Are you still using WinXP Service Pack 1 or 2?

Solution in post #76 by sUBs :

http://forum.lowyat.net/topic/326260/+60

Otherwise update to Service Pack 3.

Your PC is being attacked from the Internet causing the netapi32.dll to overload and crash.

To solved the problem install the updated netapi32.dll :

http://www.microsoft.com/downloads/details...1a-46b3eac7a305

If that file is virus, why did I ask you to update it?

Alright everyone, I have some update on this problem :

This problem is similiar to the problem & solution posted by sUBs 2 years ago in post #76 of this topic :

http://forum.lowyat.net/topic/326260

The Microsoft article :

http://www.microsoft.com/technet/security/...n/MS06-040.mspx

All freshly installed WinXP with SP2 will still face this problem unless you install the updated patch.

Your PC that are connected directly to the modem & using Window's PPPOE dailer, or PCs that are behind a router but was set as the DMZ PC would be hit by this problem.


As of 23 October 2008, Microsoft has released a new update to solve this new attack that affect even fresh installed WinXP with Service Pack 3 and Vista with Service Pack 1.

http://www.microsoft.com/technet/security/...n/MS08-067.mspx


Install this update for 32-bit WinXP SP2/SP3 users :

http://www.microsoft.com/downloads/details...76-2067B73D6A03

Install this update for 32-bit Vista users :

http://www.microsoft.com/downloads/details...5C-CAC7D8713B21


For other Windows version please, select the appropriate version from

http://www.microsoft.com/technet/security/...n/MS08-067.mspx




If you are interested in the technical details of this problem:

http://blogs.technet.com/swi/archive/2008/...t-MS08-067.aspx

This post has been edited by Hattori: Nov 4 2008, 12:16 PM

I'm still conviced the solution I posted is the correct solution, because my own office PC WinXP SP3 with 0 hotfix installed set as DMZ is hit by this problem too & the problem was solved by the KB958644 update.

You seemed to be concentrating on the "szAppName:svchost.exe or svchost.exe.mdmp" instead of the more obvious "szModName:netapi32.dll" module shown in the first screenshot.




The previous crash with the netapi32.dll attack 2 years ago causes some PC's Realtek sound driver to hang, & the whole WinXP theme to reverting to basic theme when the error box is closed.

This post has been edited by Hattori: Nov 5 2008, 08:55 PM