Generic Host Process for win32 service has encountered a problem?

[Bruce F. Leavitt]

I have afriend that just got a new computer and has this error.

Generic Host process for win32 service has encountered a problem and needs
to close?

This is when he starts internet explorer 6.0 , he is using windows xp, and
he has to close the browser, and disconnects him?

I am posting to both IE6 and Windows XP, because I am unsure where the
problem is. I looked on Microsofts FAQ's and couldn't find
any answer..

Bruce

 

[PA Bear]

Courtesy of MVP Ken Blake:

MSBlaster worm. To remove it, do the following:

The following instructions are in three parts

1. Stop it from running

2. Remove it from your system

3. Make sure it doesn't come back

Before beginning, if you have an always-on internet connection,
it's a good idea to disconnect it.

1. Stop it from running

Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
Processes tab, click msblast.exe and then "End process." Reply
"Yes" to the warning message that comes up.

This stops the worm from running, so your system will not shut
down. However, it doesn't remove it, and if that's all you do, it
will start up again the next time you boot.

***

2. Remove it from your system

a. Start the registry editor program, regedit, by going to Start

Run, and typing REGEDIT

Navigate to HKEY_Local_Machine\Software\Microsoft\Windows\Current
Version\Run by clicking the plus signs next to each of the
folders in the left hand pane. When you get to the last of them,
Run, click the word Run itself.

Find an entry called "Windows Auto Update" on the right side.
Right-click it and delete it.

b. Do a Windows search for msblast, and delete all files found.

The worm is now gone, and won't start again the next time you
boot. But if that's all you do, you can get reinfected just as
you did the first time.

***

3. Make sure it doesn't come back

a. Make sure you're running a firewall that prevents worms like
this from getting in. You can enable the built-in Windows XP
firewall, or download and install another one such as the free
version of ZoneAlarm. To enable the built-in firewall, go to
Control Panel, double-click Networking and Internet Connections,
then click Network Connections. Right-click your connection, then
click Properties, and on the Advanced tab, click the option
"Protect my computer and network..."

b. If you've disconnected your internet connection, reconnect it.
Download and install the Microsoft patch at
http://download.microsoft.com/downl...e-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

That will remove the vulnerability that the worm exploits.

c. Be sure you are running an anti-virus program, and that you
regularly download the latest updated virus definitions.
--
HTH...Please post back to this thread

~Robear Dyer (aka PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Protect Your PC
http://www.microsoft.com/security/protect/default.asp

 

[Bruce F. Leavitt]

hi
His doesn't have anything that shows the blaster
Though on microsofts site it has,

http://support.microsoft.com/default.aspx?scid=kb;en-us;821690&Product=winxp

The error he gives at the bottom is something like this, docme-robert 1temp
wer 9a-tma.dir00 sphost.exe

This isn't exact as I am not on his computer to see it

 

[Bruce F. Leavitt]

Almost forgot,
the computer doesn't shut down, he just has to close out of Internet
explorer

 

[Bruce F. Leavitt]

Disregard the last message, misunderstood him. Computer does shut down after
the error message, but gives him time to save any information
Tried both the msblaster removal tool, and also the qhost.
nothing with either of them found on the computer

 

[PA Bear]

Did you/he (1) enable a firewall (WinXP's or a third-party application), (2)
install updates identified by Windows Update
(http://windowsupdate.microsoft.com), and (3) update virus definitions
followed by a full system scan? All of these should have been done "right
out of the box", before using the new machine to do *anything* else.

More:

Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?kbid=826955

Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
http://securityresponse.symantec.com/avcenter/security/Content/8205.htm

If you machine keeps rebooting:

Start>Run> (type in) services.msc > scroll down to Remove Procedure Call
(RPC)>Recovery>First Failure>(choose) Restart the Service.

You need to install...

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

....but you must first remove the Worm. Here are several related pages which
can help:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://forum.mvps.org/viewtopic.php?t=2703
http://www.bigblackglasses.com/Article.aspx?Article=342
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also need to check the system for hijackware:

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. HijackThis (http://www.merijn.org/files/hijackthis.zip; [new
URL] ) is the preferred tool to use these days. It will help to both
identify and remove any hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/, not here.**[/QUOTE]

 

[Bruce F. Leavitt]

The first thing he tried doing was to go to the updates page,

823980 was installed removal tool twice, and ran it in safe mode just in
case.
In all cases the removal tool says there is no instance of the blaster
virus..

I ran the blaster

Did you/he (1) enable a firewall (WinXP's or a third-party application), (2)
install updates identified by Windows Update
(http://windowsupdate.microsoft.com), and (3) update virus definitions
followed by a full system scan? All of these should have been done "right
out of the box", before using the new machine to do *anything* else.

More:

Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?kbid=826955

Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
http://securityresponse.symantec.com/avcenter/security/Content/8205.htm

If you machine keeps rebooting:

Start>Run> (type in) services.msc > scroll down to Remove Procedure Call
(RPC)>Recovery>First Failure>(choose) Restart the Service.

You need to install...

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

...but you must first remove the Worm. Here are several related pages which
can help:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://forum.mvps.org/viewtopic.php?t=2703
http://www.bigblackglasses.com/Article.aspx?Article=342
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also need to check the system for hijackware:

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. HijackThis (http://www.merijn.org/files/hijackthis.zip; [new
URL] ) is the preferred tool to use these days. It will help to both
identify and remove any hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/, not here.**

 

[Bruce F. Leavitt]

Still no luck any suggestions, shows no virus, but the computer closes when
online, but gives you time to bakc up info so it says

Did you/he (1) enable a firewall (WinXP's or a third-party application), (2)
install updates identified by Windows Update
(http://windowsupdate.microsoft.com), and (3) update virus definitions
followed by a full system scan? All of these should have been done "right
out of the box", before using the new machine to do *anything* else.

More:

Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?kbid=826955

Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
http://securityresponse.symantec.com/avcenter/security/Content/8205.htm

If you machine keeps rebooting:

Start>Run> (type in) services.msc > scroll down to Remove Procedure Call
(RPC)>Recovery>First Failure>(choose) Restart the Service.

You need to install...

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

...but you must first remove the Worm. Here are several related pages which
can help:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://forum.mvps.org/viewtopic.php?t=2703
http://www.bigblackglasses.com/Article.aspx?Article=342
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also need to check the system for hijackware:

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. HijackThis (http://www.merijn.org/files/hijackthis.zip; [new
URL] ) is the preferred tool to use these days. It will help to both
identify and remove any hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/, not here.**

 

[H Leboeuf]

Internet Explorer Quits When You Visit a Web Page That Uses an XSL Transform
and Window.name Property [ 811812 ]
Internet Explorer Quits When You Visit a Web Page. ( i. e. 6. )

If the computer closes then it may be hardware problem.
Could be caused by heat. Clean the fan in the back of your computer box and
make sure that the small fan for the CPU is OK.

Still no luck any suggestions, shows no virus, but the computer closes when
online, but gives you time to bakc up info so it says

Did you/he (1) enable a firewall (WinXP's or a third-party application), (2)
install updates identified by Windows Update
(http://windowsupdate.microsoft.com), and (3) update virus definitions
followed by a full system scan? All of these should have been done "right
out of the box", before using the new machine to do *anything* else.

More:

Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?kbid=826955

Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
http://securityresponse.symantec.com/avcenter/security/Content/8205.htm

If you machine keeps rebooting:

Start>Run> (type in) services.msc > scroll down to Remove Procedure Call
(RPC)>Recovery>First Failure>(choose) Restart the Service.

You need to install...

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

...but you must first remove the Worm. Here are several related pages which
can help:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://forum.mvps.org/viewtopic.php?t=2703
http://www.bigblackglasses.com/Article.aspx?Article=342

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also need to check the system for hijackware:

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. HijackThis (http://www.merijn.org/files/hijackthis.zip; [new
URL] ) is the preferred tool to use these days. It will help to both
identify and remove any hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/, not here.**
--
~PA Bear

Disregard the last message, misunderstood him. Computer does shut down
after
the error message, but gives him time to save any information
Tried both the msblaster removal tool, and also the qhost.
nothing with either of them found on the computer

Courtesy of MVP Ken Blake:

MSBlaster worm. To remove it, do the following:

The following instructions are in three parts

1. Stop it from running

2. Remove it from your system

3. Make sure it doesn't come back

Before beginning, if you have an always-on internet connection,
it's a good idea to disconnect it.

1. Stop it from running

Press Ctrl-Alt-Delete to bring up the Task Manager, then on the
Processes tab, click msblast.exe and then "End process." Reply
"Yes" to the warning message that comes up.

This stops the worm from running, so your system will not shut
down. However, it doesn't remove it, and if that's all you do, it
will start up again the next time you boot.

***

2. Remove it from your system

a. Start the registry editor program, regedit, by going to Start
Run, and typing REGEDIT
Navigate to HKEY_Local_Machine\Software\Microsoft\Windows\Current
Version\Run by clicking the plus signs next to each of the
folders in the left hand pane. When you get to the last of them,
Run, click the word Run itself.

Find an entry called "Windows Auto Update" on the right side.
Right-click it and delete it.

b. Do a Windows search for msblast, and delete all files found.

The worm is now gone, and won't start again the next time you
boot. But if that's all you do, you can get reinfected just as
you did the first time.

***

3. Make sure it doesn't come back

a. Make sure you're running a firewall that prevents worms like
this from getting in. You can enable the built-in Windows XP
firewall, or download and install another one such as the free
version of ZoneAlarm. To enable the built-in firewall, go to
Control Panel, double-click Networking and Internet Connections,
then click Network Connections. Right-click your connection, then
click Properties, and on the Advanced tab, click the option
"Protect my computer and network..."

b. If you've disconnected your internet connection, reconnect it.
Download and install the Microsoft patch at

http://download.microsoft.com/downl...e-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe

 

[Elizabeth Chubbuck [MSFT]]

You can run in the command window (in the run line type "shutdown /a" and it should abort your shut down if there is no MSBLAST.exe to end task on), so at least you can stay online and further investigate this issue, as it did sound like the worm virus, and seems this should have stopped the issue. If this has been like this since day one, I would seriously consider returning this machine. but get all patches and necessary spyware, hijackware on a disc to install before you ever bring a replacement system online.

--
Elizabeth Chubbuck [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

"Bruce F. Leavitt" <brucefl56 at hotmail.com> wrote in message Still no luck any suggestions, shows no virus, but the computer closes when
online, but gives you time to bakc up info so it says

Did you/he (1) enable a firewall (WinXP's or a third-party application), (2)
install updates identified by Windows Update
(http://windowsupdate.microsoft.com), and (3) update virus definitions
followed by a full system scan? All of these should have been done "right
out of the box", before using the new machine to do *anything* else.

More:

Virus Alert About the W32.Blaster.Worm
http://support.microsoft.com/?kbid=826955

Microsoft Windows DCOM RPC Interface Buffer Overrun Vulnerability
http://securityresponse.symantec.com/avcenter/security/Content/8205.htm

If you machine keeps rebooting:

Start>Run> (type in) services.msc > scroll down to Remove Procedure Call
(RPC)>Recovery>First Failure>(choose) Restart the Service.

You need to install...

MS03-026: Buffer Overrun in RPC Interface May Allow Code Execution
http://support.microsoft.com/?kbid=823980

...but you must first remove the Worm. Here are several related pages which
can help:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc
http://forum.mvps.org/viewtopic.php?t=2703
http://www.bigblackglasses.com/Article.aspx?Article=342
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also need to check the system for hijackware:

Dealing with Hijackware
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/inetexplorer/Darnit.htm#tshoot
http://aumha.org/a/parasite.htm

You *must* seek updates for Ad-Aware, Spybot, etc., before each and every
use, even "right out of the box". But even then, they can't catch
everything. HijackThis (http://www.merijn.org/files/hijackthis.zip; [new
URL] ) is the preferred tool to use these days. It will help to both
identify and remove any hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/, not here.**