Blaster - Eudora - Svchost.exe

Eudora, Win2K, the Blaster Worm and svchost.exe

Tuesday August 12th was the fateful day for my computers. I didn’t realize it but just using a dial up connection would make my laptop susceptible to the blaster worm, and my networked imaging computer just as susceptible. An intermittent error message I was getting every time Eudora was running was the result of the blaster worm. The message was:

SVCHOST.EXE has generated errors and will be closed by Windows. You will need to restart the program. An error log is being created.

For that Windows needed to be restarted. Then the internet connection needs to be reestablished and Eudora started again. Then the error message again. Get the picture?

A current Norton Anti-Virus or McAfee did not see the blaster worm when it came in. I had McAfee on my laptop and Norton on my imaging computer. It wasn’t until later that day that they had a patch and definitions to catch it.

As a result of Svchost.exe shutting down, I was unable to do some basic Windows functions in any program, like copy and paste for example. In Eudora, I was unable to open mailboxes or delete messages. I’d always thought Eudora immune to these computer viruses but not this time. The support message on the Eudora web site described the symptoms with no mention of the cause blaming it on Windows.

After running the blaster fix from one of the anti-virus web sites and updating my Windows installation to avoid reinfection, I realized that the problem wouldn’t go away. Any time I got the computer on line and started my browser, within minutes I’d get the “Svchost.exe has closed” message and have to reboot again.

I tried replacing the Svchost.exe file from the Win2K CD. Because it's running I had to replace it in DOS, but replacing it didn't solve anything.

The only solution was to back up my data and reformat.

I backed up all my data files and client web sites to an external hard drive connected through an IDE to USB2 enclosure and reformatted and installed Win2K, the drivers, Service Pack 2, Norton Anti-Virus and a clean copy of Eudora. Running Eudora at this point didn’t give me any problems until I restored all my old e-mail, filters, address book and profiles. Then restarting Eudora immediately gave me the svchost.exe error message again forcing me to start over.

Meanwhile, I installed Win98SE on my old (233 PII) laptop which is immune to the blaster worm, and have been running my e-mail program until I can figure out why Eudora is corrupting Windows.

As for my imaging computer, I ordered a new computer from Dell and was able to copy my data files from the C Drive of my old computer. Dell was extremely prompt in building and delivering the new box getting it to me in only five days from placing the order. And the old computer doesn’t have the Svchost.exe problem unless I connect to the Internet so I can use it to burn DVD and CD’s through my external IDE to UDB2 hard drive enclosure from my two back up 120 Gig hard drives.

Dealing with the laptop

I’ve purchased PowerQuest’s Drive Image 7 program and intend on making a mirror image of my laptop to an external hard drive while experimenting with Eudora to see which file or mailbox might be corrupted. That will allow me to continue to bring over my old e-mail and reinstall the entire drive in minutes when the error message appears.

Description of Svchost.exe from Microsoft's web site

Svchost.exe is a generic host process name for services that are run from dynamic-link libraries (DLLs). The Svchost.exe file is located in the %SystemRoot%\System32 folder. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. There can be multiple instances of Svchost.exe running at the same time. Each Svchost.exe session can contain a grouping of services, so that separate services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.