Virus crash svchost without MS06-040

  • Article

Viruses may crash svchost.exe/services.exe on servers that do not have MS06-040 installed.

Several servers that do not have MS06-040 installed have been attacked by viruses. If your server encounters any of the symptoms listed below, check for MS06-040 (KB921883). If you do not have it installed, doing so will fix the problem.  

Common systems:

a.       SVChost.exe crashes frequently in Windows server 2003.

b.      Services.exe crashes frequently in Windows 2000.

c.       Service stops working on the server.

d.      Some services fail to start, e.g. “Computer Browser”, “Distributed File system”, “Net Logon,” and “Microsoft Exchange System Attendant”

e.      The application logs several instances of “Application Error” event 1000 (svchost.exe crashed due to netapi32.dll).

For more information, please refer to:

A known virus Win32/Graweg.B for MS06-040:
https://safety.live.com/site/en-US/virusenc/VirusEncInfo.htm?VirusID=312611

-End-

Author:Steven Xu