GENERIC HOST PROCESS FOR WIN 32 SERVICES

[FridaySe]

It's part of Norton Internet Security Professional 2004.

[Darkow Hotmale]

Deuce, I really can't thank you enough. I'll make the most progress I can with what you emailed and let you know in due course. I'll check out the suggested forums also.

FridaySe, thanks for the comeback. I'll probably pick that up when I'm back in the UK next month.

Cheers one and all.

[Bigshow]

A handy site for not so advanced pc users. most of the advice is explained in layman's terms. might be of help!

http://www.pchell.com

[Deuce Bigolo]

I think working out wether its an OS or Spyware Problem is Paramount
which is best done via hijack this,best illustrated at

link posted by Bigshow

cheers
B....OZ

[Lizard]

Your running xp right?, then go to start, help and support, then select, system restore, then restore your comp to a previous date before you had the problem, once the system has stabalised, turn off system restore after re-booting, this will stop re-infection, and wait for a couple of days before setting a NEW restore point, obviously set the new point with that days date!! the virus file will be overwritten, you can always check what programmes are running by selecting control/alt and del, this will bring up the task manager, just to be sure...there are no other things running..

Geeks-r-us.

[Darkow Hotmale]

Thanks to Deuce I was able to download Hijack This and CWShredder and the resulting Hijack Log is this:


Logfile of HijackThis v1.99.1
Scan saved at 1:36:07 AM, on 4/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\RavMonD.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe
C:\Program Files\Rising\Rav\RavTimer.exe
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\System32\TPWRTRAY.EXE
C:\WINDOWS\System32\TFNF5.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\msdirectx32.exe
C:\WINDOWS\System32\sounds.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\System32\sounds.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\PROGRA~1\Netscape\Netscape\Netscp.exe
C:\DOCUME~1\DAPOOD~1\LOCALS~1\Temp\Rar$EX07.942\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://url
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://url
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://69.50.184.51/find4u/sp.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Dapo Odesanya\Application Data\Mozilla\Profiles\default\0tp4o389.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5Cmozilla.org%5CMozilla%5Csearchplugins%5Cgoogle.src"); (C:\Documents and Settings\Dapo Odesanya\Application Data\Mozilla\Profiles\default\0tp4o389.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [PmProxy] C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files\Toshiba\ConfigFree\NDSTray.exe"
O4 - HKLM\..\Run: [Drag'n Drop CD+DVD] C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp
O4 - HKLM\..\Run: [ravtimer] C:\Program Files\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 28
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [QtRun] C:\Program Files\ietools\qtrun.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Windows Startup 32 Bits] sysrun32.exe
O4 - HKLM\..\Run: [Windows Media Player] 50cent.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitecln32.exe
O4 - HKLM\..\Run: [Windows Processe Manager] mspn32.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [msdirectx32] C:\WINDOWS\System32\msdirectx32.exe
O4 - HKLM\..\Run: [Spool Loader] spool.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MotherBoard Sounds] sounds.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\RunServices: [Windows Startup 32 Bits] sysrun32.exe
O4 - HKLM\..\RunServices: [Windows Media Player] 50cent.exe
O4 - HKLM\..\RunServices: [Windows Processe Manager] mspn32.exe
O4 - HKLM\..\RunServices: [Spool Loader] spool.exe
O4 - HKLM\..\RunServices: [MotherBoard Sounds] sounds.exe
O4 - HKCU\..\Run: [SCBPPUIEBO] C:\WINDOWS\DESSNSWEQ.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - HKCU\..\Run: [Windows Startup 32 Bits] sysrun32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Windows Media Player] 50cent.exe
O4 - HKCU\..\Run: [Windows Processe Manager] mspn32.exe
O4 - HKCU\..\Run: [msdirectx32] C:\WINDOWS\System32\msdirectx32.exe
O4 - HKCU\..\Run: [Spool Loader] spool.exe
O4 - HKCU\..\Run: [MotherBoard Sounds] sounds.exe
O4 - HKCU\..\RunServices: [Windows Processe Manager] mspn32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Web Search - c:\windows\ex.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1408.g.akamai.net/7/1408/9955/2 ... sSetup.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{7C425281-1954-4DD9-B685-41CF819E901A}: NameServer = 202.106.0.20
O20 - AppInit_DLLs: 3esc8embctm.dll
O21 - SSODL: systemie - {18BB6AD5-E665-4C3F-B132-BCA22B5A9707} - sysie.dll (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising Realtime Monitor Service (RsRavMon) - rising - C:\Program Files\Rising\Rav\RavMonD.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

What's this all mean, PLEASE! Am I as fucked as I despair I am?

Thanks for all your help. Thanks too Lizard.

Darkow

[Deuce Bigolo]

I don't pretend to understand what it all means but for those that want to theres a self-help tutorial available at

Personally I'd be posting to a spyware forum
for the volunteer experts to peruse

All set out here under "If your PC is infested w/Spware" number 5 hijack this

So i take it you've still got your problem then?

Even the people on these forums would suggest a system restore before playing around in the registry...much simpler & much safer

cheers
B....OZ

[Darkow Hotmale]

Hey, folks, just to say after I went through all the recommended scams and fixes, I'm pleased to advise that for the past 3 hours, I've had a clean session on the same LAN that probably fucked me up initially. No pop ups, no browser hijack and most importantly no GENERIC HOST PROCESS FOR WIN32 SERVICES shutdowns. I know it's far too early to celebrate, but after having had aborted 10-minute sessions every day for the past two weeks or so, it's a blessed relief to go through an error-free session, at least for now.

I don't want to sound pompous about this, but this whole issue of web-based guerilla warfare against unsepcting Internet users and the fucking incestuous relationships between hackers, hijackers, software vendors, etc etc, is making it increasingly frustrating and disspiriting to use the Net. Yeah, maybe there's no wisdom to visiting adult sites or downloading music/clips (actually, I haven't done either out here cos you never know who is snooping on you here in the Far East and you could get locked up for messing around too long on certain types of web-based porn).

But whatever it is, why does one have to spend 24 hours, and counting, looking for help to solve problems that threaten to wreck your investment in laptops . Most would probably say "Ah, diddums....", but now that I've experienced all I've gone through in the past fortnight or so, I really feel so strongly about this.

Having vented, here's to say thanks to everyone who took the trouble to offer advice on this mess.

Darkow

[Deuce Bigolo]

Theres no doubt that the computer industry thrives on selling computers to novices without telling them squat for the simple reason they're playing both sides of the fence.Can't sell spyware removal/prevention programs if the computers security is already set to stop it from getting in

I discovered adaware in a Computer Mag,posted its existence on the forum 3/4 years ago and I couldn't believe how many of the forumites were dumb founded by what they found on their computers

To say its a Conspiracy would be an understatment

Logic would say your best bet for security is anything but a Windows based system.As this guy says,Microsoft haven't produced anything after Windows 98 2nd edition that is worth paying for.Even my Techy friends that work in the IT industry use either Windows 95 or 98.Each subsequent version is always littered with flaws but always sold as being more stable & secure...pure farce

If you are going to stick with Windows just think "prevention is better than removal" then head to this page,a must see for any windows user but especially windows XP users(includes a program to disable the MESSENGER)

This security page is just as relevant today as its ever been 4 or 8 steps as to how to secure your computer.In depth but if you want piece of mind

Other useful sites





I only know of one porn site that claims to be spyware/malware free
not always but almost,an dno jail term at the end of it

cheers
B....OZ