Error message when exiting IE

[caskin]

First posting real newbie but could do with some expert advice.

Have recently installed Microsoft Office 2007 full...since then I now get everytime that I exit IE ,an error message "unable to read memory at 0x0149ea8. click Ok to terminate programme"

 

Can I rectify this error?

 

Do I have to worry about it???

 

many thanks

[AdvancedSetup]

Have you installed Service Pack 1 for Microsoft Office 2007 ?

 

The 2007 Microsoft Office Suite Service Pack 1 (SP1)

 

Also run the Windows Update and make sure you have all the Microsoft Critical Updates for Windows installed.

[Tony D]

Please verify the error message. I would expect 0x followed by 8 digits, not 7.

[caskin]

many thanks for your reply and that of Advanced...I have carried out all updates to Office 2007 as well as Windows XP..you are correct regarding error message it should have read"0x01491ea8"...it does not appear to be affecting any operations so do I have to worry about it?or is there a way to rectify?

[Tony D]

Try resetting Internet Explorer.

 

How to use Reset Internet Explorer Settings (RIES)

[caskin]

Kelly Thanks yet again....may I first explain that I did have IE7 installed without any error messages.But due to lack of Password auto,and some programmes did NOT close when requested and had to be closed down by task manager I went back to IE6 which is where the error message occurs......but I am now finding that even attempting to access windows downloads the page either will not open or freezes?

After many attempts I did access updates and carried out a custon download...two service pack updates failed to instal?

I would go back to IE7 if it would run and operate smoothly..advice I need!!!!....equally I will certainly be making a donation to the site,as it is reassurring to know help is available,

[Seth]

Hi caskin,

 

Please click here to download the HijackThis installer so we can see what's running on your computer. Run the program and choose "Do a system scan and save a logfile". Please post that log back here.

[caskin]

Seth one and all again thanks for help...since talking with Kelly I have reinstalled IE7..no more error problems but now back to pages not closing correctly and still winXP updates of net.framework 2.0 and 3.0 will NOT instal........will now carry out system scan and logfile and pass to you.

[Guest Wolfeymole]

Please do Caskin

 

Upon doing so I will move this thread to the Security section of Extreme Tech Support - Free PC Help.

[caskin]

UM?just one question...now that I have the log how do I post it onto the forum????

[Guest Wolfeymole]

Simply Copy and Paste the HJT log straight into your reply Caskin

[caskin]

Belive I have managed to work it out and hopefully LOG is enclosed with reply as attachment.Hope this assists and again many thanks for help

log.txt

[Guest Wolfeymole]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:26:06, on 19/04/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\a r service.exe (spaces inserted) Wolfey

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\Program Files\Saitek\SD6\Software\ProfilerU.exe

C:\Program Files\Saitek\SD6\Software\SaiMfd.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\HistoryKill 2007\histkill.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\MagicDisc\MagicDisc.exe

C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe

C:\Program Files\Skype\Plugin Manager\skypePM.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\Program Files\BitLord\BitLord.exe

C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe

C:\Program Files\Outlook Express\msimn.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

[Guest Wolfeymole]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = myAOL | Compaq

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Yahoo! Search - Web Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: (no name) - {6860A44B-5D3E-433D-A7B5-D517F810D0E7} - (no file)

O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll

O2 - BHO: Tooltipizer - {C004D9F0-A742-4DC7-AFD0-BC29CE3FE04A} - C:\WINDOWS\system32\dcadssuggest.dll

O2 - BHO: e404 helper - {DF47DD37-AC11-4A93-8E16-2B2364AF0897} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: IE Custom Tools - {6CA49FDD-4AEB-4F08-A394-C0A1F82CAA16} - (no file)

O3 - Toolbar: Dcads Toolbar - {41C29B07-6F91-4966-91BE-2E2841643C83} - C:\Program Files\Dcads Advanced Toolbar\toolbar.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Internet Service - {DB9FBA9D-AB1B-4CC6-9745-F3B549D64E40} - (no file)

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe

O4 - HKLM\..\Run: [saiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [HistoryKill] "C:\Program Files\HistoryKill 2007\histkill.exe" /startup

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Program Files\NetProject\scit.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')

O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe

O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)

O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1208352972389

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: boardwalk - {75a65a53-15c9-4a0c-bb40-a7ca8b24f544} - (no file)

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iolo DMV Service (ioloDMV) - Unknown owner - C:\Program Files\iolo\Common\Lib\ioloDMVSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

--

End of file - 11872 bytes

[Seth]

The log shows some minor infections, but try these first:

 

1) Go to Add/Remove programs and remove and "Toolbars", as the ones that show in the log are malware.

 

2) Perform an IE7 reset:

 

1.Open Internet Explorer 7.

2.Click Tools, and then click Internet Options.

3.Click the Advanced tab.

4.Under Reset Internet Explorer Settings, click Reset.

 

3) If the above doesn't help, keep tapping F8 as soon as you turn on the computer. A menu will appear in which you can use the arrow keys to move through the list. Choose "Safe Mode With Networking" and hit enter. Now test out IE7. Is it ok now?

 

4) If not, please do the following:

• Download ATF-Cleaner from Snapfiles.com to remove "junk" files from your computer that may contain malware.
  
• You can also download it from Majorgeeks.com
  
• When you run ATF-Cleaner, check the items as shown below for Main.
  
• For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
  
• NOTE: If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
  
• Then click on "Empty Selected".

http://kixhelp.com/wr/images-freepchelp/atf-cleaner01.gif . http://kixhelp.com/wr/images-freepchelp/atf-cleaner02.gif

 

 

----------------------------------------------------------------------------------------------------------------------Install and run the free version (not the Professional version) of SUPERAntiSpyware from SUPERAntiSpyware.com - AntiAdware, AntiSpyware, AntiMalware!

• Accept any prompts to allow SUPERAntiSpyware to install the latest rules and infection definition files.
  
• You do not have to send them your e-mail address, just click next.
  
• You can leave the automated check for updates on.
  
• You can uncheck "Send a diagnostic report to research center" if you don't want to send the information.
  
• DO NOT allow SUPERAntiSpyware to protect your Home Page settings.
  
• On the Top Left select the Scan your computer button.
  
• Make sure there is a CHECK MARK on all Fixed Drives.
  
• Click "Perform a Complete Scan". Click "Next" and reboot the computer when prompted to do so.

 

[caskin]

Have passed log to you by attachment and I then checked to see that it was on forum....but it now no longer appears to be here??

Things became so unstable on my PC that I was forced to carry out a restore,this had the affect of removing Microsoft office 2007 and it would appear most of your replies and help(For which I thank you)

The restore also returned the PC to its normal self,and I have the feeling that Microsoft Office 2007 was causing a conflict at some point?

I am very keen to become an established member of this commuity,so if you can indicate how I can subscribe?Plus again, Thanks.

[caskin]

Having just posted my last quick reply,(at which time that the forum replies were empty??)

The posting of the reply has somehow generated a return of your replies with the information that you did get the log,so I will now digest your advice plus I note how to subscribe so will carry out that action also.

[Guest Wolfeymole]

Caskin

 

I opened the txt file that you attached and posted it in 2 parts as you can see above Seth's post.

Do you mean some other attachment?

[caskin]

Donation made via paypal...I will carry out the actions you suggest after I have reinstalled iE7 and all being well will go on to reinstall Office 2007.

[caskin]

Wolfeymole..Our replies are crossing....just to explain when I rentered the forum after my restore at 0803 there were no replies from either yours self or Seth being shown?

It was only when I carried out the quick reply at 0803 this morning that all of a sudden the Forum reactivated showing your replies to which I have now acknowledged///

Confusingyou have no idea,but I guess its all those little unknowns leaping around inside my PC!!!!

[Guest Wolfeymole]

Very well now we are both up to speed can you follow Seth's advice above in post 15 please.

[RandyL]

Hi caskin; It seems there was some confusion on one point.

 

Just to make it clear donations are greatly appreciated to help cover the costs of operating this site. There are expenses but the level of support provided is done by the top notch volunteers and is not based on whether you donate or not. Extreme Tech Support - Free PC Help is free. Please feel free to donate by the link below if you wish. We would appreciate it.

 

That being said please follow up with the malware steps and toolbars as seth and wolfeymole stated to insure your system remains functional.

 

Bye the way if you are using two different antiviruses or two different firewalls uninstall one or the other. They can conflict.

 

For instance Norton Internet Security Suite AND Zone Alarm Firewall.

[caskin]

RandyL:I was only too happy to assist with donation.....a site such as this which obviously is well conducted and in so much demand ,does as you say need all the help it can get......In the meantime I am carrying out advice as given by both Seth and Wolfmole.System already running quicker and sharper.....the last thing I will add is that it is also very pleasing to find a site that does not deride lack of knowledge and goes out of its way to give information that can be easily understood by the uninitiated such as myself.

[RandyL]

Thanks so much caskin. Your kind words mean a lot to us and the donation too. The team works hard and is always polite. It's good to hear the thanks.

 

Please let us know how it finishes up caskin.

 

By the way might I ask what antivirus and firewall you are using.

 

RandyL

[AdvancedSetup]

Hello Caskin,

 

Can you please update us on your current status. From what I read it sounds like you did a system restore which should have removed any type of Malware or unwanted settings.

 

What issues are you currently experiencing so that we can best determine what assistance you need.

 

Thanks.