat.dll /s
regsvr32 shdoc401.dll /s
regsvr32 shdoc401.dll /i /s
regsvr32 asctrls.ocx /s
regsvr32 oleaut32.dll /s
regsvr32 shdocvw.dll /I /s
regsvr32 shdocvw.dll /s
regsvr32 browseui.dll /s
regsvr32 browseui.dll /I /s
regsvr32 msrating.dll /s
regsvr32 mlang.dll /s
regsvr32 hlink.dll /s
regsvr32 mshtmled.dll /s
regsvr32 urlmon.dll /s
regsvr32 plugin.ocx /s
regsvr32 sendmail.dll /s
regsvr32 scrobj.dll /s
regsvr32 mmefxe.ocx /s
regsvr32 corpol.dll /s
regsvr32 jscript.dll /s
regsvr32 msxml.dll /s
regsvr32 imgutil.dll /s
regsvr32 thumbvw.dll /s
regsvr32 cryptext.dll /s
regsvr32 rsabase.dll /s
regsvr32 inseng.dll /s
regsvr32 iesetup.dll /i /s
regsvr32 cryptdlg.dll /s
regsvr32 actxprxy.dll /s
regsvr32 dispex.dll /s
regsvr32 occache.dll /s
regsvr32 occache.dll /i /s
regsvr32 iepeers.dll /s
regsvr32 urlmon.dll /i /s
regsvr32 cdfview.dll /s
regsvr32 webcheck.dll /s
regsvr32 mobsync.dll /s
regsvr32 pngfilt.dll /s
regsvr32 licmgr10.dll /s
regsvr32 icmfilter.dll /s
regsvr32 hhctrl.ocx /s
regsvr32 inetcfg.dll /s
regsvr32 tdc.ocx /s
regsvr32 MSR2C.DLL /s
regsvr32 msident.dll /s
regsvr32 msieftp.dll /s
regsvr32 xmsconf.ocx /s
regsvr32 ils.dll /s
regsvr32 msoeacct.dll /s
regsvr32 inetcomm.dll /s
regsvr32 msdxm.ocx /s
regsvr32 dxmasf.dll /s
regsvr32 l3codecx.ax /s
regsvr32 acelpdec.ax /s
regsvr32 mpg4ds32.ax /s
regsvr32 voxmsdec.ax /s
regsvr32 danim.dll /s
regsvr32 Daxctle.ocx /s
regsvr32 lmrt.dll /s
regsvr32 datime.dll /s
regsvr32 dxtrans.dll /s
regsvr32 dxtmsft.dll /s
regsvr32 WEBPOST.DLL /s
regsvr32 WPWIZDLL.DLL /s
regsvr32 POSTWPP.DLL /s
regsvr32 CRSWPP.DLL /s
regsvr32 FTPWPP.DLL /s
regsvr32 FPWPP.DLL /s
regsvr32 WUAPI.DLL /s
regsvr32 WUAUENG.DLL /s
regsvr32 ATL.DLL /s
regsvr32 WUCLTUI.DLL /s
regsvr32 WUPS.DLL /s
regsvr32 WUWEB.DLL /s
regsvr32 wshom.ocx /s
regsvr32 wshext.dll /s
regsvr32 vbscript.dll /s
regsvr32 scrrun.dll mstinit.exe /setup /s
regsvr32 msnsspc.dll /SspcCreateSspiReg /s
regsvr32 msapsspc.dll /SspcCreateSspiReg /s
regsvr32 /s urlmon.dll
regsvr32 /s mshtml.dll
regsvr32 /s shdocvw.dll
regsvr32 /s browseui.dll
regsvr32 /s jscript.dll
regsvr32 /s vbscript.dll
regsvr32 /s scrrun.dll
regsvr32 /s msxml.dll
regsvr32 /s actxprxy.dll
regsvr32 /s softpub.dll
regsvr32 /s wintrust.dll
regsvr32 /s dssenh.dll
regsvr32 /s rsaenh.dll
regsvr32 /s gpkcsp.dll
regsvr32 /s sccbase.dll
regsvr32 /s slbcsp.dll
regsvr32 /s cryptdlg.dll
regsvr32 /s schannel.dll
regsvr32 /s oleaut32.dll
regsvr32 /s ole32.dll
regsvr32 /s shell32.dll
regsvr32 /s initpki.dll
regsvr32 /s msscript.ocx
regsvr32 /s dispex.dll
regsvr32 jscript.dll /s del %temp% /Q /F net stop wuauserv ren %windir%\system32\catroot2 catroot2.old cd /d %windir%\SoftwareDistribution rd /s DataStore /Q
regsvr32 wuapi.dll /s
regsvr32 wups.dll /s
regsvr32 wuaueng.dll /s
regsvr32 wucltui.dll /s
regsvr32 wuweb.dll /s
regsvr32 msxml.dll /s
regsvr32 msxml2.dll /s
regsvr32 msxml3.dll /s
regsvr32 urlmon.dll /s
net start wuauserv
exit

This will fix the h3ll Hole we got ourselves in Good luck
*if for some reason the .bat file gives you errors delete the spaces in front of regsvr32 put in by this post*

Oz

Topic closed to prevent further instructions.

Malware Removal support is limited to [url=]one section[/url] on this forum, and only one team is allowed to give such support.

Only Tech Staff, Tech Officers, Managers, Administrators, and Malware Advisors are allowed to give advice on malware removal.