Downloading updates in advance

[Guest]

ok, to prove my point i did another install

i changed my ip a few times and then released it
i disconnected the internet cable
i formatted my drive twice (normal & fast)
installed winxp-home (original cd-rom)
installed msi-mainboard (original cd-rom)
(rebooted when nessecairy)

when i inserted the internet cable to activate winxp:
- immediatly i have a constant up-& downstream
- after a minute or so i get following pop-up messages:

Messenger-Service
Message from MICROSOFT to USER
Critical Error
The Microsoft Windows system contains invalid registry entries and your
computer will crash. Please download the Windows registry application from:
www.fixed-pc.com
To fix your system immediatly

<<a few seconds later>>

Messenger-Service
Message from Microsoft to inform you about a virus detection.
Critical System Error ! The Windows registry appears to be infected.
Please go to the Universal Registry Infection Cleaner at
www.cleanmyharddrive.com to scan and repair the system registry.

<< every now and then i get diverse popups like this>>
i did not install the 35,3Mb NIS, so that's not it
i only installed the original winxp & msi mainboard
no other hd's are connected
i did not load any files except the 2 i mentioned above (winxp & msi)
those 2 are on original cd-roms so they can't be infected

now there's no point updating winxp or msi
installing NIS & updating also makes no difference

At this time my winxp-key is blocked by MS because i have reinstalled so
much, i have to phone them every time to get a new key which contains numbers
only.
The dude on the other side advised me to phone the technical staff instead
of reinstalling all the time... because i live from my invalid-payment i do
not have the money to do so, although i found that such assistance should be
free of charge.
Luckely there a free forums like this.
I hope you guys can help me out with this problem.

thnx in advance
omi

 

[Juan]

No doubt there is an infection feeding of the Generic Host Process so you
need to find which service(s) is or are infected and causing the problem...
the firewall service and probably the messenger service seem to be affected
but any service(s) running in Svchost.exe is/are likely to be infected...
follow the steps described in the Q314056 Microsoft article to see which
services you have to disable. you should also install another firewall at
least
temporarily to stop the pop-ups because it seems the NIS firewall is not
doing the job.

Quote from:
www.experts-exchange.com
My advice is block the GHP service.
GHP (aka svchost.exe) is a 'carrier' or 'piggy back' service that connects
to the internet on behalf of other services/apps, the problem is you have to
figure out what is REALLY connecting to the net, it could be legitamate or
it could be, well, anything.
http://www.experts-exchange.com/Security/Win_Security/Q_20724417.html

List of services in Windows XP and description of Svchost.exe
http://www.theeldergeek.com/services_guide.htm

Quote from Microsoft Q314056
To view the list of services that are running in Svchost: 1. Click Start on
the Windows taskbar, and then click Run.
2. In the Open box, type CMD, and then press ENTER.
3. Type Tasklist /SVC, and then press ENTER.
Tasklist displays a list of active processes. The /SVC switch shows the list
of active services in each process. For more information about a process,
type the following command, and then press ENTER:
Tasklist /FI "PID eq processID" (with the quotation marks) ---------
A description of Svchost.exe in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314056

(seems x-cleaner did the job for Rob webster)
Quote from www.huguesjonson.com
"From: Rob Webster" "I tried a new anti virus software. It found trojans
but didn't cure the svchost problem. ad aware, spybot and no adware. these
removed some spyware but didn't solve my prolem i then found x-clean on a
magazine disk. it found and removed a "messenger service" running which
wasn't "microsoft messenger"
http://www.huguesjohnson.com/svchost.html

Antispyware download page.
http://www.majorgeeks.com/downloads31.html

--------------------------------

 

[Steven L Umbach]

Thanks for the detailed explanation. Did you enable the firewall in XP
before you connected to the internet? It is enabled by default in SP2 but
not in earlier versions and you should verify that it is in the
properties/advanced for your network adapter. I would recommend that you
download SP2, burn it to a cdrom and install it before connecting to the
internet after a fresh install and then go to Windows Updates. The messenger
service messages you receive indicate that you do not have a firewall
protecting your computer and those messages are adware messages which are
trying to trick you into buying or downloading their product that probably
has more spyware. Those messages do NOT mean that there is necessarily
anything wrong with your computer or indicate a hack or malware infection.
If you make sure that you have the XP firewall enabled and disable the
messenger service [done by default in SP2] I would be extremely surprised if
you still get those messages. You can use services.msc to open your services
and find the messenger service and set it to disabled and make sure it is
not started. You can simply select stop to stop the service after you set
the startup type to disabled for it. I bet it is frustrating reactivating
all the time. You can go to the link at http://scan.sygatetech.com/ to check
your firewall configuration. --- Steve