«

"DullRazor" <> wrote in message
news:...
> Hi all
> I've posted this question once but I never saw it show up in the
> group. Heres the problem; I reinstalled Windows 2000pro on my machine
> and ever since I get an error message that says, "svchost.exe has
> generated problems and will be shutdown. You will have to restart the
> program. An error log is being generated". When this happens my
> windows search menu will not come up. I can click on start, go to
> search, then to files and folders but the search window will not come
> up. Also, I can go into Winnt and it is completely blank as well as
> the programs folder.
<snipped>
This issue is being caused by the msblaster worm. Further information
on this issue can be found here:

http://securityresponse.symantec.com...aster.worm.htm
l

Patch for Windows 2000/NT
http://www.microsoft.com/downloads/d...846-f541-4c15-
8c9f-220354449117&displaylang=en

..

Hey dood

Try Anti-Trojan 5.5 to check what ports are open and to scan for a few that
don't seem to be picked up by some antivirus scanners. Also try an on-line
scan from http://housecall.trendmicro.com/
http://housecall.trendmicro.com/ http://www.pandasoftware.com/activescan/
or http://www.commandondemand.com/eval/index.cfm Sometimes a Trojan or
Worm can disable your onboard virus scanner, so it is always handy to run
one form another source if you have something screwy happening.

I have the same issue on a couple of different computers. I even ran the
msblaster check from Norton to make sure, and nothing.

--
Kendal R. Emery, MCSE, Network+, A+, MCNGP #19
Systems Administrator
Coordinated Home Care

remove me to email to me
"Glenn (SBfan2000)" <> wrote in message
news:...
> I have been having this same problem with errors about svchost.exe! After
I
> get the error some programs will not run correctly and the search function
> will not work! After restarting, everything works fine! Its not the
> blaster worm I have updated windows patches, updated virus def. and the
> blaster addition to the registry is not present! Also have a firewall and
> it is not reporting and attempts on the ports that blaster uses!
>
> "DullRazor" <> wrote in message
> news:...
> > YEP, I got it. It got past my antivirus program and I keep that
> > updated. I am pretty sure I can manually remove it so I'll do that
> > first chance I get. Everyone better keep on top of this one.
> > Thanks for the advise.
> >
> > On Sat, 16 Aug 2003 14:20:30 GMT, "Dave" <nomailplease@127.0.0.1>
> > wrote:
> >
> > >
> > >"DullRazor" <> wrote in message
> > >news:.. .
> > >> Hi all
> > >> I've posted this question once but I never saw it show up in the
> > >> group. Heres the problem; I reinstalled Windows 2000pro on my machine
> > >> and ever since I get an error message that says, "svchost.exe has
> > >> generated problems and will be shutdown. You will have to restart the
> > >> program. An error log is being generated". When this happens my
> > >> windows search menu will not come up. I can click on start, go to
> > >> search, then to files and folders but the search window will not come
> > >> up. Also, I can go into Winnt and it is completely blank as well as
> > >> the programs folder.
> > ><snipped>
> > >This issue is being caused by the msblaster worm. Further information
> > >on this issue can be found here:
> > >
> >
>
>http://securityresponse.symantec.com...laster.worm.ht
> m
> > >l
> > >
> > >Patch for Windows 2000/NT
> >
>
>http://www.microsoft.com/downloads/d...a846-f541-4c15
> -
> > >8c9f-220354449117&displaylang=en
> > >
> > >.
> > >
> >
>
>

Could be a different variation of Blaster - there are a couple out there
unfortunately.

There is a d.o.s variant of the same exploit utilised by blaster, just
crashes servicehost. walling port 135 stops it

"RussS" <> wrote in message
news:CTb0b.120536$...
> Could be a different variation of Blaster - there are a couple out there
> unfortunately.
>
>

On Tue, 19 Aug 2003 09:51:29 +1200, "RussS" <>
wrote:

>Could be a different variation of Blaster - there are a couple out there
>unfortunately.
>
I had a customers machine display the symptoms of MBlast ie: shutting
down in 30 seconds, when scanned with the removal tool(two of them)
didn't pick up anything.I patched it anyway and ran Adaware and Spybot
and picked up around 150 nasties.
Customer picked up the machine and no problems ???

Yes, as Dave said - there is a DOS varient out there, and I am thinking a
lot of modern scanners do not check old DOS stuff.

Spybot http://spybot.eon.net.au/index.php?l...&page=download

AdAware http://www.lavasoftusa.com/software/adaware/

On Tue, 19 Aug 2003 01:46:00 GMT, DullRazor <>
wrote:

>Hay Brett
>Where can I pick up adaware and spybot? Are they easy to run?

RussS has kindly posted the links for you, they are easy to run, and
can be set to scan on boot every time.

Definitely sounds like one of the generic variations