tupacboy

hi guys,

got a malware yesterday. got rid of it, but now i get this error message on every boot.

Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.

i'm running win xp sp3

checked it with adaware and malwarebytes and its clean

ran avg and micro housecall and got rid of cookies etc.

tried turning off windows update.

read that hp products cause this error but i don't have any hp ever installed on here...

at least its not taking up my processing speed... more of a boot up annoyance.

this is what i can pull from event viewer:

Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 7/6/2009
Time: 9:34:56 PM
User: N/A
Computer: Tupac
Description:
Faulting application svchost.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x00406a05.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 6c707041 74616369 206e6f69 6c696146
0010: 20657275 63767320 74736f68 6578652e
0020: 312e3520 3036322e 35352e30 69203231
0030: 6e75206e 776f6e6b 2e30206e 2e302e30
0040: 74612030 66666f20 20746573 30343030
0050: 35306136 0a0d


any ideas?

attgig

no fun when it says:
faulting module unknown, version 0.0.0.0


try downloading http://technet.microsoft.com/en-us/s.../bb896653.aspx
and having that startup on bootup. that way, before you click ok, hopefully you can catch which svchost it is, and find out what service is causing the problem.
if you the process explorer doesn't catch the svchost before the error gets thrown, you might have to go a different route.

one, boot up in safemode, and make sure it doesn't happen there.
if it does happen there, i don't know what to tell you.
If it doesn't, then it's most likely one of the services at startup that's trying to run, but is now missing.
you can try going to the list of services on your computer (right click mycomputer->manage->services&apps->services).

go through the list that have automatic as the startup type, and go through that list. you can post it up here, or google search anything that's unfamiliar and see if they're remnants of the malware. you can rightclick the service, properties and find the directory/app of the exe that the service will run. most likely a service is still there, but the exe is missing.

__________________

mechmike0034

Run dial-a-fix and see what happens...

__________________
"The price of progress is trouble." (C. F. "Boss" Kettering)
"50% of the American public has below-average intelligence. 70% of the American public now has regular access to the Internet. Do the math." (unknown)

GilbertsGrape

I have had this problem before this is the solution from Microsoft. I made a bat file to make it easier i had 40 or so machines with this problem.

RESOLUTION

To resolve this issue, follow these steps leaving the svchost.exe error message dialog box open:

Step1: Check whether settings for the Automatic Updates and Background Intelligent Transfer Service ! (BITS) services are correct


To do this, follow these steps: 1. Click Start, point to Run, type services.msc in the Open box, and then click OK.

2. In the right pane, locate and double-click Automatic Updates.

3. Click the Log On tab.

4. Make sure that the Local System account! option is selected and the Allow service to interact with desktop option is unchecked.

5. Make sure that this service has been enabled in the Hardware Profile list. If not, click Enable to enable it.

6. Click the General tab, make sure that the Automatic option is clicked in the Startup Type drop-down list. Click Start under Service status to start the service if it is not already running.

7. Repeat steps 2 through 6 for Background Intelligent Transfer Service (BITS).





Step 2: Reregister Windows Update components

To do this, follow these steps: 1. Click Start, click Run, type REGSVR32 WUAPI.DLL, and press ENTER.

2. When you receive the "DllR! egisterServer in WUAPI.DLL succeeded." message, click OK.

3. Run the following commands one after the other:

REGSVR32 WUAUENG.DLL

REGSVR32 WUAUENG1.DLL

REGSVR32 ATL.DLL

REGSVR32 WUCLTUI.DLL

REGSVR! 32 WUPS.DLL

REGSVR32 WUPS2.DLL

REGSVR32 WUWEB.DLL

I did not have to do any of the steps after this but i have included them in case you do.

Step 3: Rename the Windows Update temporary folder

It is possible that the temporary folder of Windows Update may be corrupted. In this case, we can rename the temporary folder of Windows Update. To do this, follow these steps: 1. Click Start, click Run, type cmd in the Open box, and then press ENTER.

2. At the command prompt, type net stop Wuauserv, and then press ENTER.

3. Click Start, click Run, type %windir% in the Open box, and then press ENTER.

4. In the opened folder, locate and rename the SoftwareDistribution folder to SDold.

5. At the command prompt, type net start Wuauserv, and then press ENTER to start the Automatic Updates service.



WORKAROUND

To work around this issue, follow these steps: 1. Click Start, right-click My Computer, and then click Properties.

2. In the System Properties dialog box, click the Automatic Updates tab.

3. Click Turn off Automatic Updates, and then click OK.

4. Restart the computer.

5. Use the Windows Update Web site to install updates manually.

6. After you install the updates manually, turn on Automat! ic Updates.









If you have any feedback or appreciation regarding Microsoft s!