SVCHOST error to msi.dll

gsellis

Diamond Member
Dec 4, 2003
6,061
0
0
I do not know how common this is as I have seen exactly 1. But just in case, I am posting to help save some time. You may not see it. I am not sure if there was anything my step-daughter did to help this happen.

Scenario, lappie with XP Home SP2 loaded. Autoupdate is on. Last night was the first time it had been powered on since 10/18. On 10/18, it got the latest hotfixes (per its logs).

As the system logs in, all the tray icons load and it is ready for use. About 1 minute later, a popup error would appear with SVCHOST having an error at xxxxxxxx calling 00000000 in msi.dll (sorry, did not write it down, but we have all seen them). You would then get the OCA message about a Generic Service caused an error and would you like to report it. IF you clicked OK on the SVCHOST system modal box, Explorer and any apps running in Explorer's shell would no longer respond. Clicking Cancel would work ok.

Problem: The security fix: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution (924191) failed to load correctly. If you open the Windows Update tray item, it will eventually show you that it needs to load. And if you try to load it through the update, it will usually fail with the SVCHOST popup.

Why this makes sense? Well, most of the hotfix stuff is now XML. If a XML fix fails...

How I fixed it: I went to IT Pro page for security fixes and opened October http://www.microsoft.com/technet/security/bulletin/ms06-oct.mspx. I then went to the bulletin and loaded it http://www.microsoft.com/technet/security/Bulletin/ms06-061.mspx

After manually loaded the fix and restarting, everything will be back to normal. The updater may try to load it again, but it is now fixed.
 

Bozo Galora

Diamond Member
Oct 28, 1999
7,271
0
0
Dont know if this is related, but I just went through something similar.
I use win 98/XPSP2 dual boot on this particular machine. I find that 98 is less virus prone because it doesnt have all the XP protocols/services, so I use it for surfing the web. Along with Firefox or Opera, with my various AV and ZA, I seldom get anything. About a week ago, in a big hurry, and not thinking, I clicked on an exe I should have scanned first.. I immediately started getting these SVCHost error windows, in rapid succession, and clicking cancel or O.K. only made it worse, then there were so many, I had no available ram and all my AV shut down. I couldnt even turn off the computer with mouse clicks. I tried running AV from booting rescue CD's, it just got worse. I have never seen anything like this, and I have run into just about every worm and trojan over the years. I finally had to reimage my C partition from my back up DVD, something I havent done in a long time.

http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049579.html

http://ask-leo.com/svchostexe_error_svchostexe_has_generated_an_error_now_what_do_i_do.html
 

jhayx7

Platinum Member
Oct 1, 2005
2,226
0
0
We had major issues with this today here at work. It seems that booting the computer into safe mode and letting it sit for a while did the trick. I had one that didn't work, told the error to "debug" and it fixed the issue :confused:
 

gsellis

Diamond Member
Dec 4, 2003
6,061
0
0
Originally posted by: jhayx7
We had major issues with this today here at work. It seems that booting the computer into safe mode and letting it sit for a while did the trick. I had one that didn't work, told the error to "debug" and it fixed the issue :confused:
Cancel and Debug did not lock it like clicking OK did on mine. If it still happens elsewhere, installing the patch manually is apparently the cure.

 

gsellis

Diamond Member
Dec 4, 2003
6,061
0
0
Originally posted by: Bozo Galora
Dont know if this is related, but I just went through something similar.
I use win 98/XPSP2 dual boot on this particular machine. I find that 98 is less virus prone because it doesnt have all the XP protocols/services, so I use it for surfing the web. Along with Firefox or Opera, with my various AV and ZA, I seldom get anything. About a week ago, in a big hurry, and not thinking, I clicked on an exe I should have scanned first.. I immediately started getting these SVCHost error windows, in rapid succession, and clicking cancel or O.K. only made it worse, then there were so many, I had no available ram and all my AV shut down. I couldnt even turn off the computer with mouse clicks. I tried running AV from booting rescue CD's, it just got worse. I have never seen anything like this, and I have run into just about every worm and trojan over the years. I finally had to reimage my C partition from my back up DVD, something I havent done in a long time.

http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049579.html

http://ask-leo.com/svchostexe_error_svchostexe_has_generated_an_error_now_what_do_i_do.html
You described the classic, poorly written trojan. I can use Corporate Error Reporting (MS Online Crash Analysis) to find some adware, worms, and trojans because it will crashdump and show up in the log ;)