Re: Generic Host Process for Win 32

• Previous message: Ian Kenefick: "Re: Univers.exe and dingping.exe services won't stop"
• In reply to: garyghj2: "Generic Host Process for Win 32"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Sun, 07 Aug 2005 01:02:03 +0200

On Sat, 6 Aug 2005 11:29:06 -0700, "garyghj2"

>Recently I started getting the following message at start up ‘’ To help
>protect your computer, Windows has closed this programme, Generic Host
>Process for WIN 32 Service’’. Following this message a number of windows
>programmes stop working and access to ‘My Computer’ and ‘System’ takes about
>45 seconds.

>I have run AVG (up to date), but no viruses found.

>I use Power Quest Drive Image for regular backups. I restored a clean backup
>from one month before I started getting this message, but same error message
>appears at start up .

So it's something outside the file set, either hardware or something
that re-asserts itself from outside the backup you restored. Such as
a pure network attack through an unpatched code defect, exposed by the
absence of a firewall... what version XP? Pre-SP2?

>Reading help file, it would appear to be a memory problem so I replaced RAM

Testable hardware includes RAM and HD. Test both.
Untestable hardware includes SVGA, motherboard (check caps), PSU.

>Still same message ‘’ To help protect your computer, Windows has closed this
>programme, Generic Host Process for WIN 32 Service’’, so I replaced HDD and
>problem still persists.

I'm not seeing "...and on hardware diagnostics I found..."

>I recently reformatted HDD and reinstalled Windows XP Pro (with SP2) and
>installed all programmes from scratch. PC worked for one week and then same
>message appeared at start up again.

Does it start only after you reconnect to the 'net? SP2 should have
firewall on and ye olde RPC and LSASS defects patched, but what about
the hidden admin shares that "Pro" is cursed with? All that stands
between you and exploit is a password, if File and Print Sharing is
exposed. How good is your password? In this instance, null is better
than weak, such as "1234" etc. as null suppresses this exposure.

>I have run hardware tests and even changed BIOS (Die Hard), but nothing
>seams to solve problem.

Safe Mode? MSConfig suppression? Have you done an even
halfway-formal (e.g. Safe Cmd Only) virus scan?

There's only so far you can get by wiping and reinstalling and blindly
replacing hardware. Time to troubleshoot.

>-- Risk Management is the clue that asks:
      "Why do I keep open buckets of petrol next to all the
      ashtrays in the lounge, when I don't even have a car?"
>----------------------- ------ ---- --- -- - - - -

• Previous message: Ian Kenefick: "Re: Univers.exe and dingping.exe services won't stop"
• In reply to: garyghj2: "Generic Host Process for Win 32"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]