I just innstalled sp2 in xp. after that i got some issues with drwtson. changed the settings on that i regedit. now i am unable to open any folder on my computer that contains movie files. this is the error msg: explorer.exe - application error The instruction at "0x21c3397"referenced memory at 0x00000000. The memory could not be "written" Click on OK to terminate the program. Click on CANCEL to debug the program. My job is editing so i got a lot of movie files...

Hi janai. Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Click the HijackThis Guide in my signature, download it and follow the instructions in the guide.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

Hey I am getting almost the same thing as you...

The instructions at "0x02644156" referenced memory at "0x00000000". The memory could not be "written"

This happens when I try to open a newely downloaded .avi file! I havent downloaded any new .mpg's so I think it is just .avi's!

Here is my Hijackthis log! I would love some! Please.... Thanks, Mark

Logfile of HijackThis v1.98.2
Scan saved at 7:29:04 PM, on 11/19/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\marks files\Programs\Apache\Apache\Apache.exe
C:\WINDOWS\System32\cisvc.exe
C:\marks files\Programs\Apache\Apache\Apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\marks files\Programs\Winamp\winampa.exe
C:\windows\system32\ezSP_Px.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\marks files\Programs\Adware\SpywareGuard\sgmain.exe
C:\marks files\Programs\Adware\SpywareGuard\sgbhp.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\windows\system32\cidaemon.exe
C:\windows\system32\cidaemon.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\marks files\Programs\Gnucleus\Gnucleus.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\marks files\Programs\eMule\emule.exe
C:\windows\system32\drwtsn32.exe
C:\windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\marks files\Programs\Adware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\marks files\Programs\Adware\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\marks files\Programs\Adware\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NeroCheck] C:\windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\marks files\Programs\Winamp\winampa.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\windows\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: SpywareGuard.lnk = C:\marks files\Programs\Adware\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download All Files by HiDownload - C:\MARKSF~1\Programs\HIDOWN~1\HDGetAll.htm
O8 - Extra context menu item: Download by HiDownload - C:\MARKSF~1\Programs\HIDOWN~1\HDGet.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: HiDownload - {F4FBA929-A891-492C-A0F6-5C79CC4F1742} - C:\MARKSF~1\Programs\HIDOWN~1\hidownload.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/...utocomplete.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

I think I solved my problem! I found it on another forum!

I downloaded http://www.snapfiles.com/get/shellexview.html, and disabled the .avi Properties Handler!

I only tried opening 1 file, because thats all I have "I deleted the others thinking they were junk"

It worked, but now I need to download some more, and try it again!

Mark

Hi.
I had the same problem and only "system restore" resolved it.
Try restore your system to an earlier time by the "system restore" if you installed some program or updated windows or norton antivirus before this problem starts.

the instruction at "0x01b03397" refrenced memory at "0x00000000" the memory cant be "written"
after getting into many forums reading many threads i found out the reason of this d*** error msg
and how to solve the problem ...

be happy guys its solved by me .. first let me add
my pc spec
i'm using win xp build 2600 sp2
intel p4 3ghz
512mb ram
geforce fx5600

the main reason i started getting this error msg was the time i updated to sp2, so here is how i get
rid of this d*** error msg.
step 1 : check out system properties -------->advanced------->performance---------->DEP (Data Execution Prevention) if its on then its the main cause of ur problem if not... then ur not lucky as i am.

step 2 : how to disable this d*** thing , its not easy though but i could handle it
first make a system disk if u dont have one already with attrib.exe file and edit app running
from dos coz u wont be able to edit the file which has the problem in it in windows.

step 3 : the file we are looking for is boot.ini which is located at c:\ the main dir of ur booting hard-disk

step 4 : startup (boot) from the system disk u made then do these commands
1. attrib -r -h -s c:\boot.ini "remove the hidden,read only, system properties from file"
2. copy c:\boot.ini boot.bak "back-up the boot.ini file"
3. edit c:\boot.ini "now here where we should start adding the option to disable DEP"
in file u will see --->
[boot loader]
timeout=4
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=Optin
C:\ = "Microsoft Windows"

the only command we want to change is the /NoExecute option
change the /NoExecute=Optin to /NoExecute=AlwaysOff
now just exit when prompt to save the edited file just select YES

step 5 : change attribs back to normal by this commanmd
attrib +h +r +s c:\boot.ini

step 6 : restart windows normally and i hope u get rid of this d*** thing i was havin too

any questions about these step feel free to drop me email at shist666@hotmail.com

regards , and good luck everybody

Thank you. I came across the thread when searching on the same problem. Disabling DEP as you suggested has solved the problem for me. But I am curious as to why this should suddenly have become a problem (SP2 was installed months ago) and whether there is a nother solution that does not leave my system slightly less vulnerable now that I have removed DEP?

I was receiving error message whenever I open or closed any window. One of the Messages was as follows:

Regsvr32.exe- application error

The instruction at "0x77f585CO" referenced memory at "0x00000000". The memory could not be "written". Click on OK to terminate the program


Then I installed stinger.
Stinger is a stand-alone utility used to detect and remove specific viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system. Stinger utilizes next generation scan engine technology, including process scanning, digitally signed DAT files, and scan performance optimizations.

The link is as follows:

http://us.mcafee.com/virusInfo/default.asp?id=stinger

I installed it and ran it through my C drive and the D drive. After that I restarted the computer and I didn't find that error again!!

I hope it helps you all out there!!

Help!!!!!!

Wherever i click on any .avi files in Windows Explorer (i keep them mostly on CD's, so i was trying old "clean" files) i get message that DEP is closing Win Explorer program because i am trying to update memory or something.

The same .avi fies run perfectly from DivX player.

I did "system" restore an and disabled the .avi Properties Handler in the register.

I don't want to disable DEp as it seems to be reasonable protection against the viruses

I run Stinger and didn't find any viruses.

What can i do!!!!!!!!!!!???????!

This post has been edited by alexandlal: Aug 29 2005, 06:03 AM

Hi, I have the same problem, whenever I try to open any folder with avi content in windows explorer it tells me instruction at "such number" referenced memory at "such number" memory could not be written. I tried the shellexview and disabled the .avi properties handler but it did not help. Before I was getting this messege I was getting a messege saying drwatson postmortem debugger has encountered an error and needs to close, I then deleted aedebug out of the registry like suggested on forums and now I get my current situation. If anybody can help that would be great, I'm lost.
Thanks a bunch

This problem for me was NOT a virus, NOt bad memory, NOT bad hardware. I did a rebuild which was a real pain - and it came back. In the case of using explorer the "memory could not be written" error reappeared and the adress numbers were changing depending on what directory is opened

For me the error was related to the explorer thumbnails, which you can deactivate for AVI
http://www.moviecodec.com/topics/3379p2.html

but if some programs (PremierPro for example) will not work without the thumbnails.

The solution lies in a bad video codec and I found that removing DivX was the solution. This used to work before but seems to be a problem relating to either SP2 or some MS patch that causes incompatibility.

HI.
I am having this exact problem, but ONLY with the Morrowind game.
Can I just use the "Use DEP for all programs except the ones I choose" option found in System Properties, or do I need to go through the whole process of removing it?
Any thoughts or ideas???
Thanks in advance
The_Endless

I have been having the same problem and followed shist solution, although I did not have to create the system disk.

Go to Start and then RUN.
type cmd (This will bring up the dos window.
type cd.. until you get to the c:/ root directory
then type attrib -r -h -s boot.ini
follow that by typing edit.boot ini

The screen that follows should be the boot loader and should be in BLUE

Then just find the text NOEXECUTE and the test following it should read OPTIN or OPTOUT. replace the last bit with AlwaysOff
click on file and exit and yes when it asks you to save

back at the DOS prompt type attrib +r +h +s boot.ini to re enforce the attributes

type exit and everything should be fine

You should definitely disable thunbnail view for .avi files, they are not one type of file and the thumbnail utitlity can't handle all the types. MS even had a fix for XP which disabled it. If worse comes to worst it can be disabled by editing the registry.