Major Problem - PC is dead except for a few services

I read on the net that the file svchost.exe was a trojan. I had the file in Windows\System32 and in Windows\servicepac\i386. I temporarily moved them to a folder on my desktop in case my pc needed them. If it did, I was going to cut and paste them back into their folders. BIG, HUGE MISTAKE! I can't cut and paste anything and I can't "send" or "move to". My shadow back-up copy won't work, I can't do a System Restore, and my Rescue Disks won't work. Last week, I downloaded SP2 from a site because Microsoft wouldn't give me another copy. I needed it because my iexplore.exe file was missing and I was having problems with links. I copied the iexplore.exe file into System32, but I saved the SP2 folder. I tried running it a few minutes ago as my last resort, but it couldn't finish because files that are needed were missing (hmmm.... I wonder what they could be).

What can I do to fix this? How do I reinstall those files back into their folders if I can't cut and paste them, can't restore them, and can't replace them? Please don't tell me I'll have to reformat my hard drive.

I'll be here waiting for help . . .

 

First up why did you donwload sp2 from a site because MS wouldn't give you a copy?

Its part of Microsoft Updates. and is available to download from their site.

Second svchost is a system protected file, it 'should' restore itself when you removed it from system32 . Try booting into safe mode and doing it. I think you may have other issues here.

see this: for information on reinsalling IE http://support.microsoft.com/default.aspx?kbid=318378

Matt

 

I believe that's where Windows stores its backup files.
He may be able to use the System File Checker and a Windows XP CD to fix it, unless it's in the System32 folder too. Type in (without quotes) "sfc /scannow" in the Run box.

 

I tried repairing IE but it wouldn't repair and Microsoft gave me a message that basically said that I already had SP2 installed and that it wouldn't install it again. So I got SP2 from another site and it worked fine. I had no problems with it at all.

The problem I have is that I moved the svchost.exe files and I can't put them back in the folders where they belong. I easily moved them with cut and paste, no objections or warning messages were given to me.

And don't yell at me . . . I'm a wreck already.

The link you gave me was to repair Internet Explorer and Outlook Express. I just went to the Microsoft site before I read your response and tried to download SP2 from them again. This time it was willing to do it, but I had to download IE 7 Beta 3. It validated my copy of Windows and started the download but stopped before it finished. It gave me the same message that I received when I tried to reinstall SP2 that I got from the other site. It said it couldn't continue . . . "Make sure the Cryptographic service is running on this computer." I couldn't get into Disk Management to see if the service was there. The page was blank.

 

I can't type anything in the Run box. I don't have a start button. I went into Safe Mode but I couldn't get the files back into their folders from there either. I tried to run Ckdsk but the option is no longer there.

I tried running sfc /scannow from the Run box several days ago because Dial-a-fix couldn't do it and neither could the command from the Run box.

I put my Windows disk in earlier and all the options were serious so I didn't chose an option. I did Repair Permissions with Dial-a-fix but, again, the other options were over my head and I didn't want to make matters worse.

 

I can't imagine that the file is still missing from system32. (don't worry about the I386 one for now)

Please check the system32 folder and tell me if the file is missing still.

Matt

 

It's still missing. The one before it is subst and the next one is svcpack.dll. I'm downloading another SP2 right now. It'll finish downloading in about a minute.

 

SP2 just finished downloading and it started to run but stopped. I received a "Serice Pack 2 Setup Error: Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer."

 

Manage > Services and Application > Services is still a blank page.

 

ok please tell me the exact path where you copied the files to (the backup folder)

Matt

 

I'm not sure which backup folder you're talking about.

I have a shadow copy on an external hard drive.

I have C:\Windows\ServicePackFiles\i386.

and I just downloaded SP2 and saved it to my desktop.

and I also just made a set of Recovery Disks (a drive) a few days ago. Nothing happened when I put the first one in the drive. But that's not unusual. I can boot up with a floppy in my a drive.

 

WHen you removed the file from system32 where did you put it.

I am still having a hard time believing this is all related to that but once we get the file back it might help, and we can look for any other problems

 

When I removed the file from System32, I put it in a folder on my desktop. I named the folder c windows system32

I've lost all cut and paste ability, even a word in this post.

 

This is the url of the page that said that svchost is a trojan

http://www.klake.org/~jt/malware/svchost/

 

Are you still there?

 

Sorry.

I would like to know where the files are currently. The exact path. I may be able to make a batch file that will let you copy them back.

DId you have any other issues before removing these files ?

 

The only problem that I was having was that I couldn't open a lot of links. When I downloaded and installed SP2 from the other site, I copied the iexplore.exe file into System32 folder and the problem lessened to some extent.

Path 1: Desktop\c windows system32
Path 2: Desktop\windows servicepackfiles i386

I named the folders using the path that I took the file from so I'd know where to put it back.

 

I have a program named xp_emergencyutil. It will create copies of regedit, msconfig and task manager. I never ran it though but I just clicked on msconfig and it opened msconfig. Inside msconfig under one of the tabs, cryptographic was marked as stopped. Almost everything was marked as stopped. I clicked "enable all" and then unchecked some that I know that I won't use, such as Yahoo Messenger. I'll have to reboot for the changes to take affect. Hopefully, it'll help. I'm going to reboot now and will be back in a few minutes.

 

It didn't help.

Is there a way to get to Control Panel besides the start button?

I was able to get into Services though. Cryptographic was set on Automatic. I highlighted Cryptographic and clicked "Start" from the drop-down menu but I received the error message:

"Error 1068: The dependency service or group failed to start."

 

Is the remote procedure Call (RPC) service started and running?

If it isn't, try to start it, see if you get an error.

RPC is a pretty vital service! If that's not running, it sure explains all of your problems!

 

I tried starting it in msconfig and Services but it won't start. In msconfig, it's enabled. In Services, it just says "starting," but it doesn't start.

From the Command Prompt, I typed net start cryptsvc but I received the same message that "The dependency service or group failed to start."

 

This url also says that svchost is a trojan. This is the one that convinced me to remove the files.

http://www.fbmsoftware.com/spyware-net/Process/svchost_exe/2798/

What a bummer when copy and paste doesn't work.

 

OK, we really need the RPC service to start for your computer to work properly; without that service, nothing is going to work the way it should, probably including windows file protection...

Can you tap F8 when your computer boots up and boot into "safe mode with command prompt?" If yes, you might be able to use the command prompt to copy the file from the desktop folder to the c:\windows\system32 folder, which might fix everything...

If you can boot into the safe mode with command prompt, log onto you main user account (NOT administrator), and try typing this: (enter after each line)

cd %homepath%
cd desktop
cd c windows system32
copy svchost.exe c:\windows\system32

Is you get no errors, type "shutdown -r" (no quotes) to reboot, and see what happens!

 

svchost.exe is actually legitimate Windows process. http://www.processlibrary.com/directory/files/svchost/index.html

 

I can go into Safe Mode but I won't be able to be in contact with you. I tried Safe Mode with Networking but it didn't work.

I'll write down the instructions and go into Safe Mode but I have no option to log on. The prompt I get is c:\documents and settings. How do I change from being the administrator?

I already tried cutting and pasting and moving and copying the files back into System32 and i386 earlier but it didn't work.

I just finished trying to start everything in Services but only 3 items started.

 

Remember, safe mode with command prompt, you will need to be able to type this stuff in!

Hope it helps!

 

God, this reminds me of the old days working with dos.

I'll be back soon.

 

HI!

It worked. My pc didn't want to come out of Safe Mode . . . I waited about 10 minutes and then pressed my reset button. Windows started up and it immediately did a ckdsk, but there were problems, such as I had no internet connection. Instead of undoing all of the things I did to try to get the problem corrected, I did a System Restore to yesterday. Everything is working now.

Thanks Gecks so much! And thanks to you too Playin and Matt

All is right with the world again

 

How did you come up with those commands? I was trying to start crypt in dos using some commands and I tried copying the files but I didn't know the "cd" and "%homepath%" commands . . . I'd never seen them before and never would have thought of them. I tried something similar to your last line, copy svchost.exe c:\windows\system32, but I put them in 2 commands instead of 1, with copy svchost.exe on one line and c:\windows\system32 on the next.

I do have a lot of problems with my pc, such as opening links. I also downloaded and installed Yahoo toolbar but it doesn't show up and I can't click on it under "View" because it's grayed, but those problems will wait for another day.

Thanks again so much for your help!

Denise

 

I'm glad that helped you, Denise!

FYI, The cd %homepath% thing was a way to make sure it was pointed to your default user account path (ex. c:\documents and settings\<your name>), to make sure you we starting from the right directory. I think the command prompt defaults you there anyway, but I wanted to make sure so that the rest of the commands worked.

Best of luck with the rest of your problems, and thanks for stopping back to let us all know how it turned out!

 

It all worked out well in the end thanks to people like you.

My pc art doesn't work well here because of the program allowing only 1 space but

. . . . I hope you all have a glorious weekend!