THSCC Forums

I am having a porblem with my XP machine. My virus scan software seems to point to the system file svchost.exe as being corrupted. I have been looking how to replace the one file but Ihave not been able to find the right answer on Microsoft's data base. I have an original XP install disk but it does not have the repair feature that Win 95 had.

_________________
George Bright Member # 141
One of the youngest of the old farts.
Yes I voted against you joining the club.

I think you can use the WinXP Recovery console to recover individual files.

See this article http://support.microsoft.com/kb/307654 for details.

_________________
2004 Mazdaspeed Miata
2004 Subaru Forester XT

After a bit of work I got Recover Console to work. I searched through all the CABinet files on the install disk but could not find svchost.exe. GRRRR

_________________
George Bright Member # 141
One of the youngest of the old farts.
Yes I voted against you joining the club.

Another option is the system file checker (SFC). You'll need the install CD to use that and if you have installed Service Packs after the original install you may need the install CDs for the corresponding SP, which people often don't have.

Here's are article on using the SFC.
http://pcsupport.about.com/od/toolsofth ... cannow.htm
I don't think this can be run from the recovery console, just get to a normal command prompt.

_________________
2004 Mazdaspeed Miata
2004 Subaru Forester XT

I was able to replace the file with a copy from a neighbor's PC. That did not stop the problem. I have noticed that I cannot goto google.com. mmm Just now everything seemed fine after going to an older restore point. But when I tried to reach Google the problems started again. I think my DNS table may be altered.

BTW I don't have an install disk with Service Pack 3. Mine is SP 2.

Update: The computer is not having any attacks from the malware sites until I do any Internet activity. Funny how I can connect to all the sites I normally view except Google.com.

_________________
George Bright Member # 141
One of the youngest of the old farts.
Yes I voted against you joining the club.

Still fighting the virus. In this round I Isolated the machine from the internet. Installed XP from the original disk on a spare drive I had. Then I booted from this drive and restored a backup image I had from a few months ago to what is normally my boot drive. When I switched the hard drives rebooted I had the attacks continue as soon as I turned on the DSL modem.

I am stumped as what to do next other than reloading XP SP 2 from my disk and rebuilding everything from scratch. I do have another backup of my documents, videos, and pictures.

I am buying a new machine soon but I miss netflix, google, etc. in the mean time.

_________________
George Bright Member # 141
One of the youngest of the old farts.
Yes I voted against you joining the club.

Finally got it. On the Avast forum someone suggested TDSSkiller.exe and it worked like a charm. Now I wish I had taken an image of the drive when it was infected. I could have restored it to yesterdays state and fixed the problem. Lots of file restoring and upgrades ahead.

_________________
George Bright Member # 141
One of the youngest of the old farts.
Yes I voted against you joining the club.

had a similar problem recently on my work PC. "svchost.exe" showed up on my task manager using ~90-98% of my CPU, and I was also having problems when I tried to search using google.

I scanned with Malwarebytes and it came up clean, I posted up on the Malwarebytes forums and got some great help from a user there, he directed me through several different steps and I finally got it cleaned up (I think). IIRC we used combofix and a couple of other cleaner/scanners to get everything, but this bugger was locked in there pretty good.