Member Avatar for crazyjaxy

Can anyone help with this i havent a clue what i'm doing. It seems to happen whenever it feels like it and is really annoying.

I don't know what info you need but here are a few bits:

ERROR SIGNATURE:
SzAppName:svchost.exe
SzAppVer:
SzModName:svchost.exe
SzModVer:
offset:00001432

I also looked in event viewer and in the system section it had this error:

EVENT PROPERTIES:
Source:service Control Manager
Type:Error
Event ID:7034
Description: Power manager service teminated unexpectedly.

Does this help????

  • 1 Contributor
  • 1 Reply
  • 219 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by crazyjaxy

Dani AI

Generated

A short, practical diagnostic and cleanup plan based on the Event Viewer note and the attached HijackThis log from . svchost.exe is a normal Windows host process that runs many services; a crash of "Generic Host Process for Win32 services" means some service or module inside that host failed. Causes range from a buggy driver/service to system-file corruption to malware or rogue "security" software that fakes error dialogs. (lifewire.com)

Steps to identify the faulty service (non‑destructive):

  • Note the exact crash time from Event Viewer.
  • From an elevated command prompt list services in each svchost instance:
tasklist /svc
  • Use Process Explorer to match the svchost PID to the services, inspect the full file path (legitimate copies live in the System32 folder) and view loaded DLLs. If the svchost path is outside System32 or non‑Microsoft modules are present, treat the process as suspicious. (ionos.com)

If malware is suspected:

  • Boot Safe Mode (or Safe Mode with Networking) and run a fully updated antivirus scan plus an on‑demand anti‑malware scanner.
  • Use Autoruns to hide/disable non‑Microsoft Run/RunServices entries and to jump to the exact registry/file locations before deleting anything. Autoruns lets entries be disabled safely for testing. Back up the registry and create a restore point first. (learn.microsoft.com)

Cautions and final options:
Do not delete svchost.exe or unknown services blindly—removing the wrong service can break Windows. If multiple obfuscated autostarts persist after scans and careful disabling, the safest recovery is a full backup and a clean reinstall or professional remediation.

Member Avatar for crazyjaxy

This is the hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 16:27:31, on 6/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SAMSUNG\AHT-E310\CnxDslTb.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Documents and Settings\family\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: HyperSearchHook - {A622B864-0085-44BE-BEE9-45DBAC7288C3} - C:\Program Files\Common Files\Hyperbar\HyperbarSS3.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\SAMSUNG\AHT-E310\CnxDslTb.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [abjgeTvAT] C:\documents and settings\family\local settings\temp\abjgeTvAT.exe
O4 - HKLM\..\Run: [obj ping live anti] C:\Documents and Settings\All Users\Application Data\GlueThatObjPing\once delete.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [p7FW34T] syn_os.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [lkbytoqb] c:\windows\system32\lkbytoqb.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\RunServices: [USB Driver] WINDOWS.exe
O4 - HKLM\..\RunServices: [system32.exe] services32.exe
O4 - HKLM\..\RunServices: [Microsoft Intrenet Explorer] xrb.exe
O4 - HKLM\..\RunServices: [Windows Service Pack] mssm.exe
O4 - HKLM\..\RunServices: [Win32 USB1 Driver] DNS-Suffix.exe
O4 - HKCU\..\Run: [Yww6RQf8Q] snmmbed.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - Global Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O4 - Global Startup: Event Planner Reminders Tray Icon.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) -
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/gamc10-gb/gbc10/games4.cab
O16 - DPF: {99B6E512-3893-4155-9964-8EB8E06099CB} (WebSpyWareKiller Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebSWK.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\system32\ScsiAccess.EXE
O23 - Service: USB Driver (Windows Configuration Loader) - Unknown owner - C:\WINDOWS\system32\WINDOWS.exe" -netsvcs (file missing)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.