Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Programs Shutting Down


  • Please log in to reply
8 replies to this topic

#1 Sarcastikus

Sarcastikus

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:11:57 AM

Posted 04 August 2005 - 10:14 AM

Hello,

I've recently had a problem with programs shutting down, especially when changing preferences (such as in Google), or deleting files (such as in HiJack This and Privacy Crusader). The error message will sometimes even indicate that Windows Explorer is shutting down after I okay the Shut Down message of the program having the problem and the screen will briefly go black before showing the desktop again. One common factor in the examples below is either an invalid instruction or page fault in "module <unknown> at 0000:838b9035".

I run Windows 98SE. Any assistance/advice is greatly appreciated!

The error messages all being with:
All Program has performed an illegal operation and will now be shut down.

HIJACKTHIS executed an invalid instruction in
module <unknown> at 0000:838b9035.
Registers:
EAX=0071f108 CS=018f EIP=838b9035 EFLGS=00010246
EBX=000001f8 SS=0197 ESP=0071f0f4 EBP=0071f130
ECX=0071f1b0 DS=0197 ESI=bfc045c6 FS=191f
EDX=000001f8 ES=0197 EDI=00000000 GS=0000
Bytes at CS:EIP:
ff ff 90 90 90 90 00 00 00 89 45 e8 89 7d f8 89
Stack dump:
6606f73f 0071f108 000001f8 000001f8 00000000 00000028 000001f8 00000000 0116a3a8 0071f1b0 00000040 00000000 0071f158 00000000 00000000 0071f158

IEXPLORE executed an invalid instruction in
module <unknown> at 0000:838b9035.
Registers:
EAX=00648f48 CS=018f EIP=838b9035 EFLGS=00010206
EBX=00422818 SS=0197 ESP=00648b10 EBP=00648f70
ECX=00000000 DS=0197 ESI=00649020 FS=55bf
EDX=00000000 ES=0197 EDI=00648f70 GS=0000
Bytes at CS:EIP:
ff ff 90 90 90 90 00 00 00 89 45 e8 89 7d f8 89
Stack dump:
70a9f1e5 00648f48 00649020 00000000 00000000 00648b28 72756f59 65727020 65726566 7365636e 76616820 65622065 73206e65 64657661 65000020 653c7848

IEXPLORE caused an invalid page fault in
module <unknown> at 0000:838b5035.
Registers:
EAX=0064e014 CS=018f EIP=838b5035 EFLGS=00010202
EBX=00000000 SS=0197 ESP=0064dde8 EBP=0064e228
ECX=81d55404 DS=0197 ESI=00000100 FS=55bf
EDX=00000000 ES=0197 EDI=0064ea4c GS=55ae
Bytes at CS:EIP:
ff 90 90 90 90 3c 00 00 00 89 45 e8 89 7d f8 89
Stack dump:
70a9e2bf 00000000 0064e01c 0064de08 00010030 00000100 00000000 0064de08 7263694d 666f736f 6e492074 6e726574 45207465 6f6c7078 00726572 00000000

PRIVACYCRUSADERFULL executed an invalid instruction in
module <unknown> at 0000:838b9035.
Registers:
EAX=0071ccc4 CS=018f EIP=838b9035 EFLGS=00010246
EBX=0000075c SS=0197 ESP=0071ccb0 EBP=0071ccec
ECX=01178b38 DS=0197 ESI=bfc045c6 FS=2c0f
EDX=0000075c ES=0197 EDI=00000000 GS=0000
Bytes at CS:EIP:
ff ff 90 90 90 90 00 00 00 89 45 e8 89 7d f8 89
Stack dump:
6606f73f 0071ccc4 0000075c 0000075c 00000000 00000028 0000075c 00000000 01178bc0 01178b38 00000024 00000000 0071cd14 00000000 00000000 0071cd14

Thanks!
I'd be more apathetic if I wasn't so lethargic.

BC AdBot (Login to Remove)

 


#2 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:11:57 AM

Posted 04 August 2005 - 11:55 AM

Those look like errors caused from within the memory, probable from some kind of bug loading.

Lets start with some basic cleaning.

See this article:
Taking out the Trash

Show all Files & Folders
http://www.bleepingcomputer.com/forums/ind...showtutorial=62
Try these free tools.
Trendmicro (free virus scan only)
http://housecall.trendmicro.com/
Adware SE (update after installing)
http://www.lavasoftusa.com/software/adaware/
Spybot S&D (update after installing)
http://www.download.com/Spybot-Search-Dest...4-10122137.html

Post back with your progress.

#3 Sarcastikus

Sarcastikus
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:11:57 AM

Posted 05 August 2005 - 11:57 AM

Thanks for the info, etc.

I regularly clear the temp files, etc. on a regular basis.

I did the trendmicro housecall scan, which ran from 930 PM to sometime after 530 AM. It found 21 infected files and it then offered to delete them, an offer which I didn't refuse.

I then ran Adware SE. It found 300+ pieces of crap, many of which I know I've gotten rid of before, and then quarantined the lot of them. Here is the first portion of the Adware SE log (The whole log runs to 67 pages!):

Ad-Aware SE Build 1.06r1
Logfile Created on:Friday, August 05, 2005 10:22:46 AM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R60 04.08.2005


References detected during the scan:

Adintelligence.AproposToolbar(TAC index:5):7 total references
Alexa(TAC index:5):1 total references
BargainBuddy(TAC index:8):131 total references
BookedSpace(TAC index:10):5 total references
BrowserAid(TAC index:6):7 total references
ClickSpring(TAC index:6):3 total references
CometSystems(TAC index:8):3 total references
CoolWebSearch(TAC index:10):156 total references
DyFuCA(TAC index:3):6 total references
ErrorGuard(TAC index:10):4 total references
ExactSearchBar(TAC index:5):6 total references
ImIServer IEPlugin(TAC index:5):5 total references
Masta Dialer(TAC index:5):2 total references
MicroGaming(TAC index:4):1 total references
MRU List(TAC index:0):17 total references
NavExcel(TAC index:7):3 total references
PromulGate(TAC index:5):7 total references
SahAgent(TAC index:9):4 total references
Scam.AdwareRemoverGold(TAC index:3):8 total references
Security iGuard(TAC index:9):2 total references
TopMoxie(TAC index:3):6 total references
Tracking Cookie(TAC index:3):55 total references


After I quarantined these I got a (if I remember correctly) a C++ Runtime Error that involved Internet Explorer, yet Explorer stayed open, but the entire Desktop disappeared (including Start, etc.)!

I still need to run Spybot, but will keep you informed.
I'd be more apathetic if I wasn't so lethargic.

#4 Scarlett

Scarlett

    Bleeping Diva


  • Members
  • 7,479 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:As always I'm beside myself ;)
  • Local time:11:57 AM

Posted 05 August 2005 - 12:07 PM

Do you have an anti-virus program installed?

Also it is always best to run scans in safe mode.
After updating them, of course.
Then disable and re-enable your system restore.
This will clean your restore points. Nasty stuff can hide in them.

Edited by Scarlett, 05 August 2005 - 12:11 PM.

Posted Image

#5 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:11:57 AM

Posted 05 August 2005 - 01:29 PM

Well Sarcastikus you have a pretty major infestation going on there.
Go to Add & Remove Programs and remove any Toolbars & Search items that you did not knowingly install.

It may be that after all this is done the scumware my reappear, if so a HJT cleaning may be necessary. Repeated scans after rebooting will tell you if they keep reappearing. Read these instructions if a HJT cleaning is needed and post the log to the appropriate forum.

After doing this and the problems are not better feel free to post a HJT log.
Be sure to read the How to submit a HJT Log and submit it to the appropriate forum. HJT Forum links provided below.

How to submit a Hijackthis Log
http://www.bleepingcomputer.com/forums/How...s_Log-t956.html
HJT Forum
http://www.bleepingcomputer.com/forums/Hij...alysis-f22.html

Then disable and re-enable your system restore.
This will clean your restore points. Nasty stuff can hide in them.

This is not an option in Win98.
I sometimes forget what OS & forum I am in also. :thumbsup:

For future reference it is not a good idea to delete the restore points until you are sure the system is clean. I feel it is better to have an infested restore point & not need it then to need a restore point and not have one should something go wrong in the cleaning process.

#6 Sarcastikus

Sarcastikus
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:11:57 AM

Posted 05 August 2005 - 02:31 PM

River-Rat/Scarlett - thanks for your advice, etc.

I've checked Add/Remove Programs, msconfig, and HJT, and didn't notice anything unusual or bothersome.

The C++ error I mentioned in my previous post reappeared once and it affected Windows Explorer, not Internet Explorer. After a couple of restarts it hasn't reappeared.

I'm running a couple of more scans to see if anymore crap shows up.
I'd be more apathetic if I wasn't so lethargic.

#7 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:11:57 AM

Posted 05 August 2005 - 04:21 PM

Good Deal :thumbsup:
Sounds good, looks like you might be on the way.
Let us know how your webpages are opening now.

#8 Sarcastikus

Sarcastikus
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:11:57 AM

Posted 05 August 2005 - 07:25 PM

Everything seems to be okay now, I've encountered no more "illegal operations" or "invalid instructions"!

Thanks! :thumbsup:
I'd be more apathetic if I wasn't so lethargic.

#9 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:11:57 AM

Posted 05 August 2005 - 08:15 PM

You're Welcome
Thanks for letting us know. :thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users