svchost.exe swopped...?

[Boerseun]

Checkit...

My stepdad's got a laptop, and for the last couple'o days, he can't run anything on it at all.

So I took it, and being the awesomely kind dude that I am, promised him I'll fix it. Of course.

I then came across the oddest screw-up I've ever seen in a very long time, and I can't for the life of me figure it out.

Windoze starts up beautifully, everything right, sweet and dandy, with all the services starting like they should. No issues, no problems in the event log. Until you try to execute a program. Now, you click on any icon on the desktop, or you follow any link through the Start menu, and all that happens, is that the mouse pointer briefly changes into an hourglass, and that's it. Changes back into a pointer, and that's the end of it. No single program executes. So, after lots of struggling, I found the problem. The Task Scheduler Service supposedly kicks off svchost.exe, right? Not so in this machine. This machine kicks off spoolsv.exe when the Task Scheduler is supposed to run. Spoolsv.exe being the Print Spooler, there's no method in this particular madness. And you need the Task Scheduler to organise processing time for apps, otherwise they won't run.

Now, the little box with the path to the file to be kicked off when any particular process needs to run, is greyed out. I can see the path, but I can't edit it - and that's with full admin rights. And what should be pointing to svchost.exe is pointing to spoolsv.exe. Which is wrong.

Anybody seen this before?

That particular path should be registered in the registry - and if I can't panelbeat the path to svhost.exe in the registry, I'm gonna have to rebuild the entire box - which I don't actually want to do...

Advice?

[jab2]

Boerseun, my knowledge of Windows is on the windows level. Your problem is more basement level where I normally do not dwell. I was a bit intriuged however as svchost is a little bugger about whom a lot is written on the web, a lot sense but also a great deal of bull.

I thus Googled a bit and found these which might be helpful. Btw, this thread was #17 in my query result, so not a common thing.
New Virus Attack : (MS Word Icon) SVCHOST SPOOLSV : : : Piyush Labs : : :
SVCHOST / SPOOLSV.EXE Program Detail - TechSpot OS Resources
svchost.exe & spoolsv.exe changed - Kaspersky Lab Forum

[alexander]

Mr B, i have not seen this before, but i have seen windows do spooky stuff, so while i can not tell you what's wrong exactly and where you can follow up on things, i can recommend a "its just gonna be fixed" technique... hopefully anyways.

granted that system restore does not work... (and thats the first thing you wanna try )

figure out what OS version he is running, and find his key to begin
dig through your pile of cds (and i know that any self-righteous computer person has one) and find the installation cd for that version (or newer), worst case, you may have to download it.
put the media in the drive, and reboot to start installation.
in windows setup screen, you are going to say continue, agree to eula, and get to the part that searches for previous windows installs
it will find one, what you want to do is either update or repiar the windows installation (notice the first screen will ask you if you want to repair... skip that one, you gotta get to the part that finds previous installations)
then it will copy all the system files over the current ones, refresh the system registry entries, in 15-20 minutes, it should be fixed