 |  |  |  |  |  |  |  |
Windows 2000Pro explorer.exe - Application Error
Thread Solved |
Windows 2000 Pro
explorer.exe - Application Error
The instruction at "0x7ce82a8c" referenced memory at "0x0363b9d0". The memory could not be "read".
Click on OK to terminate the program
Click on Cancel to debug the program
I click cancel, because if I click OK I usually have to restart Windows altogether. Cancel it does the following.
The second cancel mentioned below is something to do with a log file. There is no other button except cancel on that one.
Haven't noted if it is the same reference numbers each time, but after this comes up I click on two different "cancel" buttons and then wait about 10 seconds during which Windows is locked up then goes to a Blank Blue screen then comes back up with my desktop as though it had restarted Windows. I say this because one of the tasktray icons by the clock comes back up as well that I usually close when I first boot up the computer which I close again. Anyway, this happens usually when I close an open folder window or sometimes when I close a browser window. It just happens basically at random really. It was happening before any of my new hardware changes, but I didn't note when it first started happening as far as software changes. Some google searches kept saying registry fixing programs would resolve it, but they have not.
Explorer.exe basically is Windows isn't it?
Anyway, are there any fixes for this that don't involve reinstalling Windows? If I do need to reinstall Windows is there such a thing as a Cabs file restore like you could do with Windows 98SE that doesn't kill any of your programs, but basically restores just your Windows files and settings without wiping the hard drive?
Also, could this be caused by software conflicts running in the background. I have noticed that sometimes, but not every time it will bring up my Anti-Virus & Firewall programs when it reloads explorer.exe.
Sorry for such a long post, but I use to do tech support myself and I remember that the more details I could get usually helped me diagnose the issue.
Thanks in advance for any advice!
explorer.exe - Application Error
The instruction at "0x7ce82a8c" referenced memory at "0x0363b9d0". The memory could not be "read".
Click on OK to terminate the program
Click on Cancel to debug the program
I click cancel, because if I click OK I usually have to restart Windows altogether. Cancel it does the following.
The second cancel mentioned below is something to do with a log file. There is no other button except cancel on that one.
Haven't noted if it is the same reference numbers each time, but after this comes up I click on two different "cancel" buttons and then wait about 10 seconds during which Windows is locked up then goes to a Blank Blue screen then comes back up with my desktop as though it had restarted Windows. I say this because one of the tasktray icons by the clock comes back up as well that I usually close when I first boot up the computer which I close again. Anyway, this happens usually when I close an open folder window or sometimes when I close a browser window. It just happens basically at random really. It was happening before any of my new hardware changes, but I didn't note when it first started happening as far as software changes. Some google searches kept saying registry fixing programs would resolve it, but they have not.
Explorer.exe basically is Windows isn't it?
Anyway, are there any fixes for this that don't involve reinstalling Windows? If I do need to reinstall Windows is there such a thing as a Cabs file restore like you could do with Windows 98SE that doesn't kill any of your programs, but basically restores just your Windows files and settings without wiping the hard drive?
Also, could this be caused by software conflicts running in the background. I have noticed that sometimes, but not every time it will bring up my Anti-Virus & Firewall programs when it reloads explorer.exe.
Sorry for such a long post, but I use to do tech support myself and I remember that the more details I could get usually helped me diagnose the issue.
Thanks in advance for any advice!
•
•
Join Date: May 2005
Posts: 3,204
Reputation: 
Solved Threads: 188
Explorer.exe basically is Windows isn't it? Yep, it's the pretty UI that you usually use to start pgms from and navigate about your files.
The blank blue screen is what you see when explorer stops running - no desktop icons, task bar, backgound etc. It does look like some bad software is killing explorer.... and bad software is most often malware.
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.
We'll go from there. And you can rarely give too much info....
The blank blue screen is what you see when explorer stops running - no desktop icons, task bar, backgound etc. It does look like some bad software is killing explorer.... and bad software is most often malware.
==Download this file to your desktop: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
- to run it dclick combofix.exe and follow the prompts to start it. When finished, it will produce a log, C:\Combofix.txt - post that log in your next reply.
A word of caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs reboot to restore the desktop.
==download hijackthis: http://www.majorgeeks.com/download5554.html
-copy it to a new FOLDER placed either alongside your program files or on your desktop and then... rename hijackthis.exe to imabunny.exe
-in that folder start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis.
-click the Scan and Save a Logfile button. Post the log here.
We'll go from there. And you can rarely give too much info....
Last edited by gerbil; May 1st, 2008 at 9:42 am.
Deep, deep in the woods, but walking about.
Hi gerbil thanks for the advice.
I downloaded and ran both programs per your instructions. I looked over the log files myself. Mostly I noted that at the end of the combofix.txt file it showed pre-run and post-run free bytes. Apparently it had freed up or IE deleted over 350MB's of whatever. It should be noted that I ran Several different spyware/malware removal programs as well as anti-virus and then Regcure a registry checker before running either of these. Of course updated all these programs before running them. They found nothing as far as a virus or any major spyware/malware, two low risk items of spyware(tracking cookies) were removed. Then I ran both of the applications you gave me links and instructions for. I also went into my Firewall rules after running your programs and had it clean up rules for applications that didn't exist. It cleaned out 1 rule for something that I had blocked.
Anyway, I will attach both files to this thread reply.
Thanks again for your help!
I downloaded and ran both programs per your instructions. I looked over the log files myself. Mostly I noted that at the end of the combofix.txt file it showed pre-run and post-run free bytes. Apparently it had freed up or IE deleted over 350MB's of whatever. It should be noted that I ran Several different spyware/malware removal programs as well as anti-virus and then Regcure a registry checker before running either of these. Of course updated all these programs before running them. They found nothing as far as a virus or any major spyware/malware, two low risk items of spyware(tracking cookies) were removed. Then I ran both of the applications you gave me links and instructions for. I also went into my Firewall rules after running your programs and had it clean up rules for applications that didn't exist. It cleaned out 1 rule for something that I had blocked.
Anyway, I will attach both files to this thread reply.
Thanks again for your help!
Hi gerbil, I posted my reply after doing what you said a few days ago and haven't seen any further reply from you. The problem hasn't gone away. Any further suggestions? Thanks
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
I'll gt back to you tonight. Sorry, but I actually missed your post...
Deep, deep in the woods, but walking about.
No problem. By the way it seems to mostly happen when I'm closing anything to do with Windows its self. Such as having My Documents open and then closing it and it will happen sometimes. Or having My computer open and then closing it and it will happen sometimes. It's intermittent. I also noticed that when it gives the explorer.exe - application error it does reference the same instruction at "0x7ce82a8c" but does not reference the same ref mem address each time. If that's of any help?
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
I guess I missed your post because for a while Opera was not working with this site, and so I did not look in much. Anyway.... you will notice that I have turned on your windows updates in one of the registry lines - if you do not want that just delete these two lines from the block before you run it with Combofix...
[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= -
Heh.... I still like playing Diablo II also... okay, let's get down to it.
Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as CFScript.txt to where you saved Combofix -that is, to a folder or your desktop.
Good. Now drag CFScript.txt onto Combofix [drag the icon if on your desktop, or the filename if in a folder]. Combofix will start, let it run, if your firewall prompts then allow all; post the log.
352 Megs gone? That will be your most precious photos smoked...
[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
"NoAutoUpdate"= -
Heh.... I still like playing Diablo II also... okay, let's get down to it.
Start hijackthis, select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked.
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as CFScript.txt to where you saved Combofix -that is, to a folder or your desktop.
Killall:: File:: C:\WINNT\eraseme_18043.exe C:\WINNT\eraseme_18536.exe C:\WINNT\eraseme_24270.exe C:\WINNT\eraseme_25226.exe C:\WINNT\eraseme_27280.exe C:\WINNT\eraseme_27710.exe C:\WINNT\eraseme_28350.exe C:\WINNT\eraseme_28884.exe C:\WINNT\eraseme_41588.exe C:\WINNT\eraseme_51842.exe C:\WINNT\eraseme_55717.exe C:\WINNT\eraseme_61051.exe C:\WINNT\eraseme_68082.exe C:\WINNT\eraseme_70626.exe C:\WINNT\eraseme_74404.exe C:\WINNT\eraseme_84170.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msci"=- [HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au] "NoAutoUpdate"= - [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.FCKK"= -
Good. Now drag CFScript.txt onto Combofix [drag the icon if on your desktop, or the filename if in a folder]. Combofix will start, let it run, if your firewall prompts then allow all; post the log.
352 Megs gone? That will be your most precious photos smoked...
Last edited by gerbil; May 7th, 2008 at 4:03 am.
Deep, deep in the woods, but walking about.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
By the way, if you look into your Combofix log you will note that you have had that erasme_*****.exe /winbin worm for over a year - that has given it ample time to make many copies of itself, and also to trot out into networked computers. It infects Explorer.exe as well....
To make sure it is gone...
==Run a BitDefender online scan: http://www.bitdefender.com/scan8/ie.html - and post the results, please.
=Check your hosts file, it may have been modified to block some security sites.
If you wish to clear your hosts file manually [C:\Windows\system32\drivers\etc\hosts] you may not be able to save the changed/corrected file. This is because some security applications, possibly also various malware, will lock your Hosts file [make it read-only] as a protection.
Go Start, run, type cmd -press Enter. Paste this line into the window at the prompt, press Enter, close the window and try to save the file again.
attrib -r -h -s %SystemRoot%\system32\drivers\etc\HOSTS
Drag HOSTS into a notepad and make any changes, then save it.
Or just use this tool:
==download HostsXpert from http://www.funkytoad.com/content/view/13/31/
-click the top button Make Writable if it is available
-click Restore MS Hosts File button.
To make sure it is gone...
==Run a BitDefender online scan: http://www.bitdefender.com/scan8/ie.html - and post the results, please.
=Check your hosts file, it may have been modified to block some security sites.
If you wish to clear your hosts file manually [C:\Windows\system32\drivers\etc\hosts] you may not be able to save the changed/corrected file. This is because some security applications, possibly also various malware, will lock your Hosts file [make it read-only] as a protection.
Go Start, run, type cmd -press Enter. Paste this line into the window at the prompt, press Enter, close the window and try to save the file again.
attrib -r -h -s %SystemRoot%\system32\drivers\etc\HOSTS
Drag HOSTS into a notepad and make any changes, then save it.
Or just use this tool:
==download HostsXpert from http://www.funkytoad.com/content/view/13/31/
-click the top button Make Writable if it is available
-click Restore MS Hosts File button.
Last edited by gerbil; May 7th, 2008 at 4:28 am.
Deep, deep in the woods, but walking about.
Thanks for the new info. Also, make that diffenent about what I said earlier. If it is just a windows compatible application no errors when closing or using. If it is a folder of part of windows its self such as My computer, My Documents, Windows Help etc... when you are using them it is fine. When you close them that's when I get the original error.
Anyway, just finished doing everything you said. However, I ran the online virus scan first on both this computer and my wireless notebook with win98se. It found 2 viruses on the win98se and 5 on this win2000Pro plus 1 that it guessed was a virus and it deleted them all. Saved the log file, but it would only save as HTML file so hope I can attach that or whatever.
Did the Hijack thing and that seemed to run ok.
Did the combofix.exe script file you gave me, but it said it wasn't a real reg edit script file or something like that, but I clicked ok to that error message and then it ran the script anyway, because I watched it delete the items you had listed.
Downloaded the tool on the Hosts file part. However it did not have the Make writeable button instead it was a Make readonly button, which I did not choose, but I did choose the "Restore MS Hosts File button" and then closed the window.
Will have to reboot and see if the original problem still exists, but if nothing else we have killed yet some more viruses/malware etc... Amazing considering I have always been one to keep my virus database updated, or spyware or whatever and use more than one and it seems it does not matter how many of all these you use a new different one always seems to find something else the others missed. Sometimes I miss the days of CP/M and DOS sure they were simple, but we didn't know that back then and I never got a virus on my computer for the first 25 years I used them. Now it's going on 31 years and it seems I spend 80% of my time doing system maintenance to kill security issues and keep Windows from crashing. Oh well, I guess I must be a glutton for punishment or I wouldn't still be using these things. :-)
Will attach all the various log files below, but not sure if the HTML one will be allowed. I had to zip the html file, but it's attached.
Thanks again for all your expert advice!
Anyway, just finished doing everything you said. However, I ran the online virus scan first on both this computer and my wireless notebook with win98se. It found 2 viruses on the win98se and 5 on this win2000Pro plus 1 that it guessed was a virus and it deleted them all. Saved the log file, but it would only save as HTML file so hope I can attach that or whatever.
Did the Hijack thing and that seemed to run ok.
Did the combofix.exe script file you gave me, but it said it wasn't a real reg edit script file or something like that, but I clicked ok to that error message and then it ran the script anyway, because I watched it delete the items you had listed.
Downloaded the tool on the Hosts file part. However it did not have the Make writeable button instead it was a Make readonly button, which I did not choose, but I did choose the "Restore MS Hosts File button" and then closed the window.
Will have to reboot and see if the original problem still exists, but if nothing else we have killed yet some more viruses/malware etc... Amazing considering I have always been one to keep my virus database updated, or spyware or whatever and use more than one and it seems it does not matter how many of all these you use a new different one always seems to find something else the others missed. Sometimes I miss the days of CP/M and DOS sure they were simple, but we didn't know that back then and I never got a virus on my computer for the first 25 years I used them. Now it's going on 31 years and it seems I spend 80% of my time doing system maintenance to kill security issues and keep Windows from crashing. Oh well, I guess I must be a glutton for punishment or I wouldn't still be using these things. :-)
Will attach all the various log files below, but not sure if the HTML one will be allowed. I had to zip the html file, but it's attached.
Thanks again for all your expert advice!
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
Back in the days of DOS it was a brave new world, the settlers were gazing enthusiastically out into the wilderness and Microsoft was loved as one of the guides who brought them face to face with it.. But then Microsoft rounded them all up and herded them out into it, some against their will, and now the wolves are circling.
Do you see in the BDF log the .dbx file? That is probably the source - an email.
"However it did not have the Make writeable button instead it was a Make readonly button"... yeah, that means it was already writable, so it gave you the option of making it read-only to stop simply written scripts altering it.
Everything happened correctly with combofix.
=Delete this file:
C:\WINNT\d3dx.dat
There seems to be a problem with your C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ folder. I do not know if it is simply to do with the AShampoo file ASFWHide in there.... I suggest you disconnect from the net, shutdown AShampoo, close any browsers, readers, applications and delete the Temp folder itselfthen recreate it. Restart your firewall.
As far as the error goes, well, there could be sys file corruption still. It can get tedious to scan your system, but I would run this last one [cclean first!]:
==Please use IE or Firefox to do an online scan at panda:- http://www.pandasecurity.com/homeuse...s/activescan/?
-for the free online virus scan select the link Scan your PC, then Register [otherwise there will be no disinfection, merely detection] with a valid email and follow through.
Post the log it produces here.
and follow up with system file checker. Go start, run, paste in:
sfc /scannow ....insert your cd when requested.
Do you see in the BDF log the .dbx file? That is probably the source - an email.
"However it did not have the Make writeable button instead it was a Make readonly button"... yeah, that means it was already writable, so it gave you the option of making it read-only to stop simply written scripts altering it.
Everything happened correctly with combofix.
=Delete this file:
C:\WINNT\d3dx.dat
There seems to be a problem with your C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ folder. I do not know if it is simply to do with the AShampoo file ASFWHide in there.... I suggest you disconnect from the net, shutdown AShampoo, close any browsers, readers, applications and delete the Temp folder itselfthen recreate it. Restart your firewall.
As far as the error goes, well, there could be sys file corruption still. It can get tedious to scan your system, but I would run this last one [cclean first!]:
==Please use IE or Firefox to do an online scan at panda:- http://www.pandasecurity.com/homeuse...s/activescan/?
-for the free online virus scan select the link Scan your PC, then Register [otherwise there will be no disinfection, merely detection] with a valid email and follow through.
Post the log it produces here.
and follow up with system file checker. Go start, run, paste in:
sfc /scannow ....insert your cd when requested.
Deep, deep in the woods, but walking about.
 |
Other Threads in the Windows NT / 2000 / XP Forum
- Previous Thread: Server 2003 - Not allowing client PC's online
- Next Thread: insert user and password in window of Windows Autenticate Box HTML code
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest Windows NT / 2000 / XP Posts
- Today's Posts
- Unanswered Threads
.net 2007 2010 a.exe address alaris apache appstore arm auto automatically black blue book bulletin cellphones chkdsk collaboration computer computerfreezes crash cursor deployment desktop desktops dns dotnetnuke drive eartlink error errors explorer features folder fontmanagers format framework gadgets intel internet interoperability killprocess laptop linux load login mac memory microsoft mobile monitor motionle1600 netbooks novell nvidia open operatingsystems osx palm partition patch port printer product proxy remotedesktop remotedesktopconnection repair replacingraiddrive retrieve screen sharepoint simplifiedchinese sitetositevpn sp1 technology unreadable update usb verizon videodrivers videogames virtual virus vista visual vulnerability wab webos weecam win win32/heur window windows windows7 windowsxp windowsxpnotstartingup. worm xp xpde
