Svchost.exe Problems

Posted by: Dignan

Svchost.exe Problems - 11/05/2010 15:36

So, I think I had a client that was hit with the McAfee screwup. Her PC was really messed up, they called me the day after the McAfee news hit, and it took finding a restore disc and replacing the svchost.exe file to get her back in business. I was able to get her to a state where she could use the computer again, but she's getting annoying error messages and I want to try to fix the machine instead of nuking it. I'd really appreciate any ideas you guys have as to how to fix this. Here is the email she sent me detailing the error messages and weird behavior of her computer:

Quote:
1. Svchost.exe – Application Error
The instruction at “0x000d000b” referenced memory at “0x00d00b” The memory could not be “read”
Click on OK to terminate the program
Click on CANCEL to debug the program.

When I click on OK like you told me, the following message appeared:

The instruction at “0x000d000f” referenced memory at “0xb7aa87cb” The memory could not be “written”

When Outlook would not start, I shut down and then these messages came up:

2. The instruction at “0x000d0013” referenced memory at “0x000d0013” The memory could not be “read”
When I clicked OK the following appeared:
The numbers changed to “0x000d003f”

Upon my third start up, I received different messages:

3.The instruction at “0x000d0007” referenced memory at “0x000d0007” The memory could not be “read”
When I clicked on OK a completely different message appeared:

The exception illegal instruction An attempt was made to execute an illegal instruction (0xc000001d) occurred in the application at location 0x000d0007.

Outlook continues to run with a different color in the background. Instead of normal colors, it is now running with a tan background. At some point during the day, it may or may not change back to normal colors and fonts.
Posted by: tman

Re: Svchost.exe Problems - 11/05/2010 15:55

If svchost.exe isn't corrupt then you'll have to investigate the various services it hosts. The services are DLLs that get loaded into the address space of an instance of svchost and you usually get multiple services per instance.
Posted by: tanstaafl.

Re: Svchost.exe Problems - 11/05/2010 16:35

Originally Posted By: Dignan
and it took finding a restore disc and replacing the svchost.exe file to get her back in business.

Are you certain that the svchost.exe file you restored was the exact same version as the one that was lost?

tanstaafl.
Posted by: siberia37

Re: Svchost.exe Problems - 11/05/2010 16:40

Try turning off Aero. Aero definetly uses svchost.exe.
Posted by: Roger

Re: Svchost.exe Problems - 11/05/2010 17:59

Originally Posted By: siberia37
Try turning off Aero. Aero definetly uses svchost.exe.


Almost all of Windows' built-in services use SVCHOST.EXE. Turning off Aero might work, but only if the DLL responsible is corrupted. In short, you're almost screwed. You've got a couple of options:

1. See if you can verify the digital signatures on all of the supposedly-signed DLLs in the Windows directory and below. I think that SysInternals have a tool that does this. This'll tell you what needs replacing.
2. Break out WinDbg and get medieval on it.
3. See if a Windows repair will fix it.
4. Nuke the site from orbit.
Posted by: tman

Re: Svchost.exe Problems - 11/05/2010 18:31

You can try using SFC. Open a command prompt with administrator privs and run "sfc /scannow".
Posted by: drakino

Re: Svchost.exe Problems - 11/05/2010 18:43

I'm assuming the affected machine is Windows XP, as that was the OS impacted by the McAfee error, so Aero won't be present.

SFC will probably be a quick way to fix it. Otherwise, system restore back to before the glitch should pull in whatever svchost version was on the system. One last idea I can think of would be to reapply the last hotfix released by Microsoft that includes svchost.exe.
Posted by: Dignan

Re: Svchost.exe Problems - 11/05/2010 20:46

Yeah, it's Windows XP SP3 (the only version affected by the McAfee screwup). I'll try using SFC. For my own educations, what is SFC and what does it do?
Posted by: wfaulk

Re: Svchost.exe Problems - 11/05/2010 21:58

System File Checker
Posted by: Roger

Re: Svchost.exe Problems - 12/05/2010 15:56

Originally Posted By: drakino
...pull in whatever svchost version was on the system. One last idea I can think of would be to reapply the last hotfix released by Microsoft that includes svchost.exe.


Again: It's probably not SVCHOST that's corrupted. It's more likely to be one of the service DLLs that it loads.
Posted by: tman

Re: Svchost.exe Problems - 12/05/2010 16:19

If svchost was corrupted, I'd expect the entire machine to be unusable considering how many services are required just to start Windows. This does bring up the strong possibility that there is an unrelated problem here that wasn't anything to do with the recent bad McAfee DAT file.

You can try running SFC and reviewing the log file it generates but it sounds more likely that to completely fix the system, you're going to have to do reinstall from scratch.
Posted by: drakino

Re: Svchost.exe Problems - 12/05/2010 16:56

Originally Posted By: Roger
Again: It's probably not SVCHOST that's corrupted. It's more likely to be one of the service DLLs that it loads.

I'm not saying it's corrupted. I'm thinking that the version Matt restored wasn't the same version the system had, thus DLLs on the system expecting a certain version of SVCHOST are having problems.
Posted by: Dignan

Re: Svchost.exe Problems - 12/05/2010 17:32

Originally Posted By: drakino
Originally Posted By: Roger
Again: It's probably not SVCHOST that's corrupted. It's more likely to be one of the service DLLs that it loads.

I'm not saying it's corrupted. I'm thinking that the version Matt restored wasn't the same version the system had, thus DLLs on the system expecting a certain version of SVCHOST are having problems.

It's possible, and yet again I curse the f***ing PC manufacturers for saving their pennies and not shipping restore discs with their computers. I'm sure they'd say "oh, but we give the user the option to make their own." Yeah, like the average user is going to do that!

So yeah, I don't really know if the disc she had was for that computer. There were three computers in their office.
Posted by: drakino

Re: Svchost.exe Problems - 12/05/2010 17:53

If you used the copy off a restore disc, it's highly likely it's not the correct version then. Numerous patches have been released for XP to fix issues with SVCHost and related support DLLs.
Posted by: Dignan

Re: Svchost.exe Problems - 13/05/2010 00:47

Originally Posted By: drakino
If you used the copy off a restore disc, it's highly likely it's not the correct version then. Numerous patches have been released for XP to fix issues with SVCHost and related support DLLs.

Well sheesh! Then what are you supposed to do?

Oh, and unfortunately system restore was turned off on this system for some reason.

I'll have access to the computer tomorrow (maybe) and I'll try SFC.
Posted by: Roger

Re: Svchost.exe Problems - 13/05/2010 04:41

Originally Posted By: drakino
If you used the copy off a restore disc, it's highly likely it's not the correct version then. Numerous patches have been released for XP to fix issues with SVCHost and related support DLLs.


And those are probably mostly the support DLLs. SVCHOST doesn't actually do anything interesting or clever, so I doubt that it needs much patching.
Posted by: Dignan

Re: Svchost.exe Problems - 18/05/2010 01:29

Hey everyone! I just HAD to thank you for the help here. I ran SFC and it fixed everything.

I'm still a little concerned, as when I ran it, it complained that it was not the correct disc. Well, at first I accidentally hit "Retry," and it proceeded to progress a significant portion. Then it complained again, and I clicked "Retry" again. I had figured that at this point I had little to lose (all the data was backed up). So I just kept hitting "Retry" until the progress bar finished. After a brief restart, all I had to do was reload the NIC drivers (already on the system), and reselect the correct audio device in her sound settings, and the computer was fully functional again.

I suspect the disc we were using was just not the exact disc for that install of Windows. It was the only one she had, though, and it matched the Windows version.

Whatever, it totally worked, and I thank you guys for the help. And thanks to you, Trevor.