Svhost.exe crash + Explorer.exe Freeze

[shark666]

Someone please help me.. I have an problem that i could not possibly solve by myself. I asked everyone but they told me that they don't know, I searched on the internet and found that a virus was the cause.

Description of my system:
O.S: Win XP SP3
Antivirus: Kaspersky Internet Security 8.0.0.506 fully updated, Spybot search and destroy..
OTHER: need any more detail??

PROBLEM DESCRIPTION : Svhost.exe crashes after 1 or 4 hours after i switch ON my PC. Then Explorer.exe freezes. I tried to end and restart the process using TASK MANAGER. But it did not work....

POSSIBLE CASES FOR CRASH : Its been 2 days that i installed the game "age of empires 3". ever since i noticed that i started to have this problem. Svhost.exe crashes during gameplay but this does not affect my gameplay or anything else.. It just bugs me with a message which i have to click "ok" to terminate the process and all except my desktop becomes to normal... but I think i already had this problem before i installed the game.. This can not possibly be that game the problem..

EFFECTS : I think that my internet connection has become slow [i cannot say that with conviction becoz i use wireless internet and dunno when the bandwidth is down or rapid]....
And also i can't view my mails using WINDOWS LIVE MAIL. but i think that the problem would be due to the low bandwidth.....

P.S: I can tell with great conviction that this problem may not be caused by a virus, bcoz i use Kaspersky Internet Security 8.0.0.506 fully up-to-dated. And i also performed a scan with spybot and found that my system was even more clean that ever....
Am putting below a Logfile from a scan by HIJACK THIS! tool.. I hope someone one can help me plz....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:48:02 PM, on 11/21/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
E:\Downloads\Programs\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Kioals - {DED2B61B-1A26-4566-BF2F-DE539D4468DD} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe"
O4 - HKCU\..\Run: [WinFlip] C:\Program Files\WinFlip\WinFlip.exe
O4 - HKCU\..\Run: [WorkShelf] C:\Program Files\Winstep\WorkShelf.exe autostart
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O4 - Global Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Save Flash by &GetFlash - C:\PROGRA~1\GetFlash\getflash.htm
O8 - Extra context menu item: Use as &Display Picture - C:\Program Files\IEDP2\IEDP.htm
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O20 - AppInit_DLLs: CLKERN.DLL,wbsys.dll,C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: klpsrvc - Unknown owner - C:\Program Files\USB LOCK AP\klpsrvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Profile Monitor (PMonSvc) - Unknown owner - C:\WINDOWS\system32\pmonsvc.exe (file missing)

--
End of file - 5772 bytes

[Birdie]

svhost.exe is a process which is registered as the W32.Mydoom.I@mm worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. The worm has its own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. This process is a security risk and should be removed from your system. Please see additional details regarding this process.

Click to run a free scan for svhost.exe related errors.

Disable and Remove svhost.exe IMMEDIATELY. This process is most likely a virus or trojan. It is highly recommended to Run a Free Performance Scan to automatically optimize memory, CPU and Internet Settings.

[ThoMas321]

svhost.exe is virus, but it is not harmful to OS.
It automatically create some file and batch file in a temp folder.
SO HOW to Recover.....Some steps bellow.....

1. 1st u open the windows task manager using Alt+Ctrl+Delete
2. Go to Process tab
3. In process there are three or more svchost.exe (Column under Image name) and just left SYSTEM, SYSTEM,NETWORK SERVICES (column under User Name) don't delete this
4. After that another two exe file present ie svhost.exe (not svchost) and under UserName column Administrator ,Administrator
5. Select two exe file(svhost.exe) and click the button END PROCESS

[shark666]

actually thanks for the help friends.. I uninstalled my version of kasperky and installed the latest one 8.0.0.506. I updated it freshly and scanned my system and found that the process "svhost.exe" was a trojan...
more precisely it was some "heur.trojan.generic", I cleaned it and restarted my computer and scanned my windows folder and found a program name "m.exe". I cleaned it...

Now am gonna see if my system shuts down properly and that it does no more freeze at the logoff menu...

[ThoMas321]

m.exe". I cleaned it...

Check if you have done in it right way

Read more about How to Delete m.exe with File Search Tool

Read more about How to kill m.exe Processes

[shark666]

Originally Posted by ThoMas321

Check if you have done in it right way

Read more about How to Delete m.exe with File Search Tool

Read more about How to kill m.exe Processes

Actually my antivirus [KIS 8.0] cleaned it when it was launched and blocked its access.. Now i get an alert that "y.exe" wants to connect to the internet... I cleaned it several times using KIS 8.0 and it reappeared.... But its been 3 hours and after a system restart that i did not see.. I assume its gone....

I've got problem,,, when i surf everytime i have to enter my passwords to websites... its seems that after each system restart or internet non-activity, all my cookies gets erased and i think the cache also get erased....

Can you tell me if these connections are normal, legal?? here's a screenshot>>

http://rapidshare.com/files/166510394/untitled.JPG.html

[shark666]

now am getting a BSOD telling that there is a "bad_pool_error" or something like that... can someone help me........ what to do?? i will be checking all my hardware and clean them up and remove the dust.. I'll just unplug them and clean and then re plug.... is this advisable?

[grizz699]

first.....download malwarebytes. install and update. DO A FULL SYSTEM SCAN. then get super-anti spyware free edition.......install-update-full scan.
Next....do you have a windows cd? If yes......boot from cd, select "r" to repair.
at the command prompt type in chkdsk /p .run this 2 times to make sure you repair things. I have done this many times and it usually fixes the os.
When you type in "chkdsk /p" , make sure to put a space between sk /p.
hit space bar once.

[shark666]

Dude, thanks.. I do not need do so.... I scanned with ad-aware 2008 and KIS 8.0 Simultaneously and found all the infections.. There was no way that they could get away...
But to my great surprise, the Parent infection was from a file that i added as exclusion to scans on kaspersky.. Thats why I kept getting those infections...

The virus "y.exe", i submitted it to kaspersky company via the quarantine windows and the day after they emailed me that this infection was a new one and they will be adding its cure in the new update.. But i already killed that b@$t@rd trojan on my hard disk... It seems that kaspersky is not as efficient as ad-aware.. I had the wrong perception, but i will continue using it as norton or mcafee are no better than it... It give really frequent updates.. its told in some magazines reviews....
Even the BSOD error disappeared and it never reappeared.. It seems that the virus did that..


So i think my problem is solved....


Damn am so relieved... Thanks to you guys...