svchost.exe and startbar lockups???

Hi guys,

I've read over many many pieces of advice on this problem and to be honest I'm at the end of my tether. I'm not having any joy at all!!!!:cry

I'm running XP home SP2, on an average system. I regularly run Adaware, Spybot, Windowwasher, ccleaner, Regmechanic, and Norton 2008.

When I start up, my syatem boots up fine until it reaches the use screen. I click on my user (the other being my Mom who has big text and icons coz shes a bit blind)

I get my wallpaper image but nothing else. About five minutes later the icons on the desktop load and the start bar appears. I seem to have about a minute to click on any icons or the start bar before my pc just locks up for another five minutes. If I click anything during the lockup, it will all suddenly flash through when the five minutes is up!!!! Very frustrating.

I have found that after logging in and getting the wallpaper and nothing else, I can start task manager. Nothing on the list seems to be drawing vast CPU apart from System Idle Processes and the odd flash of life from System.

I have found that of the svchost.exe's that are running (Three System, one Local and two Network Service) if I end the process svchost.exe Network Serices my syatem flashes to life, icons appear and the start menu appaers and works like old times????? I do however get the message saying my Remote Procedure Call is shutting down my PC. I kill this off by running "shutdown -a"

After this my PC works fine......well apart from not being able to update Norton, use any peripherals like my printer or cut and paste from different app's (word to firefox etc)

Now call me a cabbage, yes i'm green. But I ain't got no leaves????

I have no spyware that can be detected! I have ample RAM and a partitioned 120gig hard drive that on 20% used overall.

I know a little, but not enough (obviously) and would dearly love some advice. Heres a HJT logfile for you all to peruse! Many thanks in advance!!:major

.............................................................................................................

 

Welcome to MajorGeek.com.

Please work through this process before posting HJT logs. Thank you.

__________________________

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

Downloading, Installing, and Running HijackThis

• Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

• CounterSpy Log - only for Windows XP, 2K, & NT users
• AVG Antispyware Log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
• Bitdefender Log - from step 6
• Panda Scan Log - from step 6
• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• HijackThis Log

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

Hi,

Ok, here's what happened:

0: Tried to uninstall anything that I don't want. Nokia PC Suite and Nokia Cable Driver wouldn't uninstall? Also set MSCONFIG to Normal startup!

1: Emptied Norton 2008 Quarantine. Now says "there are no items to display" but Norton will not "normal/auto update" or "auto protect" outside Safe Mode. Also Norton Live Support "cannot detect a internet connection" to establish a session?? Even though I can connect using IEXP or Firefox.

I also emptied Norton Protected waste basket, ran CCleaner and Window washer.

I have updated all my drivers using DriverAgent.com! Well not strictly speaking!!

2: Enabled hidden files

3: Having recently parted form the beast that is AOL. I have changed Virus and FIrewall software from McAfee AV and Firewall to Norton Antivirus and Windows Firewall (only temp till I can buy a decent one)

4: Downloaded and setup GetRunKey and ShowNew fine!
Updated, immunized, fixed the ignore products bug and ran Spybot. It found three objects. That where deleted!
I downloaded Counterspy, but was not allowed to install it. A notice saying the Administrator has set rules not allowing the user to make changes. I rebooted in safe mode and no luck either. The install shield wizard just wouldn't work in either the Administrator or the other main user.

I managed to download and install AVG Anti-spyware. It found three bits of spyware and fixed them! Log saved!!!

5: Restarted in Safe Mode and ran all the above again! Clean as a whistle!

6A: Tried to run Panda in normal but wouldn't work. So ran in Safe Mode with networking but still didn't work. "Error on page" was the message both times??
Ran Bitefinder instead successfully. Log attached!!

6B: Ran GetRun.bat and ShowNew.bat - Logs attached!!

6C: Now at this point i'm pretty sure its not SPYWARE thats screwing up my PC. But as you guys want me to follow your steps then I have!!

7: Downloaded a new version from you site of HJT. Installed it, changed its name, ran it and saved a log!

........................................................................................................


I am still having the svchost.exe problem. Its locking up my PC bigtime and disabling it only means I can't use certain tools like printer.clipboard etc. My system is allowing some installs and not others. Some programs to run ok and not others????

I'm not sure what to do???

Thanks for your help.


.................................................................................................

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:15:08, on 15/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

 

OK....you need to follow ALL steps of the instructions I gave you too the letter. HJT logs need to be attached, not copied and pasted.

Also, you need to start a new thread with these attachments in the Malware Forum, as indicated in the instructions. You can find the forum here...

http://forums.majorgeeks.com/forumdisplay.php?f=35