help needed for error message

[Jon Paal [MSMD]]

I keep getting this error message on boot up. I removed all apps from startup but I can't locate the source of this error.
Does anybody recognize this message?

===========================================
Generic host process for win32 Services has encountered a problem and needs to close.

Error signature
szAppname: svchost.exe szAppver 5.1.2600.2180 szModname : unknown szModVer 0.0.0.0 offset: 00000000

the following files will be included in this error report
C:\DOCUME~1\...\LOCALS~1\Temp\WERfc9a.dir00\svchost.exe.mdmp
C:\DOCUME~1\...\LOCALS~1\Temp\WERfc9a.dir00\appcompat.txt
====================================================================

 

[PA Bear [MS MVP]]

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting the requested logs
in an appropriate forum.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

 

[Randem]

More possible help http://www.randem.com/virusproblems.html

You seem to have malware or remnants thereof that need to be removed from
your system.

--
Randem Systems
Your Installation Specialist
The Top Inno Setup Script Generator
http://www.randem.com/innoscript.html
Disk Read Error Press Ctl+Alt+Del to Restart
http://www.randem.com/discus/messages/9402/9406.html?1236319938

 

[Gerry]

Jon Paal

Malware piggy backing on svchost.exe.

Does the problem occur in Safe Mode?

I suggest you download and run Spybot S & D (freeware version). There
is a freeware version buried in this link:
http://www.safer-networking.org/en/spybotsd/index.html

Malwarebytes' Anti-Malware
1.32 -freeware (if you upgrade you pay).
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Run Malwarebytes' in safe mode and turn off your current anti-virus
before you do to avoid a conflict. Disregard the invitation on the web
site regarding the Registry Optimiser -a Registry Optimiser is not a
helpful utility.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[smlunatick]

I keep getting this error message on boot up.  I removed all apps from startup but I can't locate the source of this error.
Does anybody recognize this message?

===========================================
Generic host process for win32 Services has encountered a problem and needs to close.

Error signature
szAppname: svchost.exe szAppver 5.1.2600.2180 szModname : unknown szModVer 0.0.0.0 offset: 00000000

the following files will be included in this error report
C:\DOCUME~1\...\LOCALS~1\Temp\WERfc9a.dir00\svchost.exe.mdmp
C:\DOCUME~1\...\LOCALS~1\Temp\WERfc9a.dir00\appcompat.txt
====================================================================

I am not sure what can cause this but it seems that I am getting a
similar problem. I am getting svchost "pop-ups" as:

The instruction at "0x00000000" referenced memory at "0x00000000". The
memory could not be "written".

After several anti-virus / anti-spyware checks, my system is "clean."
I then did a complete uninstall of Norton Internet Security (NIS)
2009, followed by running Norton Removal Tool. I spent the better
part of the week-end looking for a solution and did several tests. I
am no lead to believe that something had damaged my WMI repository. I
then followed directions to rebuild this folder and I am just
monitoring now.

 

[Jon Paal [MSMD]]

thanks,

I had already run my virus checks with Spybot, hijackThis and Spyblaster.

Nothing was found. I believe this is a windows problem based upon this info:

http://www.microsoft.com/downloads/...FamilyID=A87B44B9-7A6A-49B6-BD89-AFAD4E049C48

Although, I already had the patches installed, I still got the error message.

From safe mode, I disabled all startup programs and restored several times. I got booted up without the annoying error message
which finally left me in a running state. I don't think this is resolved yet but I'm now able to pursue the problem.

I believe it had/has something to do with Task Manager......

 

[PA Bear [MS MVP]]

And you're replying to...?

I can assure you that KB894391 has nothing to do with that error and that
scanning with Spybot will not detect or remove all hijackware.

HijackThis doesn't remove anything on its own nor does it give one a full
picture of what hijackware might be on the system.

SpywareBlaster isn't a scanning utility.

 

[FredW]

Jon Paal

Malware piggy backing on svchost.exe.

Does the problem occur in Safe Mode?

Malwarebytes' Anti-Malware
1.32 -freeware (if you upgrade you pay).
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

Malwarebytes' Anti-Malware 1.36
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
MBAM is free for personal use.
Only if you want the full version (realtime protection) you have to pay.
http://www.malwarebytes.org/mbam.php

Run Malwarebytes' in safe mode and turn off your current anti-virus

There is no need to run MBAM in Safe Mode.
According to the development team, MBAM is developed to be run in Normal
Mode.

 

[Gerry]

Thanks Fred for the clarification/


--


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry]

Jon

I would still run malwarebytes. See the post by Fred W for an updated link.


--


Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Jon Paal [MSMD]]

ran malwarebytes , latest version / updates ,full depth scan....

nothing was found.

It's still my belief that it is windows.

 

[PA Bear [MS MVP]]

[Does MSMD = Monkey See Monkey Do, Massachusetts Society of Mayflower
Descendants, or Mike Shick Motorsports Designs?]