PDA

查看完整版本 : [警告]generic host process win32 service錯誤是什


吉米丘
02-15-2004, 22:23
一般來說,常看到這樣的錯誤訊息表示你中毒了...

你可能中的是msblaster worm所以快點上網更新吧~
或是找找看有沒有這個檔案
Locate the H_KEY_LOCAL_MACHINE entry and then select the folders HKLMsoftwareMicrosoftWindowsCurrentVersionRun
In the right hand panel select "windows auto update = msblaster.exe"
Delete it if it exists.
When you have done this you need to download the patches from Microsoft and install them.


不然也有可能是下列的狀況
What is "Generic Host Process for Win32 Services?!?"This is what ZoneAlarm complains about while connected to the internet. "SVCHOST.EXE" is "Generic Service Host." What that means is it is a "host" for other processes or services. If your internet connection seems to "no longer work," it is due to you disallowing various "required" functions to no longer access the internet. A big one is "DNS Lookups" and HTTP. With DNS lookups disabled, you will no longer be able to type in "www.blackviper.com" but you will always be able to type in the IP address of the systems. The internet connection is still working, but you are blocking a "vital" part of the process for surfing web pages. With HTTP TCP Port 80 blocked, you will not be able to access any web site.

As to whether or not "you" need the particular process to access the internet or act as a server is completely dependent upon your computer configuration, your software installation, and what you are doing at any given time.

Only you can make the decision about if "you need this to access the internet" or not.

A security vulnerability exists with Windows that could cause your system to exhibit all kinds of poor behavior. This particular issue attacks the Remote Procedure Call service which Zone Alarm may issue a warning with regards to SVCHOST.EXE and Generic Host Process for Win32 Services. However, this inbound traffic should NOT be allowed. READ MORE...

Generally speaking, the following ports and services should NOT be blocked:

DHCP: UDP Port 67 and 68 (block both outbound and inbound only if you have a static IP address)
DNS: UDP Port 53 (allow only outbound; disable inbound unless you have local DNS server)
HTTP: TCP Port 80 (allow only outbound; disable inbound unless you have local web server)
HTTPS: TCP Port 443 (allow only outbound; disable inbound unless you have local web server)
Generally speaking, the following ports and services SHOULD be blocked, "outbound and inbound":

NetBIOS: UDP 137
RPC: TCP 135
UPnP: UDP 1900
UPnP: TCP and UDP 5000
If you block a port and something breaks, reenable the blocked port and see if it is fixed. Easy as that. :)

吉米丘
02-15-2004, 22:26
網路安全專家表示,一隻網路蠕蟲利用最近在微軟(Microsoft Corp)<MSFT>視窗軟體上
發現的安全漏洞,周一在美國現身,對系統進行破壞並向門戶
洞開的電腦散播。

這隻被稱為LoveSan、Blaster或MSBlaster的蠕蟲利用Windows 2000和Windows XP系統
中,包含在一種遠端程序呼叫(Remote Procedure Call)功能內的
分散式元件物件(Distributed Component Object)服務的弱點作怪。

網路安全專家烏爾里希(Johannes Ullrich)稱,
一旦這隻蠕蟲進入有機可乘的電腦,便從上一台被感染的電腦下載程式碼,
以自我繁殖。接著,這隻蠕蟲會繼續在網際網路上尋找下一個攻擊目標。

他表示,在某些案例中,蠕蟲會把受害者的整台電腦毀了。

他指出,這隻蠕蟲正迅速散播,已經感染數千台電腦。

烏爾里希說,這隻蠕蟲似乎還指示電腦在8月16日對微軟的一個網站發動分散式阻斷服
務攻擊(distributed denial of service, DDOS)。
防毒軟體公司Network Associates認為,這隻蠕蟲對消費者與企業電腦用戶具有中級風險
賽門鐵克<SYMC>則將它列為具有高度傳播風險,但破壞風險
僅在低度。

遭受攻擊的網友主要是使用Windows NT/2000/XP/2003的用戶
黑客利用這些系統的一個漏洞,使用Win2000/XP RPC 服務拒絕服務工具對135埠實施攻擊
成功攻擊後, 在WIN2000下, "rpcss" 服務會終止, 並造成系統不穩定. 在XP下
系統會被強制重新啟動。同時2003 Server 作業系統也會受此影
響,遭受攻擊的電腦的症狀為,系統Remote
Procedure Call (RPC)意外終止。XP/2003系統還會出現Generic Host Process for
Win32 Services錯誤報告。