Generic Host Process for Win32 Services encountered a problem and needed to close.

I was doing a search on "appcompat.txt" to see if I could find anyone that had encountered a problem that I am getting periodically. In the Spyware Specific forum thread titled "trouble removing agobot/gaobot worm" user - "elemenoh" exactly described my problem in entry #40.

For some reason, I wasn't able to post to that thread, so I did the only thing I could figure to do by copying the relevant parts of that thread and hope that would be okay.

Now, I do not have an 'agobot/gaobot worm' problem, just periodically getting exactly what elemenoh described in entry #40. As he stated in entry #15, the paths changes. As he states in entry #11, I am not able to find and manualy delete the files. My last path contained WER646c were he indicated WERc3ec and WER8e81 in entry #15 (of course, where his paths contain sims, mine contain Wayne).

If I am correct and understand the last entry by CHASLANG, "These files are created by Windows. You do not need to worry about them. They are not malware related."

Okay, finally my question, although I don't get this problem very much (since the first of June it has occured on 6/7, 6/10, 6/22, 6/24 6/28 and today 7/11) should I just ignore it when it ocurrs or is there something I can do to avoid getting the problem?

I have recently uninstalled Norton SystemWorks 2005 Premier and installed AVAST! (7/2-7/3), my firewall is ZoneAlarm, I have Spybot S&D, Ad-Aware, CounterSpy and SpyBlaster installed. I have CCleaner - last ran it 7/9. My system is Windows XP-SP2 (BTW, this problem never occured before I upgraded to SP2 in mid-February) and at the end of June I preformed all of the items in the "DO NOT POST" sticky on Spyware, Trojan and Virus Removal with no problems found.

Again, sorry for the long question (setup and copying) but I couldn't figure out a better way.

WAYNE

END OF MY POST -- COPIED THREAD FOLLOWS.

chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Quote:
Originally Posted by elemenoh
The other user accounts are there because my family shares the computer when I'm home. I'm currently at school, though, so they've been unused for the last 4 months, approximately. They are password protected.

The full pathname was:

C:\Documents and Settings\Kathleen\WER2.temp.dir00\appcompat.txt

I've gone through and run all the clean-up programs in each username. The only programs I've installed recently are the ones recommended here in the course of fixing the virus. Could one of these be causing trouble?



There should be no problems with any of the items you downloaded. These files are created by Windows. You do not need to worry about them. They are not malware related.

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List


#20 05-13-05, 17:59
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

The other user accounts are there because my family shares the computer when I'm home. I'm currently at school, though, so they've been unused for the last 4 months, approximately. They are password protected.

The full pathname was:

C:\Documents and Settings\Kathleen\WER2.temp.dir00\appcompat.txt

I've gone through and run all the clean-up programs in each username. The only programs I've installed recently are the ones recommended here in the course of fixing the virus. Could one of these be causing trouble?

elemenoh
View Public Profile
Challenge elemenoh in the Arcade
Find all posts by elemenoh
Add elemenoh to Your Buddy List

#19 05-13-05, 13:36
chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Quote:
Originally Posted by elemenoh
I searched for appcompat.txt, and the only file that showed up was under a different user-name. (One that hasn't been used in quite some time, though the file was last modified May 4, 2005.)

I don't usually play games, though I played Zuma (from this site) recently. I don't use any P2P software. I'm the only active user on the computer, as well.

I've run CCleaner under my username - is there a way to get it to clean all usernames, or do I need to do it under each individually?



It you are the only user, what are the other user accounts for? Are they all password protected?

You need to run CCleaner (and all cleanup procedures for that matter) under all user accounts.

Where was the file that you attached located? The full path. Still looks like software compatiblility issue.

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List

#18 05-13-05, 06:52
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

I searched for appcompat.txt, and the only file that showed up was under a different user-name. (One that hasn't been used in quite some time, though the file was last modified May 4, 2005.)

I don't usually play games, though I played Zuma (from this site) recently. I don't use any P2P software. I'm the only active user on the computer, as well.

I've run CCleaner under my username - is there a way to get it to clean all usernames, or do I need to do it under each individually?
Attached Files appcompat.txt (4.1 KB, 4 views)


elemenoh
View Public Profile
Challenge elemenoh in the Arcade
Find all posts by elemenoh
Add elemenoh to Your Buddy List

#17 05-13-05, 01:01
chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Quote:
Originally Posted by elemenoh
I downloaded ZoneAlarm, and have had no more virus problems - thank you so much for all your help with that.

I am still occasionally getting the error message I mentioned previously. The same files are reported, but with different paths each time. It's happened twice since I last posted, and the files were:

C:\DOCUME~1\sims\LOCALS~1\Temp\WERc3ec.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WERc3ec.dir00\appcompat.txt

and:

C:\DOCUME~1\sims\LOCALS~1\Temp\WER8e81.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WER8e81.dir00\appcompat.txt

Any idea what this is?



Please post as an attachment the appcompat.txt file. You may be having a software compatibility problem. The file may be too large to post and you may need to compress it with WinZip or similar before posting.

If you run CCleaned, it should be delete all files in that Temp folder.
Are you playing any games? If so, which ones? Do you play online?

Are you using any P2P downloading software (like Kazaa, Morpheus, Limewire, Imesh, etc)?

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List

#16 05-12-05, 17:14
chuddds
Private First Class Join Date: May 2005
Posts: 33

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

you are still are infected. at symantecs site do a search on: WERc3ec

and any other file you have issues with.

also, do a scan in DOS with F-Prot, google it.

chuddds
View Public Profile
Challenge chuddds in the Arcade
Find all posts by chuddds
Add chuddds to Your Buddy List

#15 05-12-05, 17:09
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

I downloaded ZoneAlarm, and have had no more virus problems - thank you so much for all your help with that.

I am still occasionally getting the error message I mentioned previously. The same files are reported, but with different paths each time. It's happened twice since I last posted, and the files were:

C:\DOCUME~1\sims\LOCALS~1\Temp\WERc3ec.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WERc3ec.dir00\appcompat.txt

and:

C:\DOCUME~1\sims\LOCALS~1\Temp\WER8e81.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WER8e81.dir00\appcompat.txt

Any idea what this is?

elemenoh
View Public Profile
Challenge elemenoh in the Arcade
Find all posts by elemenoh
Add elemenoh to Your Buddy List

#14 05-05-05, 00:11
chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Perhaps Norton is removing them and that is why PocketKillbox cannot find them. You need to get a real firewall installed and then disable the one in Win XP SP2 as it just is not good enough. Please see the link below (which includes a couple free ones). You should complete all those steps anyway. Make sure if it ever comes up on the firewall that you disable nvc32.exe from having any access in or out of your PC. There could be another file on your PC that is reloading this.

If it does come back and you can actually see it, right click on it and select Properties and then the Version tab (if it has one) then scroll thru the Item name list so we can see who it belongs to.

How to Protect yourself from malware!

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List

#13 05-04-05, 19:13
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

That was all I got from Spy Sweeper, unless I took the info from the wrong place - I copied out what was in the window in the lower part of the screen.

I had trouble with Pocket KillBox. It wouldn't paste the filenames correctly, so I tried to do them individually, but each time I got an error saying the files don't exist. Searching manually, I couldn't find them either. The Norton warnings are still coming, however, in fits and spurts - I'll get a couple hundred warnings over a few minutes, and then everything will be quiet for a few hours. Maybe what's happening is that Norton is actually doing a good job getting rid of the files when they show up, but somehow I'm periodically getting reinfected?

The computer is running fine, other than the alerts - if it weren't for the Norton pop-ups, I wouldn't suspect anything was wrong.

elemenoh
View Public Profile
Challenge elemenoh in the Arcade
Find all posts by elemenoh
Add elemenoh to Your Buddy List

#12 05-04-05, 18:41
chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Was that all that Spy Sweeper found and reported? Usually there is significantly more info than that.

That nvc32.exe may be part of Norman Antivirus Control.

Now download: Pocket KillBox

And extract it to its own folder.
Double-click killbox.exe on your desktop. Select the option "Delete on reboot".
Now highlight and 'copy' the entire list of filepaths below:

C:\nvc32.exe
C:\Documents and Settings\All Users\Documents\nvc32.exe

Open 'file' in the killbox menu at the top and choose 'Paste from clipboard'

Now you will see, this is pasted in the "Full Path of File to Delete"-field.
There's a little arrow (dropdown-arrow) next to that field.
If you expand it, these lines should be there together!

Then press the red button with a white X in it.
Killbox will tell you that all listed files will be deleted on next reboot.
Click YES

When it asks if you would like to Reboot now, click YES
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

Now after reboot check to see if those files are gone. How are things running.

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List

#11 05-04-05, 08:20
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

I wasn't able to find the WER7b22.dir00 folder at all manually, and when I ran CCleaner, those files were not on the list of deleted items. (Yesterday's error message didn't appear today.)

C:\nvc32.exe is still there, and C:\Documents and Settings\All Users\Documents\nvc32.exe and all the entries in the C:\WINDOWS\system32\spool\PRINTERS folder have reappeared in the last few hours.

I installed, updated and ran Spy Sweeper (in normal mode because it wasn't specified - is that alright?), log is attached.
Attached Files spy sweeper.txt (120 Bytes, 2 views)
hijackthis 532005.log (7.1 KB, 4 views)


elemenoh
View Public Profile
Challenge elemenoh in the Arcade
Find all posts by elemenoh
Add elemenoh to Your Buddy List

#10 05-03-05, 19:44
chaslang
Anti-Spyware-Man Join Date: Feb 2004
Location: Northern New Jersey USA
Posts: 15,566

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

Run Ccleaner or manually delete those files:
C:\DOCUME~1\sims\LOCALS~1\Temp\WER7b22.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WER7b22.dir00\appcompat.txt

In fact you should be able to delete thw whole WER7b22.dir00 folder.

Is that c:\nvc32.exe file still on your PC?

Please download, install, and update: Spy Sweeper
Then run a full scan with Spy Sweeper and fix what it finds. Post the log from Spy Sweeper as an attachment.

Now post a new HJT log too. Tell me what problems you may still be having.

chaslang
View Public Profile
Challenge chaslang in the Arcade
Send a private message to chaslang
Find all posts by chaslang
Add chaslang to Your Buddy List

#9 05-03-05, 04:23
elemenoh
Private E-2 Join Date: Apr 2005
Posts: 14

Re: trouble removing agobot/gaobot worm

--------------------------------------------------------------------------------

System restore is off, and I uninstalled AVG.

This morning I started getting this error when I start the computer:


Quote:
Generic Host Process for Win32 Services encountered a problem and needed to close.

Error signature:
szAppName : svchost.exe szAppVer : 0.0.0.0 szModName : unknown
szModVer : 0.0.0.0 offset : 00000000

Files included in the error report:
C:\DOCUME~1\sims\LOCALS~1\Temp\WER7b22.dir00\svchost.exe.mdmp
C:\DOCUME~1\sims\LOCALS~1\Temp\WER7b22.dir00\appcompat.txt

 

Since earlier when I first posted my question, I had to perform a restart and again got the error message I mentioned previously. The same files are reported, but with different paths.

This time the files were:
C:\DOCUME~1\Wayne\LOCALS~1\Temp\WER6a61.dir00\svchost.exe.mdmp
C:\DOCUME~1\Wayne\LOCALS~1\Temp\WER6a61.dir00\appcompat.txt

Earlier they were:
C:\DOCUME~1\Wayne\LOCALS~1\Temp\WER646c.dir00\svchost.exe.mdmp
C:\DOCUME~1\Wayne\LOCALS~1\Temp\WER646c.dir00\appcompat.txt

So I ran CCleaner which had a lot of C:\DOCUME~1\Wayne\LOCALS~1\Temp\ files but none of the ones mentioned above. I performed a restart and didn't get the problem. I don't know if CCleaner helped but I am sure the problem will occur again since I have run CCleaner multiple times in the last month and half and have since eventually seen the error again.

So, if anyone can tell me what is causing this and how to eliminate it, I would appreciate it.

Thanks

 

Re: Generic Host Process for Win32 Services encountered a problem and needed to close

As chaslang has stated this is most likely a driver problem. Make sure you have the lastest drivers for all your system hardware, including the motherboard.

 

Shadow,
How/where do I check to see if I need to update any of my drivers? What other hardware drivers might I have on my PC? (I am very much a novice in this area.) That does seem a logical cause of this problem since it started after I upgraded to to SP2. I did obtain and install new software for my HP printer/scanner/fax after the SP2 upgrade.

Thanks to chaslang for the advice on posting... I knew I was creating a very unwieldy question but at the time I couldn't figure out a better way... it didn't occur to me to just post the link. Also, I posted to the Spyware forum because that was where I found the thread which exactly described my problem... again thanks for getting me to the right forum.

Wayne

 

Re: Generic Host Process for Win32 Services encountered a problem and needed to close

Install and run this program:

EVEREST Home Edition

When you run the program do the following:

Click-on Report in the File Menu

Select Report Wizard

Click-on Next

Click-on System Summary Only

Click-on Next

Click-on Plain Text

Click-on Finish

Click-on Save To File

Browse to My Documents

Accept the default file name, close the report wizard and everest.

Post the report as an attachment in your reply. It will help me to figure out which drivers you may need for you computer.

 

Downloaded/Installed/Run Everest and attached the requested file.

Thanks for your time.
Wayne

 

Re: Generic Host Process for Win32 Services encountered a problem and needed to close

Video Drivers NVIDIA GeForce4 MX 420
Display DRivers Dell E171FPb
Audio Drivers Creative SB Live!
Chipset Drivers Intel Tehama i850(E)
DVD-ROM Drivers LITEON DVD-ROM LTD163
CD-ROM Drivers SAMSUNG CD-R/RW SW-240B
Modem Drivers BCM V.92 56K Voicemodem
NIC Drivers Intel 82557/82558/82559 EtherExpress PRO/100B Adapter
Dell Patches And Fixes (Cross LOB)

 

Wow, I had no idea I could have been so out of date. Should I only install one of these at a time versus all at once... and should I install them in the order you have them listed or does it matter?

Wayne

 

Thanks D3m3nt3d, I am downloading now. I am amazed I didn't have more problems since I am so out out of date. I am guessing my upgrade from SP1 to SP2 caused a lot of this. I'll get everything installed that Shadow mentioned. Thanks again Shadow.

 

Re: Generic Host Process for Win32 Services encountered a problem and needed to close

Too bad Microsoft didn't warn everyone that updates like this would possibly have to be made... I may have missed it but I researched everything I could before upgrading to SP2 and saw nothing. But, in retrospect, it makes sense that upgrades would be needed. I only wish that novices like me knew what to look for and where to go for the updates -- I would have been totally lost without Shadow's research and directions.

 

Re: Generic Host Process for Win32 Services encountered a problem and needed to close

Do the Video and Chipset drivers first, then load the Dell patches. The others may not be necessary unless you are having problems with that hardware also.

Your Video and Chipset drivers are the most likely culprits of your problem

 

http://www.microsoft.com/downloads/...b9-7a6a-49b6-bd89-afad4e049c48&displaylang=en

 

Checked into your post and discovered that I did install MS05-012 in KB873333. So I figured it would be a good idea to get my Windows maint up to date - last upgraded 5/17. Went to http://v5.windowsupdate.microsoft.com/v5consumer/default.aspx?ln=en-us like I always do and clicked EXPRESS and it tried to download and install Microsoft Windows Installer 3.1. I attempted this multiple times each time an error 0x80246008 was returned.

After doing some research it appears that I need to start BITS. Performed the following steps:
START/Run/services.msc/

Right clicked on Background Intelligent Transfer Service
Clicked Properties
Clicked on Start (under Service Status) -- (previous Status was Stopped)

Received the following message: Windows could not start the Background Intelligent Transfer Service on Local Computer. For more information, review the System Event Log. I couldn't find the System Event Log. Can anyone help me get BITS started?

This must be something new because I have used the Windows Update website multiple times this year to download and install Windows Maint.

 

I found http://forums.majorgeeks.com/showthread.php?t=65573 which describes the problem I am having with Windows Update. I followed all the steps laid out by Shadow_Puter_Dude but I am still not able to start BITS -- I get the exact same message listed by bjgarrick in entry #7.

 

I switched my question about how to get BITS started over to http://forums.majorgeeks.com/showthread.php?t=65573 since that thread seemed to be a more appropriate place to deal with that problem.

Wayne