Help! Idk what's going on..

Hello BC. Can somebody tell me if there's something wrong with my computer? I mean I know there's something wrong with it because it never behaved like this before. I just want to know the cause.

Ok, to start, I always get this microsoft data execution prevention window thing upon loading the desktop. I can't recall what it exactly says but I noticed that this generic process for win32 services is involved. After I close that window, an error report from microsoft pops and says that it encountered a problem with generic process blah blah.

I don't have any idea what that generic process error thing does but the thing is, when I'm using my computer, the appearance of the taskbar switches from the xp theme to classic(if Im not mistaken) and then resets back to xp appearance. Oh, and that happens to whatever active window too. After that, I notice also that applications cant play sounds (I hear alert sounds though). And when I double click the speaker icon at the notification bar, I get this message box that tells "There are no active mixers available... ...this program will now close". I don't know why but when I open an application before the "seizure" happens, I can hear sound from that application. But if its otherwise, its dead silence.

I appreciate any reply guys. Thx. keep it up BC. More power!

Need to know all of the error messages in their entirety

Hello garmanma!

Uhmm,, Is this what you need?

==>Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience.

EventType : BEX P1 : svchost.exe P2 : 5.1.2600.2180 P3 : 41107ed6
P4 : netapi32.dll P5 : 5.1.2600.2180 P6 : 411096ac P7 : 0000a3c0
P8 : c0000409 P9 : 00000000

or you require a screen shot or something?

Btw, the data execution prevention window did not came up this time.

Thanks for stopping by.

Welcome to BC.
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Hello Garmanma. I already downloaded MBAM 5 days ago I think and I already made 4 scans including this time. here are the logs.

_________________________________
Malwarebytes' Anti-Malware 1.31
Database version: 1461
Windows 5.1.2600 Service Pack 2

12/5/2008 1:03:16 PM
mbam-log-2008-12-05 (13-03-16).txt

Scan type: Quick Scan
Objects scanned: 55828
Time elapsed: 9 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Jeff®\Application Data\Microsoft\dtsc (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Jeff®\Application Data\Microsoft\dtsc\s (Trojan.Agent) -> Quarantined and deleted successfully.

______________________________________________
Malwarebytes' Anti-Malware 1.31
Database version: 1461
Windows 5.1.2600 Service Pack 2

12/5/2008 5:57:51 PM
mbam-log-2008-12-05 (17-57-51).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 123947
Time elapsed: 2 hour(s), 21 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{498EBC80-BA95-4DFC-8EE9-D4C2780B8466}\RP91\A0063449.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{498EBC80-BA95-4DFC-8EE9-D4C2780B8466}\RP91\A0063451.dll (Adware.WebHancer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{498EBC80-BA95-4DFC-8EE9-D4C2780B8466}\RP91\A0063452.exe (Adware.WebHancer) -> Quarantined and deleted successfully.

__________________________________________
Malwarebytes' Anti-Malware 1.31
Database version: 1461
Windows 5.1.2600 Service Pack 2

12/6/2008 11:57:11 PM
mbam-log-2008-12-06 (23-57-11).txt

Scan type: Quick Scan
Objects scanned: 55893
Time elapsed: 10 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

____________________________________
Malwarebytes' Anti-Malware 1.31
Database version: 1479
Windows 5.1.2600 Service Pack 2

12/10/2008 10:35:37 AM
mbam-log-2008-12-10 (10-35-37).txt

Scan type: Quick Scan
Objects scanned: 56491
Time elapsed: 10 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

You seem to be free of spyware

no active mixers available.

1) Click on Start and Run
2) Type the following command and press Enter

services.msc

3) Scroll down to Windows Audio in the right-hand column and double-click on it,

If it is not set to automatic, it needs to be

microsoft data execution prevention window

It would be nice to have the entire message. Here is an explanation of DEP
http://support.microsoft.com/kb/875352

Have you been turning things on an off in Administrative Tools>Services?

Is it still acting funky

Edited by garmanma, 10 December 2008 - 08:28 AM.

Hi there!

The windows audio is set to automatic. I'll post the DEP msg later, I need to restart my pc first.

Regarding the administrative tools, I haven't changed a thing. However, this unit just got repaired because it wont boot before. The guy who tweaked this said that he repaired the windows because some files were missing. He asked me if I happen to delete some things. which I didn't. He also added that they ran a scan (using McAfee v. 8.6) and found nothing.

btw, I read the details about DEP, and I'm confused. Is the hardware-enforced DEP somehow related to problems with hardware or not necessarily?

thx

there is also software DEP
There is also the possibility of malware causing this
Is this XP or Vista? Do you have an original Windows disk?

I have xp sp2. I don't have the original cd's since Im not the original owner. Its a second hand PC. he only gave me some drivers.

Its strange but the DEP window doesn't come up anymore.

also, my antivirus detects this virus from time to time:
W32/Conficker.worm

If you have System Restore turned on, turn it off and delete all restore points
-----------------------

ATF
Please download ATF Cleaner by Atribune & save it to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main "Select Files to Delete" choose: Select All.
• Click the Empty Selected button.
• If you use Firefox browser click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• If you use Opera browser click Opera at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• Click Exit on the Main menu to close the program.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Now SAS,may need an hour
Please download and scan with SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
• In the Main Menu, click the Preferences... button.
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen and exit the program.
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes" and reboot normally.
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

Hello there! I followed your instructions and here's the SAS log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/11/2008 at 09:16 PM

Application Version : 4.23.1006

Core Rules Database Version : 3671
Trace Rules Database Version: 1650

Scan type : Complete Scan
Total Scan Time : 02:13:20

Memory items scanned : 167
Memory threats detected : 0
Registry items scanned : 6934
Registry threats detected : 0
File items scanned : 73914
File threats detected : 0

Thx!

Does anything show up now?

Well sadly, yes. The same error msg. And It's still acting funky. lol ooops! it switched to classic and quickly back to xp appearance just now. The DEP window doesn't seem to show up until now.

Uhmmm.. the DEP showed up this time

It says:

To help protect your computer, Windows has closed this program.

name: Generic Host process for Win32 Services
Publisher: Microsoft Corporation

I'm going to suggest that you follow the instructions and prepare a HJT log, here:
http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/
Then post the log in the proper form here:
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/
Our team members are rather busy, so it may take a while to get to you
Be patient and good luck