System Admin

4-Dec-04 22:58

This may not be the right place to post this but have a look at it

recently my previous hard disk failed and i replaced it with a new one and i installed windows 2000 pro service pack 4,
i retrived my data from the faulty drive and was doing good till i start connecting to the net;

now i get the error svchost.exe the referenced memory could not be accessed.

i searched and seen many articles explaining what the cause might be , some suggest a virus or worm,
others may be installing the microsoft security patch or downloading the norton tools for fixing the blaster
or welch worm might fix the problem, the microsoft web site suggests editing the registry might solve the problem.

I have a theory how this might have been caused
I first copied the data from the faulty drive on my friends pc; maybe i got the virus from there and i connected the previous
drive to my pc at home so may be if it's a virus thats where i got it from.

Now i have the following symptoms

when i connect to the internet the error message appears and i closed the svchost.exe
no system crash but various odd things showed up i could not copy/paste, move files, and cliking on a URL and
open in a new window could not work, add/remove programs in control panel looked funny, Norton Anti Virus 2004 was disabled
could not launch it again even after i rebotted, the regedit.exe and regedt32.exe don't work till now ,wasn't able to
disconnect i had to manually remove the phone line or restart the computer.windows update could not work.....

After the first encounter with the error message i rebooted the computer and start connecting again then i saw that
the domain field in the connection settings was empty i retyped the server and got connected again boom!!! i see the error
message again now all the symptoms show up again

if i don't connect some of the problems still persist as Norton couldn't start, regedit and regedt32 don't work

In the Middle of connection i see the error message that says internet explorer generated errors and stuff
then when i say don't send a new IE window is launched

Then i downloaded Windows2000-KB823980 security patch as i start to excute the program it exits as soon as it starts
then i downloaded windows2000-KB833330 and i excute it it starts and suddenly exits.

now i see a new message that says your registry size is low increase the registry size it was 18Mb now i made it to 20MB
still no change

I really tried everything;

-Editing the registry is impossible since regedt32 and regedit don't work
maybe i was thinking of writing a program to modify the regstry keys but i am not sure if the suggestion really works,
or i might be messing up the registry by the program i write (VC6)

-i downloaded the norton tools and scanned for the blaster and welch still no infection.

-i unistalled and reinstalled the Norton Anti Virus still no change Norton could not be Activated and Excuted

What is really happening ?? Does any one has any Ideas ??? Pls Help

Confused | :confused:

Mekong River5-Dec-04 2:59

5-Dec-04 2:59

Leyusha wrote:
This may not be the right place to post this but have a look at it

Yes, that is the right place that you post this thread.

Leyusha wrote:
now i get the error svchost.exe the referenced memory could not be accessed.

Of course, according to my experience, your computer is infect with w32.blaster.worm[^]. To solve this problem, try to keep your document away in the safe place. Then go to any PC that is not infect with the virus and download the following files step by step:

1. Download security patch KB823980[^].
2. Download security patch KB824146[^].
3. Download MS03-026 scanner tool[^]. This tool is used to verfiy that you install the above security patch success or not.
4. Donwload Blaster remove tool[^] from norton website.

Then copy all of these files to the infect computer via CDROM. Do not connect your infect computer to the network or the internet. Then try to install the security patch one by one as I order in the list. If it is not install in the normal mode, try to restart your computer in the safe mode and install the security patch one by one follow by the list that I order for you.

Leyusha wrote:
i downloaded windows2000-KB833330

Try to use this tool as the last step, it is optional. When the virus was first spread on the interent Microsoft just inform the above security patch. But the last patch also helpful too.

Leyusha wrote:
when i connect to the internet the error message appears and i closed the svchost.exe
no system crash but various odd things showed up i could not copy/paste, move files, and cliking on a URL and
open in a new window could not work, add/remove programs in control panel looked funny, Norton Anti Virus 2004 was disabled
could not launch it again even after i rebotted, the regedit.exe and regedt32.exe don't work till now ,wasn't able to
disconnect i had to manually remove the phone line or restart the computer.windows update could not work.....

That is the symthom that your computer infect with the virus. Remember for further challenges.
Remember that in windows xp, when it infect and after you clean it, it alwasy display report that virus is captured and remove. But in windows 2000 sometime it display, but some time it is not. So after you perform these 4 steps successfully, then try to check that the copy/paste function in windows explorer is working or not... your anti-virus is running or not... if it is working than it mean that your computer is rescure from the virus. Try to run windows update, office update and virus definition update regalurly to protect your computer from virus attack.

Good luck
Rose | [Rose]

A thousand mile of journey, begin with the first step.

APO-CEDC
Save Children Norway-Cambodia Office

Leyu5-Dec-04 6:10

5-Dec-04 6:10

Thanks a Lot ! I will try it

Leyu5-Dec-04 9:34

5-Dec-04 9:34

I did the steps u recommended that is

i downloaded the patches u pointed out in an isolated labtop burned them to
a cd then when i tried to install them it failed then i switched to safe mode and
installed the patches and i ran the scanner tool it says failed to initialize socket or so

but after that i scanned for the worm using the blaster worm removal tool still
no change one thing i noticed after i installed the 2nd patch in windows start
up is a message box saying svchost.exe the program is currently in use or some similar message.

Even after scanning my pc and Norton claims that there is no worm; i can not see
contents of program files and windows in normal mode control panel's add/remove programs
is corrupted, can not open regedit and regedt32, what is happening really ???
i wonder if it is only the blaster worm ???!!!

In the task manager i saw "SWchost.exe" not "svchost.exe" and i killed the process
i also see cool.exe created when i tried to open windows folder what is cool.exe and SWchost.exe???

I have sophos anti virus should i install it instead of norton,should i be installing any
fire walls like zonealarm or what ?? why am i not able to see contents of my folders???

Leyu5-Dec-04 21:02

5-Dec-04 21:02

I finally found out the problem m pc is infected with the Dumaru virus and i removed it using the norton and sophos tools but the problems still persist i.e folders not showing contents and so on....

Any further updates

Roger Wright7-Dec-04 2:36

Roger Wright

7-Dec-04 2:36

It's possible that the virus has corrupted your files beyond recovery. One last-ditch approach would be to reinstall Win2K on the new drive (to ensure an undamaged configuration) and install your antivirus software on it. Make sure the AV software is fully updated and working correctly. Then shut down and add the old drive as a secondary hard drive. On startup, nothing on that drive should be executed at boot up, so any viruses on it will be inactive. You can then scan the drive and let the AV software repair or delete and infected files there, after which it should be safe to copy the files that survive to the new drive. You can then remove the second drive and trash it.

This assumes, of course, that the old drive is still functional enough to run for a little while. If not, you're probably out of luck. Frown | :(

"If it's Snowbird season, why can't we shoot them?" - Overheard in a bar in Bullhead City

Mekong River8-Dec-04 11:16

How to upgrade a domain controller?

8-Dec-04 11:16

Leyusha wrote:
problems still persist i.e folders not showing contents and so on....

Because you are using windows 2000 I'm not sure too but if your are using windows xp pro, you should use command SFC /scannow from the command prompt. This command will check your system file and repaire any system file that is corrupt.

Leyusha wrote:
I finally found out the problem m pc is infected with the Dumaru virus

Remember that next time if you think that you computer affect with the virus, the most importance thing is search for the virus name. Sometime our anti-virus is just detect the virus but could not clean/delete it. Because some virus need the special method or tool to delete it, you should find any method to detect for the virus name then search it on the internet about the method to clean it.

A thousand mile of journey, begin with the first step.

APO-CEDC
Save Children Norway-Cambodia Office

Miszou4-Dec-04 12:44

Miszou

4-Dec-04 12:44

I have an old Windows NT 4.0 Server system that is finally reaching the limits of its usefulness, and I would like to upgrade it to Server 2003. The Server is currently responsible for the following tasks in my network:
- Domain Controller
- Web Server
- File Server
- Print Server
During the upgrade, I would like to replace the current 60gb drive with a new 160gb drive and a more sensible partition layout, so I'm guessing that an "upgrade" is not really the way to go - I think I'm looking at a clean install.
My biggset problem is how to preserve the existing domain so that clients do not lose their profile settings. Any suggestions on how to perform this upgrade would be very welcome!
Thanks. Smile | :)

WDevs - The worlds first DSP, free blog space, email and more. Now also with forums Smile | :)

Anders Molin4-Dec-04 13:41

Anders Molin

4-Dec-04 13:41

If you can not perform an upgrade but want a clean install on the same hardware your only choise is:

Upgrade the NT 4 to win2003.
Install another machine with win2003 and add it as domain controller.

Transfer all responsebilities for the domain to the new server.

Reinstall the original server with win2003, and add it as domain controller, and transfer all responsibilities for the domain to it.

Shut down the temp server, and you'r done Smile | :)

- Anders

Bill's Bar

My Photos

Miszou4-Dec-04 16:05

Miszou

4-Dec-04 16:05

Thanks for the quick reply!

I thought about making a backup domain controller when I was in the shower earlier, but I'd already posted the message! Smile | :)

Fortunately, I have a spare computer that I can use for such a purpose. I think I'll set it up to run alongside the existing server and then slowly move services (eg. web, email, domain control) onto the new box. Eventually I should be able to unplug the original server ad be done.

The current server is actually an old Pentium 2 (333mhz, 256mb), so a slightly newer, more powerful computer might not be a bad idea anyway....

Smile | :)

Mekong River26-Feb-06 16:31

26-Feb-06 16:31

Anders Molin wrote:
Transfer all responsebilities for the domain to the new server.

I think this point a little bit difficult do with file sharing. According to my experience, i rarely use one server with multi purpose. Whether you have a new server and configure as additional domain controller, you could only replicate an object in active directory. But you could not move the file from one DC to another DC. Just moving, you could do that but it will lost its permission and you have to reassign the permission to file and folder especially you will have a problem with roaming profile, home direcotry and folder redirection... of each user.

Mekong River26-Feb-06 16:51

Inspiron 8500 special button app [Found it]

26-Feb-06 16:51

Miszou wrote:
- File Server

This is the problem, you use one DC to handle many task, especially the file server. This is the most complicate task that you need to handle with. According to my experience, i used to seperate to multi server which handle a difference task. It any server that is down or need to maintenance, it won't impact to the other server. Whether you have a new server and configure as additional domain controller, you could only replicate an object in active directory. But you could not move the file from one DC to another DC. Just moving, you could do that but it will lost its permission and you have to reassign the permission to file and folder especially you will have a problem with roaming profile, home direcotry and folder redirection... of each user.

Matt Newman3-Dec-04 6:58

Matt Newman

3-Dec-04 6:58

Anyone know what app controls the special buttons on Inspirons (specifically 8500 but its probably universal) I'm working on my dad's computer and I think I disabled it shutting down anything I didn't recognize. I don't want to run down the list and just run anything. Any help would be appreciated.

[EDIT]Not sure what it was but i think it was DSentry. All I had to do was re-enable it in msconfig and reboot for those that may have the same problem.

^Matt Newman

Even the very best tools in the hands of an idiot will produce something of little or no value. - Chris Meech on Idiots

Monitor network printer

Mekong River2-Dec-04 9:57

2-Dec-04 9:57

I read the book from MCSE training kit Microsoft windows 2000 professional (Published by Microsoft Press). In chapter 11 about network printing it said that in the workgroup environment the printer could handle only 10 concurrent user. That make me think about the printer at my office. Sometime it could not print out, I don't know why but might be become from this issue (insufficient printer memory). My question is, are there any log that record which user print to the specify printer on the network? if it is possible then it is a good way for me to estimate how many time that user print on that printer and easy for me to manage the printer too.

A thousand mile of journey, begin with the first step.

APO-CEDC
Save Children Norway-Cambodia Office

System Speakers

vikramlinux1-Dec-04 23:43

vikramlinux

1-Dec-04 23:43

Hie,
I want to disable system speakers. But My headphones should work. Is there any way...When i pull headphone pin from socket systems speakers turn on...I dont want that...

Re: System Speakers

raouls2-Dec-04 1:01

raouls

2-Dec-04 1:01

a - try your BIOS
b - rip out your internal speaker

--
Raoul Snyman
Saturn Laboratories
e-mail: raoul.snyman@saturnlaboratories.co.za
web: http://www.saturnlaboratories.co.za/
linux user: #333298

Re: System Speakers

Mekong River2-Dec-04 9:51

Parallel Port Programming in Windows XP

2-Dec-04 9:51

vikrams wrote:
I want to disable system speakers

Right click on the My computer on the desktop and click on Property menu, navigate to the Hardware tab and click on Device Manager. Try to find Sound, Video and game controller node and double click on it and right on sound item and click disable. This will disable your sound from the system.

A thousand mile of journey, begin with the first step.

APO-CEDC
Save Children Norway-Cambodia Office

Nikhil Wason28-Nov-04 21:58

Nikhil Wason

28-Nov-04 21:58

I wish to control LEDs on a bread board through the parallel port using a c++/vc++ program made in windows xp. I tried doing the same thing on windows 98 where it worked but i guess windows xp does not give permissions to access the parallel port for programming. Is it really so?? If yes, then plz suggest a suitable alternative or workaround to this so that i can control LEDs by programming on windows xp.

I'm also interested in knowing how to program the USB & serial ports. Can anyone help me out pls??? Confused | :confused:

Nikhil

Re: Parallel Port Programming in Windows XP

Matt Newman29-Nov-04 6:06

Matt Newman

29-Nov-04 6:06

As I understand it you will either need to create a XP-compatible driver or find one that already suits your needs and use that.

^Matt Newman

"May they go to hell!" the soldiers shouted. Allawi replied: "To hell they will go." - Minister Ayad Allawi

Re: Parallel Port Programming in Windows XP

Arsalan Malik1-Dec-04 22:23

Arsalan Malik

1-Dec-04 22:23

Windows 2000 and XP does not gives access to parallel port. Alternate is to use a device driver which resides in kernel and gives access to your program. Check out this page:

http://www.codepedia.com/zone15/cat610/

I used Inpout32.dll and it worked. You only have to use dll, and call its functions: Inp32(...), Out32(...) Cool | :cool:

ARSALAN MALIK

Script for Printer

pn199525-Nov-04 22:32

pn1995

25-Nov-04 22:32

Hi Does anyone know of a script of free utility that will let you connect to Windoews 2000 printer and change the secuity on it? We would like to add a new group to all our printers on our print server that has "Manage Printer" rights.

Thanks

Re: Script for Printer

Mekong River1-Dec-04 21:42