# svchost.exe keeps crashing!



## Spiritwalker (Sep 29, 2003)

hiya peoples.. I was poking around my system.. and found

stisvc.exe

in my windows task manager.. well.. not knowing what it was I did a google search.. ended up here.. and man!!! I like it!!!

anyone wanna take a look at my HJT log.. see anything amiss?

and does anyone know what stisvc.exe is?

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\r_server.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Program Files\PopUp Killer\PopUpKiller.EXE
C:\Program Files\Crystal Internet Meter\cimeter.exe
C:\WINNT\explorer.exe
C:\Program Files\Belkin\Nostromo\nost_LM.exe
c:\program files\internet explorer\iexplore.exe
C:\Program Files\Winamp\winamp.exe
c:\program files\internet explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\DAVIDE~1\LOCALS~1\Temp\Rar$EX00.437\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [PopUpKiller] C:\Program Files\PopUp Killer\PopUpKiller.EXE
O4 - HKLM\..\Run: [Crystal Internet Meter] C:\Program Files\Crystal Internet Meter\cimeter.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37867.4870486111
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


----------



## ~Candy~ (Jan 27, 2001)

Hi and welcome. I've split you into your own thread for better assistance.


----------



## ~Candy~ (Jan 27, 2001)

> _Originally posted by buckaroo:_
> *
> Spirtwalker.....nothing going on with your log. It doesn't sound like you're having any problems. I believe stisvc.exe is a legitimate app.
> 
> *


Also, going to cut and paste a response from the previous thread you posted to.


----------



## IMM (Feb 1, 2002)

stisvc is the Still Image Service and usu. required for digital cameras or scanners.

What's of more concern is *r_server.exe*
Any idea why there's a remote administration server running?


----------



## Spiritwalker (Sep 29, 2003)

heh.. forgot about this thread.. thanks.. Remote Admin is used by me, from work..
thanks


----------

