microsoft visual c++ runtime library run time error program: c:\windows\explorer.exe

Discussion in 'adware, spyware & hijack cleaning' started by exujing, Jun 1, 2004.

Thread Status:
Not open for further replies.
  1. exujing

    exujing Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    5
    Hi there,
    I've run Spybot and Hijack This, and below is the log.
    The problem I experience is a pop box with the following message:
    microsoft visual c++ runtime library
    run time error
    program: c:\windows\explorer.exe
    abnormal program termination
    It only happens to certain websites.

    Logfile of HijackThis v1.97.7
    Scan saved at 11:31:56, on 01/06/2004
    Platform: Windows 2000 SP2 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\System32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\System32\drivers\trcboot.exe
    C:\Program Files\Dell\OpenManage\Client\ActionAgent.exe
    C:\DMI\WIN32\bin\DellDmi.exe
    C:\Program Files\Dell\OpenManage\Client\EventAgt.exe
    C:\Program Files\Dell\OpenManage\Client\DLT.exe
    C:\WINNT\System32\svchost.exe
    C:\Program Files\Dell\OpenManage\Client\Iap.exe
    C:\Program Files\IBM\Application Developer Integration Edition\IBM Agent Controller\bin\RAServer.exe
    C:\WINNT\LogWatNT.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\snmp.exe
    C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
    C:\dmi\win32\bin\Win32sl.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\System32\wm.exe
    C:\NOVELL\ZENRC\wuser32.exe
    C:\WINNT\System32\WMRUNDLL.EXE
    C:\WINNT\System32\WMRUNDLL.EXE
    C:\NOVELL\ZENRC\WUOLService.exe
    C:\WINNT\System32\drivers\ldlcserv.exe
    C:\WINNT\System32\NALNTSRV.EXE
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\NALDESK.EXE
    C:\WINNT\System32\dpmw32.exe
    C:\Program Files\Microsoft Hardware\Mouse\point32.exe
    C:\WINNT\System32\NWTRAY.EXE
    C:\WINNT\loadqm.exe
    C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
    C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\internet explorer\IEXPLORE.EXE
    \EDIT01_FS\sys\public\zenworks\ntscan32.exe
    C:\My Documents\downloaded software\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.directline.com/itnet/itnet.nsf/hotnetframes?open
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Direct Line Group Services
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.directline.com:8080
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = datatrain*;*.directline.com;*.directline.co.uk;*.privilege.com;*.u-k-i.com;*.tesco-insurance.co.uk;*.greenflag-breakdown.com;*.jamjar.com;*.jamjarcars.com;192.168*;10.128*;190.100*;191.254*;172.16*;*.rbsgrp.net;*.dlfs.com;*.companies-house.gov.uk;<local>
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://cpqjump.av.com/cpq/cid/1Q00/kb3/
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [NDPS] C:\WINNT\System32\dpmw32.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [FinePrint Dispatcher v5] C:\WINNT\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
    O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\Plus!\MICROS~1\Plugins\NPDocBox.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {37775067-8350-11D4-A7DA-00C04F14FB69} (PVCS Tracker I-Net Client for MSIE) - http://11.134.100.251/trackdoc/trkpm660ie.cab
    O16 - DPF: {CDBD9968-7BF1-11D4-9D36-0001029DEBEB} (Loader Class) - http://10.128.202.11/tdbin/Spider.ocx
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = directline.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = directline.com
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = directline.com
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
     
  2. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi exujing,

    Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

    O16 - DPF: {37775067-8350-11D4-A7DA-00C04F14FB69} (PVCS Tracker I-Net Client for MSIE) - http://11.134.100.251/trackdoc/trkpm660ie.cab
    O16 - DPF: {CDBD9968-7BF1-11D4-9D36-0001029DEBEB} (Loader Class) - http://10.128.202.11/tdbin/Spider.ocx

    Are you using Sun Java or MicroSoft Virtual Machine?

    Regards,

    Pieter
     
  3. exujing

    exujing Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    5
    Hi Pieter, thanks for your prompt reply. I have tried HijackThis fix and rebooted, but it didn't help. I am using Sun JVM but in internet options, advanced tab, all three checkboxes under Microsoft VM are checked.
    Thanks
    Jing
     
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
  5. exujing

    exujing Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    5
    Dear Pieter,

    I have installed Windows Script5.6 and rebooted, but the error still comes up. The difference I noticed is that I used to get two pop boxes with the same error msgs for one website, now I am only getting one before the window is closed.

    Thanks
    Jing
     
  6. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
  7. exujing

    exujing Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    5
    Hi Pieter,

    The link didnt work, but I have tried to reinstall Macromedia player.. no luck either..

    Jing
     
  8. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Clutching at straws:

    http://www.mcse.ms/message639960.html

    If that does not help click Start > Run type or copy&paste sfc /scannow >OK (If you type, there is a space between sfc and /scannow)
    Windows will look for outdated, corrupted or missing system files and prompt you when it finds one.

    Regards,

    Pieter
     
  9. exujing

    exujing Registered Member

    Joined:
    Jun 1, 2004
    Posts:
    5
    Hi Pieter,

    I couldn't do that because i dont have win2k CD at hand. Instead I reimaged the harddisk. It works fine now. but I still wonder what the problem is about. Could you share some info with me?

    Thanks!
    Jing
     
  10. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi Jing,

    No idea really. I was hoping that a Windows file would turn out to be damaged or replaced.
    Some programs replace Windows files when they get installed, which is almost never a problem untill the program gets uninstalled, taking the replacement for the Windows with it lor putting back an outdated copy of the original.

    Regards,

    Pieter
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.