Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet Requests Leading To Crashing Programs?


  • Please log in to reply
17 replies to this topic

#1 Crabby

Crabby

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 12 May 2006 - 11:30 AM

I'm having a problem with my computer.

Since this morning, all programs (that I know of) that access the net give the error "{program} has encountered a problem and needs to close" when doing so. Some programs include:
  • Internet Explorer (which is strange because when I start windowsupdate.microsoft.com from my start menu it works without a problem) gives this error
  • Outlook Express (takes slightly longer to give error)
  • AVG Antivirus (when updating, and which I believe now crashes the entire computer (shuts down) if I leave it scanning away)
  • Mozilla Firefox
  • Opera
  • Spybot S & D (when trying to 'update')
Hopefully you can see the correlation. In addition to this, I can simply drag the error window out of the way and continue using the program just fine.

What I found this morning at first though, was an error on startup (of XP) saying that 'radio.exe' had crashed in the same way. I checked through and found a new exe, radio.exe, all alone, in C:\Program Files\Free Radio\, so naturally, I deleted it.

So far I've also tried:
  • Updating ethernet card driver
  • Removing Office 2000
  • Removing a program I didn't recognise in Add/Remove, called something like 'Dream{something} DLL'.
...to no avail.

Does anyone have any ideas how to solve this?

BC AdBot (Login to Remove)

 


#2 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:08:22 PM

Posted 12 May 2006 - 01:03 PM

Welcome to BC! :thumbsup:

Your computer is exhibiting signs of being infected.

I would recommend following the Preparation Guide to posting a High Jack This log. You may not need to actually post a log, however. If you follow the instuctions in the Preparation Guide faithfully then your computer may be cleaned. However, rarely is a computer infected with only one thing, and it is possible that not all of the problems will be get removed using this method.

PREPARATION GUIDE


You could also try EWIDO:

Download Ewido Anti Malware it is a trial version of the program.
  • Install ewido anti malware
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update Ewido.
Ewido manual updates

Once the updates are installed do the following:
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.
  • You will need to step through the process of cleaning files one-by-one.
  • If ewido detects a file you KNOW to be legitimate, select none as the action.
  • DO NOT select "Perform action on all infections"
  • If you are unsure of any entry found select none for now.
If after completing all of the steps in the Preparation Guide and running EWIDO you continue to have issues, post a HJT log as instructed in the Preparation Guide.

Edited by Albert Frankenstein, 12 May 2006 - 01:05 PM.

ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#3 jgweed

jgweed

  • Members
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:07:22 PM

Posted 12 May 2006 - 06:41 PM

The HJT log posted to the thread in error has been split and moved to the HJT Forum where it will be reviewed by our volunteer team of experts who can help you with your malware problems:

http://www.bleepingcomputer.com/forums/t/52466/crabby-hjt-log/

Regards,
John
Whereof one cannot speak, thereof one should be silent.

#4 Crabby

Crabby
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 14 May 2006 - 10:07 AM

BIG UPDATE

Right, I have formatted C:, and reinstalled windows. Now I am getting the same error (it took a while before it started coming up though). I've installed so far only programs that are trustworthy like office, avg av, steam, cakewalk, limewire, winamp, winrar. The 'free radio' however has reappeared.

So, is this a hardware problem or is whatever (created/is associated with) radio.exe causing my problems?

It shows up as virus-free & malware-free according to windows defender and AVG, and a HJT log shows nothing suspicious, however I just don't know where it has come from. It's properties is blank and it has no icons, nor any other files in the c:\Program Files\Free Radio directory.

The error code I get, is '0xc0000005' which is an 'access violation', which apparently usually means memory problems? But it's highly suspicious that it only started giving me the error again after a startup where 'radio.exe' is started upon bootup but then gives an error and closes.

Please help.

#5 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:08:22 PM

Posted 14 May 2006 - 10:14 AM

"Trused Programs" and "Limewire" should not be used in the same sentence! :thumbsup:

Limewire is a huge source of infection.

Delete this program, and maybe the problems will go away. If they don't, it does not neccessarily mean they weren't originally caused by Limewire. I suspect that Limewire will leave remnants. And if you have actually run the software then perhaps other damage has been done.

That all being said: a 0x05 error can have other causes, such as bad RAM, other programs bugs, etc.

ALSO: It would be courteous on your part to go to your HJT log thread and tell miekiemoes that you don't need their help anymore as your logs are too old to be any good to them. That will free them up to help others.

Edited by Albert Frankenstein, 14 May 2006 - 10:17 AM.

ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#6 Crabby

Crabby
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 14 May 2006 - 10:20 AM

OK, I did that, no immediate effects.

Restarted...

Now I get one of those classic-style error windows:

iexplore.exe Application Error

The instruction at "0x0014072f" refernced memory at "0x020e0000". The member could not be "read".


EDIT: Opened IE for a second time, and now it's giving the old error.

Edited by Crabby, 14 May 2006 - 10:21 AM.


#7 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:08:22 PM

Posted 14 May 2006 - 11:22 AM

If there are two pieces of RAM you could always remove one and see if this issue persists. If it does, swap the pieces and try again. This would identify which piece of RAM is defective, if any.

If you care to test the memory:

Microsoft Memory Diagnostic
Memtest86
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#8 Crabby

Crabby
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 15 May 2006 - 06:50 AM

11 passes on Windows Memory Diagnostic, no errors, and it's decided to start going really slow.

What now?

Edited by Crabby, 15 May 2006 - 09:34 AM.


#9 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:08:22 PM

Posted 15 May 2006 - 10:30 AM

and it's decided to start going really slow.

What does that mean, EXACTLY? What is happening slowly? I have seen people say this and mean all kinds of things. It could mean, the computer starts up slowly, or shut down slowly, or opens programs slowly, or everything works fine except the internet pages load slowly, etc.

Please be specific.
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#10 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:08:22 PM

Posted 15 May 2006 - 10:45 AM

The more I think about it, the more I think you are still infected. What I suggest is the following:

1) Perform a clean install of Windows XP after using KILLDISK. It may not be enough to only format. Some infections can survive a simple formatting. (more detailed instructions below)

2) Fully update your instance of Windows by going to Start > All Programs > Windows Update (near the top of the list). Keep going back until you have installed all updates available.

3) Only install software from trusted sources, not free software (with the possible exception of AVG antivirus). Install MS software, but NEVER P2P software like Limewire, Kazaa, Bearshare, etc.

4) do NOT reinstall your data. It may contain a virus.

Use the computer for a while after doing these things and see if everything works out ok.

and a HJT log shows nothing suspicious,

Who helped you determine that? You should never attempt to fix anything using HijackThis, until someone who is experienced at reading the log outputs, has a chance to review it. Fixing the wrong items can make a computer unbootable.

Spaces, extra characters, spelling, file location, plus numerous other subtle changes, all make the difference between a good, or bad, file entry.

HijackThis is an ennumerator. It lists what is found in certain areas of the registry, or system files, in an easily accessible manner, so that those familiar with the use and reading of HijackThis logs, and windows programs, can determine what is infecting the machine, and how to remove it.

It is not a removal tool. It will indeed remove the entries listed, but that does not cure the underlying problem. The problem must be properly identified first, and cured, prior to removing the entries with HJT.
Otherwise you leave the infection, and remove the keys which are needed to identify and remove it .

Removing entries in HJT before the problem is properly identified, and correct removal instructions posted, can make the problem undetectable to other detection and removal tools. Hijack this should only be used to clean up the entries left behind, after you have properly removed the offending program, file, trojan, worm, hijacker etc. And this usually requires help.
~~~~~~~~~~
You can run Killdisk to delete everything including any infections. This is a free progam and can be downloaded HERE. Put the program on a floppy disk or a CD.

Then run a DOS disk, such as a Windows 98 start up disk, when the computer boots to DOS, type "C:" (without the quotes), push ENTER. Then type "fdisk" (without the quotes), push ENTER, then just push ENTER at each selection that you are prompted to make (in other words, just accept all defaults). You can download what you need HERE.

Then reboot with your XP CD in the cd drive and reinstall Windows, being sure to choose "Full Format" instead of quick format when prompted.

Be careful about reinstalling your data as it may contain a virus or other malware.

Edited by Albert Frankenstein, 15 May 2006 - 10:47 AM.

ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#11 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:06:22 PM

Posted 15 May 2006 - 11:25 AM

Since I do not know your system specs I am guessing whether or not this article will help..

http://www.microsoft.com/technet/prodtechn...n/sp2mempr.mspx
"2007 & 2008 Windows Shell/User Award"

#12 Crabby

Crabby
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 15 May 2006 - 04:27 PM

I've unfortunately just decided to do a second re-install so as to investigate the creation of 'free radio/radio.exe' and it doesn't appear to be limewire.

If I get the problem again and still can't work out what caused it I'll try disabling DEP for IE.

#13 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:06:22 PM

Posted 15 May 2006 - 04:51 PM

Have you taken Albert's advice, and used KillDisk? Certain malware can and does survive the formatting of a drive. This should be your first act to insure your drive is clean. Overwriting the drive will destroy all data including any malware that exists on that drive.
"2007 & 2008 Windows Shell/User Award"

#14 Crabby

Crabby
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:07:22 PM

Posted 15 May 2006 - 05:07 PM

Sorry, somehow I managed to completely overlook Albert's two latest posts.

Windows Memory Diagnostic was what was going slow but 4 passes later and it appeared to be at full speed again.

I didn't remove anything with HJT I just said there wasn't anything suspicious, i.e. I knew the reasons for all of the exceptions brought up.

I'll possibly try killdisk tomorrow if I get time.

EDIT: Found that I can't update the driver for my Ethernet adapter card now. Windows update just says 'the following updates were not installed:' then the adapter update. Possibly something significant?

Edited by Crabby, 15 May 2006 - 05:43 PM.


#15 SilentComputerDeath

SilentComputerDeath

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:06:22 PM

Posted 08 June 2006 - 11:43 PM

Hi,
I have the same problem as crabby. When I turned on my computer this morning i get critical errors everytime a program attempts to access the internet.

It is not the memory, i believe it is the fault of the programs "Information Update" and "Free Radio" these seem to have installed on their own some time yesterday.

When I start up the computer "iu.exe" and "radio.exe" are the first programs to crash.

In my research one site identified it as malware.

http://www.file.net/process/radio.exe.html

http://www.neuber.com/taskmanager/process/radio.exe.html

using: http://www.kaspersky.com/remoteviruschk

>>>>>>

Kaspersky File Scanner

Attention!

Kaspersky Anti-Virus has detected a virus in the file you have submitted.

We suggest that you consider:

*

Reading about the virus/viruses in our Virus Encyclopedia
*

Downloading a trial version of Kaspersky Anti-Virus
*

Purchasing a copy of Kaspersky Anti-Virus in our E-Store
*

Purchasing Kaspersky Anti-Virus from a certified partner



Scanned file: radio.exe - Infected
radio.exe - infected by Trojan-Downloader.Win32.Centim.ch

Statistics:
Known viruses: 199367 Updated: 09-06-2006
File size (Kb): 16 Virus bodies: 1
Files: 1 Warnings: 0
Archives: 0 Suspicious: 0


ad-aware does not detect radio.exe as spyware, my virus scanner does not detect it either but im positive that "radio.exe" is at fault.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users