# Generic Host Process for Win32 Services Help!



## julies (Jun 3, 2004)

I keep getting a Data Execution Prevention message that says Windows has closed the following program to help protect my computer: Generic Host Process for Win32 Services.

I'm running Windows XP on an IBM ThinkPad T40. IBM Tech Support says I have to reinstall my OS, but I want that to be the absolute last resort (obviously). I have run Spybot and AdAware and all has been cleaned off except on Spybot something called DSO Exploit keeps reappearing despite taking it off.

I installed an HP printer the other day and it made me disable my firewall briefly and I'm beginning to think that's the problem. Should I uninstall the printer? My computer has a lot of trouble with internet browser windows (opening them and letting me type in a URL--for some reason navigating from Google is much less of a problem).

Do I have to reinstall my OS? Help, please! I'm in the middle of grad school applications and really need my computer!

My Hijack This log:
Logfile of HijackThis v1.97.7
Scan saved at 8:16:35 PM, on 11/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\dumprep.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Julie\Local Settings\Temporary Internet Files\Content.IE5\KD2VC5Y7\HijackThis[1].exe
C:\WINDOWS\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: Yahoo! NFL GameChannel StatTracker - http://aud14.sports.sc5.yahoo.com/java/y/nflgcst1008_x.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/downl...-a3de-373c3e5552fc/msSecAdv.cab?1091717753796
O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - https://vapwcc.ops.placeware.com/etc/place/CHAIR/VACpws-c3s/5.1.6.246/lib/quicksilver.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://download.yahoo.com/dl/mail/autocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://salesforce.webex.com/client/latest/webex/ieatgpc.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com/forbesnews/triggernews/ForbesDownloaderSigned.cab


----------



## cybertech (Apr 16, 2002)

DSO Exploit is a bug in Spybot.

Create a permanent folder on your hard drive like c:\program files\hjt. 
Download the new version of Hijackthis and save it to that folder. Post another log.


----------



## warbird (Nov 30, 2004)

Hello,

I am having the exact same problem and I just recently installed a new HP printer, as well. I've been running SP2 for WinXP for some time now. Last night, I did an update and if memory serves, the only "high priority update" was the SP1 for the Microsoft .NET framework. It required a reboot after installing.

Now I log into my machine today and I get this pop up window from DEP saying it has closed the "Generic Host Process for Win32 Services".

I think you are correct in assuming the problem is something to do with your new printer. However, it is probably something else M$ has screwed up.

What printer do you have? I have the HP Photosmart 2610xi "All-in-one" and I'm running the drivers/software that came on the CD with it.

I'll keep poking around. If I find a solution, I'll post it here. Please do the same, should you find a solution?


----------



## cybertech (Apr 16, 2002)

Hi warbird, Welcome to TSG!!

julies has some things to remove from the system so I won't move this thread, but you should post in the XP or all other software and see if you get some response.


----------



## cjohnsjn (Dec 2, 2004)

undefined


warbird said:


> Hello,
> 
> I am having the exact same problem and I just recently installed a new HP printer, as well. I've been running SP2 for WinXP for some time now. Last night, I did an update and if memory serves, the only "high priority update" was the SP1 for the Microsoft .NET framework. It required a reboot after installing.
> 
> ...


----------



## cjohnsjn (Dec 2, 2004)

I too have just installed the HP Photosmart 2710 on my new machine running SP2 for WinXP and get the same pop up window saying DEP has closed the "Generic Host Process for Win32 Services" message after a reboot. No problems found when running virus scan and my firewall is enabled.....
Not sure if this is an HP or MS issue.....one way to bypassing the message is to select the "turn on DEP for all programs except this one" option under the system icon in the control panel...
I will continue to investigate and post a fix if I find one......


----------



## warbird (Nov 30, 2004)

Thanks cjohnsjn.

I've not had time to do any further investigation yet. I have many contacts around and will get some fingers out there shortly. Just very busy with work.  

Please do post if you find a solution or more information.


----------



## cjohnsjn (Dec 2, 2004)

To warbird (and others).....
Talked to HP, they recognize that there may be a compatibility issue with SP2....like you, my workload is hectic.....did not have time to address the issue in detail....plan to talk to a HP technician either today or tomorrow....I will keep everyone posted on development.....


----------



## rezdog (Dec 11, 2004)

I'm having the same issue. Uninstalling the HP software was the only thing that helped. I am using an HP PSC 2510. Once I uninstalled the software my PC ran like a champ. Not sure why 500 megs of crap is needed to print. About the same time windows started complaining about the Generic Service host my 2510 scanner was making a sound like the gears were all stripping out. Maybe the error state of the HP software has something to do with it? Just grabbing at straws. I will be calling HP for a repair of my printer, and also asking about the low quality/bloat of their software as well.


Scott


----------



## goldendox (Dec 12, 2004)

I recently had the same issue after installing an hp officejet all in one printer. To disable the generic host process: right click on my computer, select properties, advanced, performance settings, then the data prevention execution tab, and choose "turn on dp for programs and services except those I select," then check "generic host process for win32," then select apply. This should take care of the problem. 

Jeannie


----------



## Evilscott (Dec 14, 2004)

Generic Host Process for WIN32 Services has encountered a problem and needs 
to close. We are sorry for the inconvenience.  

Seems many people are getting this error message. I've seen that both audio 
drivers and HP drivers may be to blame. Seen solutions for WIA and DEP 
changes and also to download the latest .NET framework.

Error occurs for me after reboot (always) typically accompanied by a "Error 
The instruction at "xxxxxxxx" referenced memory at "xxxxxxxxx". The memory 
could not be read. Click on OK to terminate the program.
Printer (HP) wont work, and audio is inop about 50% of the time.

Seems to have started happening to a lot of people (me included) around 
mid-late Nov 04. 

Anyone have a good solution? I already tried the MS KB article in this topic 
and HP printers - that solved the problem until a restart or reboot - then it 
was back again. I've heard svchost might be blocked by a firewall, or that 
it could be a worm, or that dll's are corrupt/missing.


----------



## ferretkid (Dec 19, 2004)

Well i was having somewhat of the same problem and i could not find a solution but i did fix it but you are going to have to reinstall ur os...
just put the disk in and select upgrade instead of new installation and ull have all of ur stuff still, it takes just 30 to 50 mins to install and its better then doing all this forum stuff and looking for answers when u can take 30 to 50 mins out of ur time instead of 2 weeks or something lol


----------



## Psiko_Coop (Jan 8, 2005)

If you use Zone Alarm, go into the programs tab and block all access for HP items. This solved my problem immediately.
Zone Alarm is a software Firewall, better than Winblows Firewall IMHO

go to

http:\\www.zonelabs.com


----------



## DaleCBrooks (Jan 15, 2005)

All,

Thanks very much for helping me confirm that this DEP issue is related to HP.

Quick Details:

- I have an HP 2710
- I have already done a nice clean rebuild of Windows XP Pro SP2 with
all patches
- My HP software is updated as of Dec
- The DEP message seemed to have gone away for a little while,
BUT has come back, and each time I reboot the repetive messages
return, and are MORE numerous each time.
- have tried combs of DEP on or off, as suggested above, but am convinced
it's just going to keep happending until Microsoft or HP determine the problem and provide updates.

I don't believe a clean rebuild is going to solve this problem, so I wouldn't
bother...it didn't work for me and I did everything right.

** Update. Okay, I re-set the advanced settings to allow DEP
for all programs except for: Generic Host Process for Win32 Services,
rebooted, only got the message once, rebooted again, and for now
don't get the DEP message, but I'm not so sure it isn't going to come back.
Seems to be the best solution for now. Would keep eye out for
any updates from HP and/or Microsoft.

thanks again to the others for posting...it really helps...

Dale


----------



## scorwitz (Jan 16, 2005)

Hello all,

This is my first post here. I've also had this problem since installing my HP 2710, and have now learned how to turn it off for the HP software, but I don't know if that would have an ill effect of any kind?

What exactly does the "Generic Host Process Win32 Services" do and what does the HP software use it for? Keep in mind I use it wirelessly and still would like to be able to do so.

Thank you!
[email protected]


----------



## rolau (Jan 23, 2005)

Hello everyone,

this is my first post. I have been having this problem too and it just happened right after i had installed the HP drivers and software for my printer which is HP 2610xi "All-in-One" ... i did the update for the HP software and it solved the problem for a day and then it came rearing it's ugly face again. I would like to thank all of you for trying to help with suggestions and I will try and do them except for the OS method

but if I do the "turn on dep for programs and services except those I select" would it affect any other programs/processes?

and to scorwitz: how did you turn off your HP software?

Thanks to everyone who is helping!!!
Rob


----------



## scorwitz (Jan 16, 2005)

I actually don't know much more than you. I am not the person who learned to shut off my HP software. I'm afraid to do anything, considering that after spending a total of 9 HOURS!! on the phone over New Year's Weekend starting with HP and the Linksys, Comcast and Dell, I finally was able to get a wireless connection between my wireless router and the printer.

The linguically challenged Indian gentleman from HP who I called to help me establish a connection told me to hard reset my router (after having turned on WEP and used MAC address filtering) He then didn't know how to help me and was trying to get rid of me. I had no internet connection whatsoever and finally made it all the way back to Dell, talking to Indians at every turn who merely told me to reset my computer back to the 'restore date'.

The only useful information I got from HP was that if you already have SP2 downloaded from Satan....I mean Microsoft the HP software, which came out before SP2 may have some issues interacting with it. He told me that I may have to uninstall the HP software, uninstall SP2, Re-install the HP software and then re-install SP2!! And I'm sure that no residual bits of data would remain after all that, yeah right.

So, all I do is close the message when it pops up. Sometimes it pops up once, sometimes 3 or 4 times and sometimes not at all. Aren't computers the most precise machines on the planet?

Scorwitz


----------



## egvv (Jan 24, 2005)

I had the same problems on two laptops, the following link did help me : 
http://h10025.www1.hp.com/ewfrf/wc/...roduct=420428&lang=en&cc=us&docname=c00273968


----------



## rolau (Jan 23, 2005)

thanks for the info egvv


----------



## maikischer (Jan 26, 2005)

Then it should stop.



warbird said:


> Hello,
> 
> I am having the exact same problem and I just recently installed a new HP printer, as well. I've been running SP2 for WinXP for some time now. Last night, I did an update and if memory serves, the only "high priority update" was the SP1 for the Microsoft .NET framework. It required a reboot after installing.
> 
> ...


----------



## Vessel185 (Feb 13, 2005)

I may not be the one with the right answer but I fixed the problem by going to Control Panel in XP, then to system, then to the advanced tab. Here I clicked on Performance Settings and then Data Execution Prevention. I changed it to only do this with the essentials, I also added the Generic host exception to the list, though you dont need that if you select the "limited" check box. If the limited doesnt work then add generic host services for win32 and go with that. You can also add any programs to this list that cause you grief. Also, in System, here to can turn off error reporting. I did this since there are a bajillion people with it on and many will have the same problem as me. This eliminates the annoying process of reporting errors.


----------



## Shairel (Jan 15, 2003)

I have a notebook that is exhibiting this issue, and also has the driver for the psc 2700 series installed, I am gonig to try to load the update on HP's web site


----------



## blue screen (Mar 25, 2005)

ditto ! yet another one suffering from the DEP GHP Win32 problem!...
...with all new (1 month old) computer equipment direct from manufacturer all OEM software...

_NOW.. my brand new beemer, purchased with a brand new ski rack, both direct from bmw, has a problem: if i use install the rack; the doors wont close. last week bmw tech support in bombay talked me through fitting mudflaps the first time round, the second time a respray. the dealership said its a know error and suggest removing the doors. just waiting for the patch on that to come out. meanwhile, i have to use the bus._

HP fix...

Solution 1

Uninstall and then reinstall the software using the following procedure:

Uninstall the software by inserting the software CD that came with unit into the CD-ROM drive on the computer.

NOTE: If the startup screen does not appear, double-click the My Computer icon, then double-click the CD-ROM icon where the all-in-one disc is inserted. Choose the Uninstall option. If the Uninstall option does not display, the software is not completely installed. Proceed to step 2.

Install the software by inserting the software CD that came with unit into the CD-ROM drive on the computer.

NOTE: If the startup screen does not appear, double-click the My Computer icon, and then double-click the CD-ROM icon, where the all-in-one disc is inserted. Choose the Install option.

Download the Critical update for network installed HP All-in-One devices patch (hp_officejet_psc_scan_update_enu_2kxp.exe) from www.hp.com.

Solution 2

Uninstall the all-in-one software using the CD that came with the unit, by following the steps in Solution 1 above.

After the software is uninstalled, restart the computer.

Install the all-in-one software by following the steps in Solution 1 above. After installation is complete, verify that the unit works correctly.

Change the Windows Image Acquisition (WIA) service from Automatic to Manual by performing the following steps:

Right-click My Computer, then select Manage. The Computer Management window opens.

in the Computer Management window, click the plus (+) sign next to Services and Applications.

In the list below Services and Applications, select Services.

In the right-hand side of the window, right-click Windows Image Acquisition.

Select Properties.

Change Startup Type to Manual.

Click OK.

Close the Computer Management window.

Add hpqtra08.exe to the Windows Firewall Exception list by performing the following steps:

Click Start, then Control Panel. (Click Start, Settings, then Control Panel if you are in Classic Start menu mode).

Click Security Center.

Scroll to the bottom of the new window.

Click Windows Firewall.

Click the Exceptions tab.

Click Add Program.

Click Browse.

Select C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe.

Click OK.

Click OK.

Close all open windows.

Restart the computer and verify that the unit works correctly.

Solution 3

Perform the following procedure to create exceptions in the Data Execution Prevention (DEP) tab:

Right-Click My Computer, then click Properties.

On the Advanced tab, under Performance, click Settings.

On the Data Execution Prevention tab, do one of the following:

Click Turn on DEP for essential Windows programs and services only to select the OptIn policy.

Click Turn on DEP for all programs and services except those I select to select the OptOut policy, and then click Add to add the programs that you do not want to use the DEP feature.

Create an exception in the DEP for the following programs by browsing to the correct location. The following list outlines the locations:

Hpcmpmgr.exe (x:\Program Files\HP\Hpcoretech\hpcmpmgr.exe)

HPwuSchd2.exe (x:\Program Files\HP\HP Software Update\hpwuSchd2.exe)

HP Digital Imaging Monitor (hpqtra08.exe) (x:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe)

HP Image Zone Fast Start (hpqthb08.exe) (x:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe)

...

*Note: 2 identical computers on network with identical software & same user.. one has DEP GHP Win32 issue, other has server UID error with outlook, neither replicates the error of the other !*


----------

