[komodo24]

I was just wondering why this keeps happening to me. Once I'm on the net for a while and my computer is idle I get a message that says a prg needs to close becuase it encountered a problem. I'm running windows xp I have a dell dimension P4. The message I get is "Generic host process for Win32 services" needs to close. This has been happening for bout three days. After that happens my computer still functions but I'm online meaning I'm connected but when i try to go to any website it says page not avail. and also my msn shuts down.. I did a virus scan using Avast cause that is what i have right now and it says everything is fine. So what I wanna know is why this is happening and what can I do to fix it? I'm not sure if it happens always at the same time or not... After i restart my computer is is ok. The net works and msn works until that specific process needs to end. any suggestions would be helpfull. Thanks in advance...

[telecom69]

Ive done a bit of research on this and havent found an answer yet,the general opinion seems to think you might have a virus/trojan/worm call it what you will, so go here http://www.majorgeeks.com/download3155.html and its important you download this to its own folder,then post a log back here for analysis .....

Just wondering do you have all your Windows updates installed up to date?

[komodo24]

I will download that and post back here when I'm done. I am updated but I didn't install XP SP2 or whatever you call it becuase i did have it on my computer before and problems came up from using that update.Thanks

[komodo24]

I ran a scan using the link above with the hijackthis program and 20 items were listed. However I'm not sure what to do with the items it found.....
This is what it found. Sorry for the long post

Logfile of HijackThis v1.98.2
Scan saved at 12:21:22 PM, on 10/28/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vlpuptfwgtpveihgymmmkyjlo...atYNEwNa3.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7EA2910F-7CBB-9772-A0B6-CA9D9F9261E5} - C:\DOCUME~1\Sam\APPLIC~1\AUDIOT~1\frag seek.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [ChicBikeBalmTitle] C:\Documents and Settings\All Users\Application Data\link mp3 chic bike\Meow dupe.exe
O4 - HKCU\..\Run: [Love Defy] C:\DOCUME~1\Sam\APPLIC~1\GREYPU~1\FileMeet.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{3540AE63-C12C-4047-BC10-B4E64FB2E260}: NameServer = 206.47.244.43 206.47.244.89



Any suggestions would be helpful

[telecom69]

You did exactly right in the way you posted back,there is not much wrong in your log,just put a tick by each of the following and after closing all open windows have hijack FIX them

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vlpuptfwgtpveihgymmmkyjl...8atYNEwNa3.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

[Flrman1]

Fix these too:

O2 - BHO: (no name) - {7EA2910F-7CBB-9772-A0B6-CA9D9F9261E5} - C:\DOCUME~1\Sam\APPLIC~1\AUDIOT~1\frag seek.exe

O4 - HKLM\..\Run: [ChicBikeBalmTitle] C:\Documents and Settings\All Users\Application Data\link mp3 chic bike\Meow dupe.exe

O4 - HKCU\..\Run: [Love Defy] C:\DOCUME~1\Sam\APPLIC~1\GREYPU~1\FileMeet.exe

Restart to safe mode.

How to start your computer in safe mode

Because XP will not always show you hidden files and folders by default, Go to Start > Search and under "More advanced search options".
Make sure there is a check by "Search System Folders" and "Search hidden files and folders" and "Search system subfolders"

Next click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Now find and delete these folders:

C:\Documents and Settings\All Users\Application Data\link mp3 chic bike
C:\Documents and Settings\Sam\Application Data\AUDIOT~1
C:\Documents and Settings\Sam\Application Data\GREYPU~1

I don't know the exact names of those last two folders, but the first one will begin with AUDIOT and will contain the frag seek.exe file. The second will begin with GREYPU and will contain the FileMeet.exe file. These folders must be found and deleted.


FYI: You got this crap, which is LOP malware, from Messenger Plus. I would personally recommend that you uninstall it. It is my opinion that any app that sees fit to bundle that kind of scumware with their software should be boycotted. See here for more info.

[komodo24]

Just wanted to say thanks to everyone who helped me the problem seems to be fixed.... Thanks!!!

[Flrman1]

Glad we could help!