Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
SVCHOST.EXE problem! 1
- Thread starter Syky
- Start date
Is it just Excel, or does that happen in other Microsoft Office apps? Do you have anitvirus software (up to date) just in case? Run a scan just to make sure as svchost was associated with a virus a ways back.
If you have no virus protection ,check out and look for AVG Free Edition
If you have no virus protection ,check out and look for AVG Free Edition
-
1
- #3
nevets2001uk
IS-IT--Management
We were getting that error on a number of our machines when they were infected with the MSBlaster virus if I remember correctly. We had to use McAfee's Stinger virus scanner to remove it before applying the Windows 2000 patch...
Steve Gordon
Steve Gordon
- Thread starter
- #5
nevets2001uk
IS-IT--Management
Have you applied the Microsoft patch (see above post) after cleaning the infected file? If not give it a try. I think that's the right patch. If you don't install it then your system is still open to the same security risks and can be infected again.
Steve
Steve
ghost123uk
Technical User
Hi all
Same problem here
svchost.exe - application error
the instruction at 0x....... referenced memory at 0x..... . The memory could not be "wrtten".
Then no right click, no cut and paste, no mutiple windows, control panel icons appearing in a left hand pane, etc etc.
This seems to quite common but diffucult to find info on as searches keep producing 100's of old results refering to blaster !!!
Notes.......
I have spare hard drives so I have re-built my machine about 4 or 5 times now on a spare drive.
My Windows 2000 disk has SP4 pre-installed so I can't not use it.
Std W2K build on my machine (Dell GX150 - PIII-1gig etc) with all up to date drives from the Dell site.
W2K bang up to date according to mickysofts update site.
Adaware with latest ref files.
SpyBot with latest ref files.
McAfee AV with latest engine and dat files.
McAfee Firewall with latest updates.
Been to "housecall" online AV scanner.
Been to various malware scanners.
If I install this very basic build, the problem occurs within minutes of connecting to the net (BT Broadband - Alcatel "frog" with latest drivers) !!
I work for a IT ex lease re-furb company and 2 others here have this problem also, and we just can't figure it out.
I have found another site that has been set up to find an answer to this but not sure if it's acceptable to post a link here, so for now I better haddn't !
What a pain - boy will I be happy when someone finds a fix and we can post it for all to enjoy !
JB - N.W. - UK
Same problem here
svchost.exe - application error
the instruction at 0x....... referenced memory at 0x..... . The memory could not be "wrtten".
Then no right click, no cut and paste, no mutiple windows, control panel icons appearing in a left hand pane, etc etc.
This seems to quite common but diffucult to find info on as searches keep producing 100's of old results refering to blaster !!!
Notes.......
I have spare hard drives so I have re-built my machine about 4 or 5 times now on a spare drive.
My Windows 2000 disk has SP4 pre-installed so I can't not use it.
Std W2K build on my machine (Dell GX150 - PIII-1gig etc) with all up to date drives from the Dell site.
W2K bang up to date according to mickysofts update site.
Adaware with latest ref files.
SpyBot with latest ref files.
McAfee AV with latest engine and dat files.
McAfee Firewall with latest updates.
Been to "housecall" online AV scanner.
Been to various malware scanners.
If I install this very basic build, the problem occurs within minutes of connecting to the net (BT Broadband - Alcatel "frog" with latest drivers) !!
I work for a IT ex lease re-furb company and 2 others here have this problem also, and we just can't figure it out.
I have found another site that has been set up to find an answer to this but not sure if it's acceptable to post a link here, so for now I better haddn't !
What a pain - boy will I be happy when someone finds a fix and we can post it for all to enjoy !
JB - N.W. - UK
- Thread starter
- #9
Hi!
Now the problem is solved! =>>>
1. Use fix tool from Symantec or McAfee, to find and destroy infected file!
2. Apply Microsoft patch to system =>>>3. Now Your system is protected against this sticky worm!!!Finally..... ;-)
Good luck.....
Syky
Now the problem is solved! =>>>
1. Use fix tool from Symantec or McAfee, to find and destroy infected file!
2. Apply Microsoft patch to system =>>>3. Now Your system is protected against this sticky worm!!!Finally..... ;-)
Good luck.....
Syky
ghost123uk
Technical User
Hey SyKy please don't go away 
That link isn't working....
Symantic / McAfee tool to destroy what ?
My latest dat files and online scans show nothing
Come back and talk to us some more.
I NEED a fix ( for the prob that is )
JB - N.W. - UK
That link isn't working....
Symantic / McAfee tool to destroy what ?
My latest dat files and online scans show nothing
Come back and talk to us some more.
I NEED a fix ( for the prob that is )
JB - N.W. - UK
- Thread starter
- #11
OK ghost123uk I'm here again!
here's the link!It's Microsoft Security Bulletin MS03-026
McAfee's STINGER.exe is the best fix tool for discovering infected file=SVCHOST.EXE
(Description of svchost file can be found on this web page =>>> This tool will discover and delete svchost.exe file.Don't worry, this file is recreated by system after restart...
Cheers.....
Syky
here's the link!It's Microsoft Security Bulletin MS03-026
McAfee's STINGER.exe is the best fix tool for discovering infected file=SVCHOST.EXE
(Description of svchost file can be found on this web page =>>> This tool will discover and delete svchost.exe file.Don't worry, this file is recreated by system after restart...
Cheers.....
Syky
ghost123uk
Technical User
Thanks SyKy but that is old news.
Quote from my earlier post =
> W2K bang up to date according to mickysofts update site.
> Adaware with latest ref files.
> SpyBot with latest ref files.
> McAfee AV with latest engine and dat files.
> McAfee Firewall with latest updates.
> Been to "housecall" online AV scanner.
> Been to various malware scanners.
I have already tried deleting svchost.exe's (don't know it all but notr a nooby)
This site
is trying to find a cause.......
Seached Technet for ages, lotsa stuff around the problem but no fix![[sad]](/data/assets/smilies/sad.gif "[sad] [sad]")
Anyone else ?
JB - N.W. - UK
Quote from my earlier post =
> W2K bang up to date according to mickysofts update site.
> Adaware with latest ref files.
> SpyBot with latest ref files.
> McAfee AV with latest engine and dat files.
> McAfee Firewall with latest updates.
> Been to "housecall" online AV scanner.
> Been to various malware scanners.
I have already tried deleting svchost.exe's (don't know it all but notr a nooby)
This site
is trying to find a cause.......
Seached Technet for ages, lotsa stuff around the problem but no fix
Anyone else ?
JB - N.W. - UK
- Thread starter
- #13
OK,
if it's old news for You than why this helped to me !?
I think that's something with system patches,hotfixes.
This should be good solution for it.Maybe this depends on system.I'm using W2000 Pro service pack 4, Internet Explorer 6,sp1 with the newest patches and hotfixes.....
Take care.....
Syky
if it's old news for You than why this helped to me !?
I think that's something with system patches,hotfixes.
This should be good solution for it.Maybe this depends on system.I'm using W2000 Pro service pack 4, Internet Explorer 6,sp1 with the newest patches and hotfixes.....
Take care.....
Syky
ghost123uk
Technical User
Hey Syky
I will try re-installing the 823980 blaster patch tonight and see what happens - can't do any harm and you may well be right !
I'll report back tomorrow with or
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
I will try re-installing the 823980 blaster patch tonight and see what happens - can't do any harm and you may well be right !
I'll report back tomorrow with
or JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
- Thread starter
- #15
ghost123uk
Technical User
Quote
"I'll report back tomorrow with or "
Well it's a
I did it all last night.
re ran the 823980 patch as suggested by Jackass
did a trendmicro housecall online scan
ran SpyBot (latest dat file)
ran AdaWare (latest dat file)
ran McAfee (latest dat file)
Checked that my W2K pro was fully up to date thro mickysoft update scan.
dissabled my LAN to isolate the PC
all to no avail
so will keep searching for the cause
you can see know where my sig comes from !
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
"I'll report back tomorrow with
or " Well it's a
I did it all last night.
re ran the 823980 patch as suggested by Jackass
did a trendmicro housecall online scan
ran SpyBot (latest dat file)
ran AdaWare (latest dat file)
ran McAfee (latest dat file)
Checked that my W2K pro was fully up to date thro mickysoft update scan.
dissabled my LAN to isolate the PC
all to no avail
so will keep searching for the cause
you can see know where my sig comes from !
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
ghost123uk
Technical User
Hi SyKy - cheers for checking back.
Nope still not working (as in my previous post cut and pasted here) =
> Quote
> "I'll report back tomorrow with or
> Well it's a
> I did it all last night.
> re ran the 823980 patch as suggested by SyKy
> did a trendmicro housecall online scan
> ran SpyBot (latest dat file)
> ran AdaWare (latest dat file)
> ran McAfee (latest dat file)
> Checked that my W2K pro was fully up to date thro mickysoft update scan.
> dissabled my LAN to isolate the PC
> all to no avail
> so will keep searching for the cause
> you can see know where my sig comes from !
However this morning I got this from another site I have been in comunication with =
Hi,
Sorry I didn't get back to you sooner..
I recently found a solution to the problem I was having that might work for you. After my last crash I decided to hit "Cancel" instead of "OK" to fire up the Visual Studio debugger to see what happened. I looked at the call stack and saw that the process that actually generated the error was something called "SENS", which is a service that svchost.exe hosts.
To make a long story short, SENS is the "System Event Notification Service" which "Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events". I disabled this service and haven't had the problem again..
There's a more detailed write-up at
Since you're getting the svchost crash shortly after connecting to the internet it sounds like it could be this System Event Notification Service that's causing the problem.
Thanks again for visiting and writing!
-Hugues
I'll have a look tonight and report back tomorrow.
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
Nope still not working (as in my previous post cut and pasted here) =
> Quote
> "I'll report back tomorrow with
or > Well it's a
> I did it all last night.
> re ran the 823980 patch as suggested by SyKy
> did a trendmicro housecall online scan
> ran SpyBot (latest dat file)
> ran AdaWare (latest dat file)
> ran McAfee (latest dat file)
> Checked that my W2K pro was fully up to date thro mickysoft update scan.
> dissabled my LAN to isolate the PC
> all to no avail
> so will keep searching for the cause
> you can see know where my sig comes from !
However this morning I got this from another site I have been in comunication with =
Hi,
Sorry I didn't get back to you sooner..
I recently found a solution to the problem I was having that might work for you. After my last crash I decided to hit "Cancel" instead of "OK" to fire up the Visual Studio debugger to see what happened. I looked at the call stack and saw that the process that actually generated the error was something called "SENS", which is a service that svchost.exe hosts.
To make a long story short, SENS is the "System Event Notification Service" which "Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events". I disabled this service and haven't had the problem again..
There's a more detailed write-up at
Since you're getting the svchost crash shortly after connecting to the internet it sounds like it could be this System Event Notification Service that's causing the problem.
Thanks again for visiting and writing!
-Hugues
I'll have a look tonight and report back tomorrow.
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
ghost123uk
Technical User
Hi again
I tried the recommendation to kill the SEN's service - still got the problem.
Shut down DECOM and port135 ( a little prog called "decombobulate_me" )
Ran various AV in normal & safe mode.
Ran SpyBot and AdAware in normal & safe mode.
Re-applied 823980 blaster (patch and others).
Closed down all processes that are not essential.
Getting daft this !!!
Any one getting anywwhere yet.
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
I tried the recommendation to kill the SEN's service - still got the problem.
Shut down DECOM and port135 ( a little prog called "decombobulate_me" )
Ran various AV in normal & safe mode.
Ran SpyBot and AdAware in normal & safe mode.
Re-applied 823980 blaster (patch and others).
Closed down all processes that are not essential.
Getting daft this !!!
Any one getting anywwhere yet.
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
Try running a scandisk and check the option for surface scan. It's possible that a cluster of this file resides in a bad sector and could be causing you problems. Next idea is kinda' grasping, but try deleting your event logging info and see if it clears up.
ghost123uk
Technical User
Well thanks battmain but I have done both of those.
Had another good look last night but still got the problem.
Another forum I use has this a topic and whilst most posts on that one get 30, 50 , or 100 "hits" the one on this topic has had 39 thousand to date !!!!!!!!!
see =
Keep the ideas coming, someone will hit the jackpot, hopefully.
JB - N.W. - UK
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
Had another good look last night but still got the problem.
Another forum I use has this a topic and whilst most posts on that one get 30, 50 , or 100 "hits" the one on this topic has had 39 thousand to date !!!!!!!!!
see =
Keep the ideas coming, someone will hit the jackpot, hopefully.
JB - N.W. - UK
JB - N.W. - UK....
If at first you don't succeed, keep at it until you can't even think straight !
- Status
Similar threads
- Locked
- Question