Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Explorer.exe error[RESOLVED]


  • This topic is locked This topic is locked

#1
dandima_nc

dandima_nc

    Member

  • Member
  • PipPip
  • 26 posts
Hello,

I'm gonna ask your help for a problem that lots of people posting here complain of, hoping you'll have the time and patience to solve it.
Many times (actually 75%) I turn on the computer and start browsing my computer through Windows Explorer, when I select some video files (not the same ones everytime, and only with .avi extension from what I recall - it's been 3 weeks since this is troubling me) I get the explorer.exe error with the message "The instruction at "0x..........." referenced memory at "0x00000000". The memory could not be "written". Click on OK to terminate the program. Click on CANCEL to debug the program."
If I click OK Windows seems to reload, but the problem persists and somehow, after many restarts (even manual restart or after shutting down the computer) I can select my video files without this error message bugging me.
If I click on CANCEL there passes about a minute before I get another error message related to Dr.Watson PostMortem Debugger which has encountered an inconvenience and needs to close, then... the same sequence as if I would have clicked OK from the beginning, instead of hitting CANCEL.
I've been through every step before posting the next HijackThis log, but it never solved my issue. So if you would be so kind as to spend your time and look over my post and suggest a way to get rid of this I would really appreciate your effort.
Thank you.




Logfile of HijackThis v1.99.1
Scan saved at 17:42:08, on 07.05.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Dan\Desktop\HijackThis.exe

O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1114387089609
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  • 0

Advertisements


#2
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Hello again,

I'm back to add a piece of information: I'm using a version of AceMegaCodecsPack (I think 5.93 PRO) as codec library for my video files, which are set by default to be played with Windows Media Player. I hope this will help you identify sooner what is causing my problem and I felt like I should add this because my problem is, until now, strictly involving the selection of .avi files in Windows Explorer.

Thank you very much for taking care of another desperate Windows XP SP2 user ( :tazz: )

Dan
  • 0

#3
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Hi dandima_nc,

Click Start > run > Type or copy&paste regedit /e c:\aviassoc.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi" > OK

That will create the file c:\aviassoc.txt
Post the content of that file please.

Regards,
  • 0

#4
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi]
@="avifile"
"PerceivedType"="video"
"Content Type"="video/avi"
"MP2.Last"="Default"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\OpenWithList]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\OpenWithList\wmplayer.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\OpenWithProgIds]
"avifile"=hex(0):

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\ShellEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{c5a40261-cd64-4ccf-84cb-c394da41d590}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\ShellEx\{FFB699E0-306A-11d3-8BD1-00104B6F7516}]
@="{FFB699E0-306A-11d3-8BD1-00104B6F7516}"



Thank you
Dan
  • 0

#5
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Hmmm. Looks like a nVidia problem.
Save that file you just posted in case we need a backup.
(All you need to do is reneme it to c:\aviassoc.reg and you can use it to restore the current settings)

Copy the part in bold below into notepad and save it as nvrep.reg

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.avi\ShellEx\{FFB699E0-306A-11d3-8BD1-00104B6F7516}]


Doubleclick that file, confirm you want to merge it with the registry.

Reboot and let me know if it helped.

Regards,
  • 0

#6
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Hi Pieter

Well, I've just done what you asked, but the problem persists. I only tried to click on 2 of those videos that constantly trouble me and got the error message with 'explorer.exe' and 'memory could not be written'.
Don't know whether it may help you or not, but I'll add a few things.
First of all, I got an nVidia GeForce MX4000. Then, I noticed that since my first post here a week ago the files that lead to error in Windows Explorer are always the same, not random as I thought before (perhaps because these are bigger files - e.g movies and I don't want to delete them - I used to delete video files that gave me errors before, but there were many small .avi's). The third aspect I think it's worth mentioning to you is that these files were downloaded with a DC++ client (StrongDC++, to be more specific), and not all of the video files I get through download give me 'headaches', but it seems that the percentage is growing. Since last week I've downloaded some more, some didn't cause any problem, some did, but there were small files and I deleted them immediately via Norton Commander.

Thank you so much for trying to help!

Dan
  • 0

#7
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
OK restore the regkey I deleted by using the backup as I described.

It is a nVidia handle that sometimes gives problems, so I thought it was worth a try.

But if it isn't guilty you can better keep it.

Regards,
  • 0

#8
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
OK, did it.

Do you happen to know what's next to do to get rid of this?

Thank you again

Dan

Edited by dandima_nc, 14 May 2005 - 03:10 PM.

  • 0

#9
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Can you give me the exact text of an error merssage, maybe that will provide a clue.

Regards,
  • 0

#10
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
It is in my first post, but I'll quote that again:

"The instruction at "0x..........." referenced memory at "0x00000000". The memory could not be "written". Click on OK to terminate the program. Click on CANCEL to debug the program.", where those dots are some randomly chosen row of 8 numbers.

Thank U!
  • 0

Advertisements


#11
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Well. I doubt if those numbers will be random, but if they are different everytime they are not of much use.

Please click Start, Control Panel, Performance and Maintenance, Administrative Tools, Event Viewer and check at the Application tab if you can fijnd any errors/ warning coinciding with the last crash.

Regards,
  • 0

#12
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Hi

Here it is:

"The shell stopped unexpectedly and Explorer.exe was restarted.

For more information, see Help and Support Center at [url="http://go.microsoft.com/fwlink/events.asp.""]http://go.microsoft.com/fwlink/events.asp."[/url] , Source: Winlogon

This message is reported there for every time I got this error.

Don't know whether it would help you, but this is what it says there for the times when I chose 'Debug' instead of 'OK' after receiving the error message:

"Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

For more information, see Help and Support Center at [url="http://go.microsoft.com/fwlink/events.asp.""]http://go.microsoft.com/fwlink/events.asp."[/url] , Source: Application Error

That's it.

Another three events listed there many times (it looks suspect to me, but I'm obviously not that familiar with this level of using Windows):

"wuauclt (3188) The database engine 5.01.2600.2180 started.

For more information, see Help and Support Center at [url="http://go.microsoft.com/fwlink/events.asp.""]http://go.microsoft.com/fwlink/events.asp."[/url] , Source: ESENT,

"wuaueng.dll (3836) SUS20ClientDataStore: The database engine started a new instance (0).

For more information, see Help and Support Center at [url="http://go.microsoft.com/fwlink/events.asp.""]http://go.microsoft.com/fwlink/events.asp."[/url] , Source: ESENT,

and:

"Windows saved user DIABLO\Dan registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.

This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.

For more information, see Help and Support Center at [url="http://go.microsoft.com/fwlink/events.asp.""]http://go.microsoft.com/fwlink/events.asp."[/url] , Source: Userenv.

Everything else is listed as 'Information', except for this last one, which is listed as 'Warning'.



I'm looking forward to reading from you.
Thanks
  • 0

#13
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Click Start > run > Type or copy&paste regedit /e c:\drwatson.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug" >OK

That will create the file c:\drwatson.txt
Post the content of that file please.

Regards,
  • 0

#14
dandima_nc

dandima_nc

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
"Auto"="0"
"Debugger"="drwtsn32 -p %ld -e %ld -g"
"UserDebuggerHotKey"=dword:00000000


Thank you again
  • 0

#15
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,676 posts
Did you turn DrWatson of on purpose?

If not, copy the part in bold below into notepad and save it as drwon.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
"Auto"="1"


Doubleclick that file and confirm you want to merge it with the registry.

Save the file you posted as drwoff.reg You can use that the same way as a backup to restore your present settings.

Reboot and let me know what happens.

Regards,
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP