Create an Account Login to Account

# memory could not be written

### #1 janaj Posted 14 November 2004 - 07:10 AM

janaj

New Member

• Member
• 1 posts
I just innstalled sp2 in xp. after that i got some issues with drwtson. changed the settings on that i regedit. now i am unable to open any folder on my computer that contains movie files. this is the error msg: explorer.exe - application error The instruction at "0x21c3397"referenced memory at 0x00000000. The memory could not be "written" Click on OK to terminate the program. Click on CANCEL to debug the program. My job is editing so i got a lot of movie files...
• 0

### #2 Yarnouth Posted 14 November 2004 - 07:21 AM

Yarnouth

Visiting Staff

• Member
• 508 posts
Hi janai. Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.
• 0

### #3 mheinjr Posted 19 November 2004 - 06:29 PM

mheinjr

New Member

• Member
• 2 posts
Hey I am getting almost the same thing as you...

The instructions at "0x02644156" referenced memory at "0x00000000". The memory could not be "written"

This happens when I try to open a newely downloaded .avi file! I havent downloaded any new .mpg's so I think it is just .avi's!

Here is my Hijackthis log! I would love some! Please.... Thanks, Mark

Logfile of HijackThis v1.98.2
Scan saved at 7:29:04 PM, on 11/19/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\marks files\Programs\Apache\Apache\Apache.exe
C:\WINDOWS\System32\cisvc.exe
C:\marks files\Programs\Apache\Apache\Apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\windows\system32\nvsvc32.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\inKline Global\PC Booster\pcbooster.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\marks files\Programs\Winamp\winampa.exe
C:\windows\system32\ezSP_Px.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\RUNDLL32.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\windows\system32\cidaemon.exe
C:\windows\system32\cidaemon.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\marks files\Programs\Gnucleus\Gnucleus.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\windows\system32\drwtsn32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\marks files\Programs\eMule\emule.exe
C:\windows\system32\drwtsn32.exe
C:\windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapp...rch/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapp...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\marks files\Programs\Adware\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_5_0.dll
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [PC Booster] C:\Program Files\inKline Global\PC Booster\pcbooster.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NeroCheck] C:\windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] C:\marks files\Programs\Winamp\winampa.exe
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\windows\system32\ezSP_Px.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CleanUp] C:\PROGRA~1\McAfee.com\Shared\mcappins.exe /v=3 /cleanup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Startup: SpywareGuard.lnk = C:\marks files\Programs\Adware\SpywareGuard\sgmain.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .tiff: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -
• 0

### #4 mheinjr Posted 19 November 2004 - 10:42 PM

mheinjr

New Member

• Member
• 2 posts
I think I solved my problem! I found it on another forum!

I only tried opening 1 file, because thats all I have "I deleted the others thinking they were junk"

It worked, but now I need to download some more, and try it again!

Mark
• 0

### #5 Saman Posted 03 March 2005 - 05:26 PM

Saman

New Member

• Member
• 3 posts
Hi.
I had the same problem and only "system restore" resolved it.
Try restore your system to an earlier time by the "system restore" if you installed some program or updated windows or norton antivirus before this problem starts.
• 0

### #6 Arike Posted 06 April 2005 - 02:04 AM

Arike

New Member

• Member
• 2 posts

Hi janai. Let us take a closer look at what is running on your PC. We'll need you to use a free diagnostic tool (HiJackThis) and post a log back here with the results.

Most of what it lists will be harmless or even essential, DO NOT delete or modify anything yet! Someone will be along to tell you what steps to take after you post the contents of the scan results.

• 0

### #7 shist Posted 07 April 2005 - 04:06 AM

shist

New Member

• Member
• 1 posts
the instruction at "0x01b03397" refrenced memory at "0x00000000" the memory cant be "written"
after getting into many forums reading many threads i found out the reason of this d*** error msg
and how to solve the problem ...

be happy guys its solved by me .. first let me add
my pc spec
i'm using win xp build 2600 sp2
intel p4 3ghz
512mb ram
geforce fx5600

the main reason i started getting this error msg was the time i updated to sp2, so here is how i get
rid of this d*** error msg.
step 1 : check out system properties -------->advanced------->performance---------->DEP (Data Execution Prevention) if its on then its the main cause of ur problem if not... then ur not lucky as i am.

step 2 : how to disable this d*** thing , its not easy though but i could handle it
first make a system disk if u dont have one already with attrib.exe file and edit app running
from dos coz u wont be able to edit the file which has the problem in it in windows.

step 3 : the file we are looking for is boot.ini which is located at c:\ the main dir of ur booting hard-disk

step 4 : startup (boot) from the system disk u made then do these commands
1. attrib -r -h -s c:\boot.ini "remove the hidden,read only, system properties from file"
2. copy c:\boot.ini boot.bak "back-up the boot.ini file"
3. edit c:\boot.ini "now here where we should start adding the option to disable DEP"
in file u will see --->
timeout=4
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=Optin
C:\ = "Microsoft Windows"

the only command we want to change is the /NoExecute option
change the /NoExecute=Optin to /NoExecute=AlwaysOff
now just exit when prompt to save the edited file just select YES

step 5 : change attribs back to normal by this commanmd
attrib +h +r +s c:\boot.ini

step 6 : restart windows normally and i hope u get rid of this d*** thing i was havin too

any questions about these step feel free to drop me email at shist666@hotmail.com

regards , and good luck everybody
• 0

### #8 gary.lane Posted 08 May 2005 - 02:11 PM

gary.lane

New Member

• Member
• 1 posts
Thank you. I came across the thread when searching on the same problem. Disabling DEP as you suggested has solved the problem for me. But I am curious as to why this should suddenly have become a problem (SP2 was installed months ago) and whether there is a nother solution that does not leave my system slightly less vulnerable now that I have removed DEP?
• 0

### #9 F_A_Z Posted 28 July 2005 - 03:36 PM

F_A_Z

New Member

• Member
• 1 posts
I was receiving error message whenever I open or closed any window. One of the Messages was as follows:

Regsvr32.exe- application error

The instruction at "0x77f585CO" referenced memory at "0x00000000". The memory could not be "written". Click on OK to terminate the program

Then I installed stinger.
Stinger is a stand-alone utility used to detect and remove specific viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when dealing with an infected system. Stinger utilizes next generation scan engine technology, including process scanning, digitally signed DAT files, and scan performance optimizations.

http://us.mcafee.com....asp?id=stinger

I installed it and ran it through my C drive and the D drive. After that I restarted the computer and I didn't find that error again!!

I hope it helps you all out there!!
• 0

### #10 alexandlal Posted 28 August 2005 - 02:08 PM

alexandlal

New Member

• Member
• 1 posts
Help!!!!!!

Wherever i click on any .avi files in Windows Explorer (i keep them mostly on CD's, so i was trying old "clean" files) i get message that DEP is closing Win Explorer program because i am trying to update memory or something.

The same .avi fies run perfectly from DivX player.

I did "system" restore an and disabled the .avi Properties Handler in the register.

I don't want to disable DEp as it seems to be reasonable protection against the viruses

I run Stinger and didn't find any viruses.

What can i do!!!!!!!!!!!???????!

Edited by alexandlal, 29 August 2005 - 06:03 AM.

• 0
<

### #11 realityfire Posted 01 September 2005 - 08:33 PM

realityfire

New Member

• Member
• 1 posts
Hi, I have the same problem, whenever I try to open any folder with avi content in windows explorer it tells me instruction at "such number" referenced memory at "such number" memory could not be written. I tried the shellexview and disabled the .avi properties handler but it did not help. Before I was getting this messege I was getting a messege saying drwatson postmortem debugger has encountered an error and needs to close, I then deleted aedebug out of the registry like suggested on forums and now I get my current situation. If anybody can help that would be great, I'm lost.
Thanks a bunch
• 0

### #12 O2_oxygen Posted 18 September 2005 - 05:24 PM

O2_oxygen

New Member

• Member
• 1 posts
This problem for me was NOT a virus, NOt bad memory, NOT bad hardware. I did a rebuild which was a real pain - and it came back. In the case of using explorer the "memory could not be written" error reappeared and the adress numbers were changing depending on what directory is opened

For me the error was related to the explorer thumbnails, which you can deactivate for AVI
http://www.moviecode...ics/3379p2.html

but if some programs (PremierPro for example) will not work without the thumbnails.

The solution lies in a bad video codec and I found that removing DivX was the solution. This used to work before but seems to be a problem relating to either SP2 or some MS patch that causes incompatibility.
• 0

### #13 The_Endless Posted 20 October 2005 - 09:38 PM

The_Endless

New Member

• Member
• 1 posts
HI.
I am having this exact problem, but ONLY with the Morrowind game.
Can I just use the "Use DEP for all programs except the ones I choose" option found in System Properties, or do I need to go through the whole process of removing it?
Any thoughts or ideas???
The_Endless
• 0

### #14 Neo-Ranger99 Posted 25 October 2005 - 06:46 AM

Neo-Ranger99

New Member

• Member
• 1 posts
I have been having the same problem and followed shist solution, although I did not have to create the system disk.

Go to Start and then RUN.
type cmd (This will bring up the dos window.
type cd.. until you get to the c:/ root directory
then type attrib -r -h -s boot.ini
follow that by typing edit.boot ini

The screen that follows should be the boot loader and should be in BLUE

Then just find the text NOEXECUTE and the test following it should read OPTIN or OPTOUT. replace the last bit with AlwaysOff
click on file and exit and yes when it asks you to save

back at the DOS prompt type attrib +r +h +s boot.ini to re enforce the attributes

type exit and everything should be fine

• 0

### #15 Tyger Posted 25 October 2005 - 07:09 AM

Tyger

Member 2k

• Member
• 2,896 posts
You should definitely disable thunbnail view for .avi files, they are not one type of file and the thumbnail utitlity can't handle all the types. MS even had a fix for XP which disabled it. If worse comes to worst it can be disabled by editing the registry.
• 0