svchost.exe virus

[mlucool]

Well I think its a virus only I cant find it.

So I just brought my computer home, and my parents computer is having a problem where it says svchost.exe much close. then win32 error - send error report. So I figured something was wrong and got messed up. Now I am having the same problem a few days after being home. This leads to me a virus. I have run spybot, windows defender, and symantec all find nothing.

google leads me to links that say some virus may cause this but nothing specific about where or what it is.

when I look at active processes I have 5 named svchost.ece. Two are NETWORK SERVICE, two are SYSTEM, and one is LOCAL SERVICE. Also weird may and may or may not be related is the fact is that I used to have XP skip which user to click and just log me in, now it wants to choose.

Will viruses usually run under my username or system or both?

Any ideas on how to find this sucker?

Oh ya I try and open my computer and then windows goes through that whole svchost.exe must close thing again and the flashlight is looking for my computer in the folder. I tried a go back but windows says it failed.

 

[mlucool]

"
svchost.exe - Application Error

The instruction at "0x009a96bc" referenced memory at "0x00000000". The Memory could not be "written".

Click Ok to terminate the program.
Click Cancel to debug the program.

"

 

[mlucool]

Sorry for the abundance of posts.
Here is the other error message:

"Data Execution Prevention - Microsoft Windows

To help protect your computer, Windows has closed this program.

Name: Generic Host Process for Win32 Services
Publisher: Microsoft Corporation"

This comes up like 3 times in a row when the computer turns on.

In safe mode neither error message come up.

 

[Osiris]

Go to start, run, type msconfig, press enter, go to the startup tab, click disable all, then recheck your antivirus and reboot. Let us know what happens after this

 

[mlucool]

no error messages pop up when all the startup things are disabled. When I try to open my computer the first error i posted still comes up. Virus scan found nothing. Im thinking a binary search by eliminating 1/2 of the possibilities by checking 1/2 of the startup boxes and seeing if the message comes back, if it doesnt try the other 1/2 of the 1/2 until I find the exact file.

virus scan yeilds nothing

 

[Osiris]

just go one by one till you find it. you need to post a hijackthis log

 

[mlucool]

ok so I found the problem comes when NvCpl is checked.
Command: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If that is checked and I restart the errors come. If it is not checked and I restart no errors, but then it becomes checked automatically for the next restart.

So how do I fix it?

 

[Osiris]

That is the Nvidia graphics helper so you may need to reinstall your video card, or mobo drivers if you have the nvidia chipset I beleive.

 

[boo]

I have this exact same thing.... i have svchost.exe and i think i finally got rid of NvCpl.exe

Just run msconfig uncheck NvCpl.exe on startup then run Mscongfig cleaner which is on Warez Monsters guide

Any idea what i should do about scvchost.exe?

I also have lsass.exe and found this info about it INFO ON LSASS.EXE How would i go about stopping it? its running in the task manager > Processes

 

[Osiris]

Don't stop lsass.exe That is a critical system process

You have scvchost.exe?? Is that spelled correctly? Or is is scvhost.exe?