svchost.exe, conhost.exe & csrss.exe

I'm online with a Debian linux machine as I've problems with my mai
machine running WinXP Pro.

Windows XP Pro x64. It's been running for years on the computer.
upgraded the drive from 250 GB to 500GB then recently to 1TB. This las
time I tried to be as correct as possible so I bought Norton Ghost 15.
and cloned the drive. That was just under a month ago and all had bee
okay until recently.

I didn't back up the drive before or after the cloning.

I recently started getting redirects in Google searches. I ran Spybot
something I do infrequently. Spybot showed CoolWWWSearch.OleHel
infection of svchost and. conhost.exe, Win32FakeAlert.ttam infection o
csrss.exe. Spybot would fix the problems but the infection would retur
almost immediately.

I'd gotten complacent about making changes with regedit. There are n
registry backups and now can't make any.

I made changes in trying to clear the infection(s).

The infection(s) problem is on the back burner while I try to fix wha
I broke.

The WinXP Pro machine will boot into Windows just fine. The logi
screen shows the one user and I login. No services are running. I loo
in Task Manager and svchost.exe, conhost.exe and csrss.exe are al
running.

File search doesn't work. My Eudora doesn't find its mailboxes.
Commands don't run, e.g. Ntbackup.exe run as Administrator comes up wit
The service did not respond to the start or control request in a timel
fashion.

I try to run Norton Ghost but get Error in Main. Image format is no
valid. The image file may be corrupted. Parameter name: stream

I tried a reinstallation of Norton Ghost but get that the Window
installation wizard service isn't running.

I've started the machine in Safe Mode and tried running Ntbackup.ex
but it won't run in Safe Mode. I tried adding Administrator t
Ntwindows in regedit but it wouldn't take until I added it using regedi
in Safe Mode. Now I can login to Administrator from the normal WinX
login screen but still programs complain that no services are running.

I try searching for files from Start > Search but the attempt seems t
get dumped into the bitbucket as the Search dialog never appears.

I open Administration Service and immediately see it's opening t
Extended instead of Standard making it look as if there are no service
installed. I go to the Standard page and see the services. I had mad
some changes here as well trying to clear the infections. I recall
disabled DCOM Server Process Launcher. I try to enable DCOM but Star
Stop Pause Resume and Restart are all grayed out. I try the DCO
Properties but it doesn't run.

I tried going to My Computer and selecting Properties of Local Disk C:
Sharing, and checking Share this folder on the network. In order t
successfully clone the drive with Norton Ghost I found I had to enabl
sharing the C: drive then changed it back after the cloning. Now
reasoned I might need to re-enable sharing on C: to get some normalit
back but now I get "An error occurred while trying to share C. Th
Server service is not started. The shared resource was not created a
this time."

So, it seems as if my drive is somehow locked down. It's as if th
drive is being protected. I'd appreciate suggestions on how to ge
services running once again. I'm putting off a reinstallation o
Windows. I have a single icon space free on my desktop and know if
reinstall Windows I'll see that WinXP vision of rolling fields instea
of my 103 folders, shortcut and program icons.

I'm looking forward to your suggestions.

BillJohnsto

it's in your regedit back up!
And is Being Scheduled Tasks bacK

P.S.

http://en.wikipedia.org/wiki/Svchost

If you seeing Svchost.exe it can be the one made by Spybot
For 99.999% of Svchost.exe good!

"MyNews" <(E-Mail Removed)> wrote in message
news:ie7l20$adr$(E-Mail Removed)...
> it's in your regedit back up!
> And is Being Scheduled Tasks bacK