Błąd Generic Host Process for Win32 Services

aholz · 16 Maj 2007 16:06

Witam

Mam problem z Generic Host Process for Win32 Services. Zainstalowałem poprawki WindowsXP-KB894391-x86-PLK, WindowsXP-KB921883-x86-PLK oraz wyłączylem wszystkie porty aplikacją wwdc. Niestety nie pomogło.

Oto log HijackThis

Logfile of HijackThis v1.99.1 Scan saved at 17:55:01, on 2007-05-16 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\slmdmsr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\system32\VTtrayp.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\Program Files\Adobe\Acrobat 5.0 CE\Distillr\AcroTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\svchost.exe D:\install\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Acrobat\ActiveX\AcroIEHelper.ocx O4 - HKLM…\Run: [VTTimer] VTTimer.exe O4 - HKLM…\Run: [VTTrayp] VTtrayp.exe O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM…\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0 CE\Distillr\AcroTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: winsys32 - C:\WINDOWS\system32\winsys32.dll O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slmdmsr.exe

Zgóry dziękuję za pomoc.

Gutek · 16 Maj 2007 16:36

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\System32\rpcc.dll

C:\WINDOWS\System32\winsys32.dll

i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

Daj log z Combofix

aholz · 16 Maj 2007 17:04

Oto log

“a” - 2007-05-16 19:00:42 Dodatek Service Pack 2 ComboFix 07-05.13.2.V - Running from: “D:\install” (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\max1d1641.exe ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-16 )))))))))))))))))))))))))))))))))) 2007-05-16 18:51 2007-05-15 21:09 20,480 --a------ C:\WINDOWS\system32\9535312ld.exe 2007-05-11 14:22 0 --a------ C:\WINDOWS\system32\2248122ld.exe 2007-04-26 21:34 2007-04-26 21:30 64,000 --a------ C:\WINDOWS\system32\esfw41.bin 2007-04-26 21:30 274,432 --a------ C:\WINDOWS\system32\esint41.dll 2007-04-26 21:30 176,128 --a------ C:\WINDOWS\system32\eswia41.dll 2007-04-26 21:30 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-04-20 13:56 2007-04-19 21:07 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-04-19 21:07 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-04-19 21:07 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-04-19 21:07 2,222 --a------ C:\WINDOWS\system32\tmp.reg 2007-04-19 20:59 2007-04-19 19:37 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:48 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:48 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:48 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:34 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-09 18:49:54 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-02-09 18:49:54 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Acrobat\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “VTTimer”=“VTTimer.exe” “VTTrayp”=“VTtrayp.exe” “SoundMan”=“SOUNDMAN.EXE” “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” “HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe]) “VTTrayp”=“VTtrayp.exe” [2005-09-14 13:47 C:\WINDOWS\system32\VTTrayp.exe]) “SoundMan”=“SOUNDMAN.EXE” []) “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2005-07-08 11:05] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe” [2001-10-22 21:09] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winsys32 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-16 19:01:39 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-16 19:01:41 C:\ComboFix-quarantined-files.txt … 2007-05-16 19:01

Gutek · 16 Maj 2007 17:09

Otwórz Notatnik i wklej w nim to:

Plik >>> Zapisz jako >>> Ustaw rozszerzenie z TXT na Wszystkie pliki >>> zapisz pod nazwą FIX.REG >>> kliknij podwójnie zrobiony plik i potwierdź >>> reset kompa

Użyj Pocket Killbox. Zaznaczasz opcję Delete on Reboot oraz All Files i w polu Full Path of File to Delete wklejasz ścieżki

C:\WINDOWS\system32\9535312ld.exe

C:\WINDOWS\system32\2248122ld.exe i naciskasz X czerwony. Program poprosi o reset kompa … czyli resetujesz.

aholz · 16 Maj 2007 17:32

Gotowe. Podać jakiś log?

Gutek · 16 Maj 2007 17:44

Daj z Combo

aholz · 16 Maj 2007 17:48

Proszę bardzo oto log:

“a” - 2007-05-16 19:46:40 Dodatek Service Pack 2 ComboFix 07-05.13.2.V - Running from: “D:\install” ((((((((((((((((((((((((((((((( Files Created from 2007-04-05 to 2007-05-16 )))))))))))))))))))))))))))))))))) 2007-05-16 19:01 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-05-16 18:51 2007-04-26 21:34 2007-04-26 21:30 64,000 --a------ C:\WINDOWS\system32\esfw41.bin 2007-04-26 21:30 274,432 --a------ C:\WINDOWS\system32\esint41.dll 2007-04-26 21:30 176,128 --a------ C:\WINDOWS\system32\eswia41.dll 2007-04-26 21:30 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2007-04-20 13:56 2007-04-19 21:07 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-04-19 21:07 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-04-19 21:07 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-04-19 21:07 2,222 --a------ C:\WINDOWS\system32\tmp.reg 2007-04-19 20:59 2007-04-19 19:37 (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:48 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:48 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:48 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:34 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys 2007-02-09 18:49:54 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat 2007-02-09 18:49:54 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat 2007-02-05 20:19:48 185,856 ----a-w C:\WINDOWS\system32\upnphost.dll (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 5.0 CE\Acrobat\ActiveX\AcroIEHelper.ocx [2001-04-16 18:39] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] “VTTimer”=“VTTimer.exe” “VTTrayp”=“VTtrayp.exe” “SoundMan”=“SOUNDMAN.EXE” “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” “HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe” [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “VTTimer”=“VTTimer.exe” [2005-03-08 03:33 C:\WINDOWS\system32\VTTimer.exe]) “VTTrayp”=“VTtrayp.exe” [2005-09-14 13:47 C:\WINDOWS\system32\VTTrayp.exe]) “SoundMan”=“SOUNDMAN.EXE” []) “SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe” [2005-07-08 11:05] “NeroFilterCheck”=“C:\WINDOWS\system32\NeroCheck.exe” [2001-07-09 11:50] “HPDJ Taskbar Utility”=“C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe” [2001-10-22 21:09] HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages msv1_0\0\0 Security Packages kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages scecli\0\0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService DnsCache\0\0 rpcss RpcSs\0\0 imgsvc StiSvc\0\0 termsvcs TermService\0\0 HTTPFilter HTTPFilter\0\0 DcomLaunch DcomLaunch\0TermService\0\0 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost ******************************************************************** catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-05-16 19:47:36 Windows 5.1.2600 Dodatek Service Pack 2 FAT scanning hidden processes … scanning hidden services … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 2007-05-16 19:47:37 C:\ComboFix2.txt … 2007-05-16 19:01 C:\ComboFix-quarantined-files.txt … 2007-05-16 19:47

Gutek · 16 Maj 2007 17:51

No i już powinno być dobrze

aholz · 16 Maj 2007 17:53

Dzieki!!

Jesteś wielki!!

:):)

Złączono Posta : 16.05.2007 (Sro) 21:17

Czy jesteś mi w stanie powiedzieć na co zwracać uwagę aby tego uniknąć w przyszłości lub skąd się ten badziew wziął?