1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved essential services do not load at startup

Discussion in 'Malware and Virus Removal Archive' started by jharry, 2008/12/07.

  1. 2008/12/07
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    [Resolved] essential services do not load at startup

    I accidently cut off power to my computer when it was "saving settings" during shutdown. Now when I start my computer, I find that many essential services are not loaded (The Task Manager "Services" tab shows only a few services). For instance: I cannot copy or paste files. The Windows Explorer Seach does not work. I lost all network connections. The Control Panel "Add Hardware" function does not work. The "Help and Support" and "System Restore" does not work. Any help in solving this problem is greatly appreciated.
     
  2. 2008/12/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS jharry

    Download driver_service_info and run it.
    Press S then Enter for a Services report.
    Press B then Enter for both.
    When prompted, press N then Enter to skip LoadOrderGroup info.
    Copy the contents of the log that opens and paste it in a reply here.
     

  3. to hide this advert.

  4. 2008/12/07
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    Thanks for your advice. Following is the content of the log. Since my computer's internet connections are dead, I have to use a public computer to communicate with windowsbbs. I appologize for the late response to your help.

    ~~~ Service Information report ~~~


    ~~~ svchost Export ~~~

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
    HTTPFilter REG_MULTI_SZ
    HTTPFilter
    LocalService REG_MULTI_SZ
    Alerter
    WebClient
    LmHosts
    RemoteRegistry
    upnphost
    SSDPSRV
    NetworkService REG_MULTI_SZ
    DnsCache
    netsvcs REG_MULTI_SZ
    6to4
    AppMgmt
    AudioSrv
    Browser
    CryptSvc
    DMServer
    DHCP
    ERSvc
    EventSystem
    FastUserSwitchingCompatibility
    HidServ
    Ias
    Iprip
    Irmon
    LanmanServer
    LanmanWorkstation
    Messenger
    Netman
    Nla
    Ntmssvc
    NWCWorkstation
    Nwsapagent
    Rasauto
    Rasman
    Remoteaccess
    Schedule
    Seclogon
    SENS
    Sharedaccess
    SRService
    Tapisrv
    Themes
    TrkWks
    W32Time
    WZCSVC
    Wmi
    WmdmPmSp
    winmgmt
    wscsvc
    xmlprov
    BITS
    wuauserv
    ShellHWDetection
    helpsvc
    WmdmPmSN
    napagent
    hkmsvc
    DcomLaunch REG_MULTI_SZ
    DcomLaunch
    TermService
    rpcss REG_MULTI_SZ
    RpcSs
    imgsvc REG_MULTI_SZ
    StiSvc
    termsvcs REG_MULTI_SZ
    TermService
    eapsvcs REG_MULTI_SZ
    eaphost
    dot3svc REG_MULTI_SZ
    dot3svc
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\DComLaunch
    CoInitializeSecurityParam REG_DWORD 0x1
    DefaultRpcStackSize REG_DWORD 0x8
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\dot3svc
    AuthenticationCapabilities REG_DWORD 0x3020
    CoInitializeSecurityParam REG_DWORD 0x1
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\eapsvcs
    AuthenticationCapabilities REG_DWORD 0x3020
    CoInitializeSecurityParam REG_DWORD 0x1
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\HTTPFilter
    CoInitializeSecurityParam REG_DWORD 0x1
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\LocalService
    CoInitializeSecurityParam REG_DWORD 0x1
    AuthenticationCapabilities REG_DWORD 0x2000
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\netsvcs
    CoInitializeSecurityParam REG_DWORD 0x1
    AuthenticationCapabilities REG_DWORD 0x3020
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\PCHealth
    CoInitializeSecurityParam REG_DWORD 0x2
    AuthenticationCapabilities REG_DWORD 0x40
    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost\termsvcs
    CoInitializeSecurityParam REG_DWORD 0x1
    DefaultRpcStackSize REG_DWORD 0x8

    ~~~End of Report~~~
     
  5. 2008/12/08
    Dytrog

    Dytrog Inactive

    Joined:
    2007/01/13
    Messages:
    341
    Likes Received:
    0
    Did you try start run - type in "msconfig" select startup - select all. and see what happens. you will also see what you have as startup before you do the select all.
     
  6. 2008/12/08
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    Here are the items in the "Startup" tab of "msconfig ". All of them were selected.
    uvpl C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
    uvpl C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
    SynTPLpr C:\Program Files\Synaptics\SnTP\SynTPLpr.exe
    SynTPEnh C:\Program Files\Synaptics\SnTP\SynTPEnh.exe
    SSBkgdupdate C:\Program Files\Common Files\Scansoft Shared\SSBkgdupdate\SSBkgdupdate.exe -Embedding -boot
    SOUNDMAN SOUNDMAN.EXE
    qttask C:\program Files\QuickTime\qttask.exe -atboottime
    OpwareSE4 C:\Program Files\Scansoft\OmniPageSE4.0\OpwareSE4.exe
    NeroCheck C:\Program Files\Common Fies\Nero\Lib\NeroCheck.exe
    mcagent C:\Program Files\McAfee.com\Agent\mcagent.exe\runkey
    issch C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start
    isuspm C:\PROGRA~1\COOMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
    ifrmwrk C:\Program Files\Intel\Wireless\Bin\ifrmwrk.exe /tf Intel PROSet/Wireless
    IMSCMIG C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
    EOUWiz C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
    AGRSMMSG AGRSMMSG.exe
    Reader_sl C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    cftmon C:\Windows\system32\ctfmon.exe
    MSMSGS C:\Program Files\Messenger\MSMSGS.exe /background


    Here are the items in the "Services" tab of "msconfig ". All of them were selected, but most were "stopped ". Normaly, there were a lot more items in the "Services" tab, but they are not showing up.

    Capture Device Service Stopped
    EvtEng Stopped
    InstallDriver Table Manager Stopped
    McAfee Services Running
    McAfee Networl Agent Stopped
    McAfee Scanner Stopped
    McAfee Proxy Service Running
    McAfee Real-time Scaner Running
    McAfee SystemGuards Start Pending
    McAfee Personal Firewall Service Running
    Office Source Engine Stopped
    OwnershipProtocol Stopped
    RegSrvc Stopped
    Spectrum24 Event Monitor Stopped
    Ulead Burning Helper Running
     
    Last edited: 2008/12/08
  7. 2008/12/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please open the Task Manager and tell me how many svchost.exe processes you have.
     
  8. 2008/12/08
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    There are none.
     
  9. 2008/12/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please see if you have the file svchost.exe located in C:\Windows\system32 and C:\Windows\system32\dllcache
    The dllcache folder is a hidden folder. It's most easily accessed by typing that path in the Start>Run dialog then hitting Enter.
    If not present in either location, please open a command window and enter the following command.

    dir %Systemdrive%\svchost.exe /a h /s >>check.txt

    Please make note of the spacing between characters .. it is important to enter it correctly.
    When it completes, type the following and hit Enter.

    notepad check.txt

    I need to see the contents of check.txt
     
  10. 2008/12/09
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    The file svchost.exe was found in C:\Windows\system32 but not in C:\Windows\system32\dllcache (I checked the "show hidden files" box in "folder options" to unhide the dllcache folder, but there was no svchost.exe file in that folder)

    Following are the contents of check.txt

    Volume in drive C has no label.
    Volume Serial Number is 1093-57E3

    Directory of C:\WINDOWS\$NtServicePackUninstall$

    08/04/2004 08:00 PM 14,336 svchost.exe
    1 File(s) 14,336 bytes

    Directory of C:\WINDOWS\ServicePackFiles\i386

    04/14/2008 05:42 AM 14,336 svchost.exe
    1 File(s) 14,336 bytes

    Directory of C:\WINDOWS\system32

    04/14/2008 05:42 AM 14,336 svchost.exe
    1 File(s) 14,336 bytes
     
  11. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please enter the following command into a command window.

    copy C:\WINDOWS\ServicePackFiles\i386 C:\WINDOWS\system32\dllcache

    Check the dllcache now. If svchost is present, rename the copy in C:\Windows\system32 to svchost.old
    Now press the F5 key to refresh and see if svchost.exe was replaced with a copy from the dllcache. If successful, reboot and let me know if there's any change.
     
  12. 2008/12/10
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    I followed your instructions. But when I pressed the F5 key in the command window, the previous command ren svchost.exe svchost.old showed up and I got a file not found response. There was no svchost.exe in the C:\windows\system32 folder. I exited the command window and pressed the F5 key while in the desktop. There was still no svchost.exe in the C:\windows\system32 folder. Then I rebooted. There was no change. Did I do something wrong in the press F5 step?
     
  13. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Is there an svchost.exe in the C:\windows\system32 folder now?
     
  14. 2008/12/10
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    There is only a svchost.old file in the C:\windows\system32 folder.
     
  15. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    That suggests there is not an svchost.exe file in the system32\dllcache folder. Please check.
    If necessary, just copy svchost.exe from the C:\WINDOWS\ServicePackFiles\i386 folder to both system32 and dllcache. Reboot and see if there's any change. If no change, check to see if both copies are still in place.
     
  16. 2008/12/10
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    There was a svchost.exe file in the dllcache folder. I copied this file to the system32 folder. Then rebooted. There was no change. Both the system32 and dllcache folders still have the svchost.exe file intact.
     
    Last edited: 2008/12/10
  17. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Assuming you are using an XP machine, copy the svchost.exe file from that machine to the dllcache folder, after first renaming the existing file. Now place a copy in the system32 folder as well. Reboot and see if there's any change.
     
  18. 2008/12/10
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    The public computer that I'm using to communicate with you is a Windows 2000 machine. The svchost.exe on my Windows XP machine has a time stamp of 04/14/2008, which came from a Windows XP SP3 package I downloaded from Microsoft. It doesn't look like this svchost.exe has been corrupted.
     
  19. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Click Start>Run and type services.msc then hit Enter.
    If unable to do that, right click My Computer and select Manage, then double click the Services entry in the left pane.
    Locate Remote Procedure Call (RPC) service in the list and verify if it is running. If not, right click and select Start.
    Let me know what you find there please.
     
  20. 2008/12/10
    jharry

    jharry Inactive Thread Starter

    Joined:
    2008/12/07
    Messages:
    106
    Likes Received:
    1
    The "extended" tab of the "services" window is empty. The "standard" tab has a few entries, but no "RPC" entry.
     
  21. 2008/12/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please open the registry editor by clicking Start>Run and typing regedit then hit Enter.
    Expand the tree to the following key.

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

    Expand and count how many subkeys you have under the Services key.
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.