Exploere.exe - Application Error 1

[bobo0605]

Hi!

I'm working on a windows xp pro machine that had a ton of spyware, trojans, and virus on it. I ran multiple spyware programs ( Spysweeper, Adaware, Spybot, Hijackthis, and microsofts antispyware program). I also ran AVG virus scanner. I'm not receiving any hit with spyware or viruses anymore. But after I deleted all the infection i'm gettign this error when I try to open things like My Computer, Control Panel. The error is " Explorer.exe - Application Error. The instructions at "0x0198d065" referenced at "0x00000000". The memory could not be written." Now if I look in the event viewer there an application error. The error is " Event 1000 Faulting Application DRWTSN32.exe, version 5.1.2600.0, FAulting module dbgkelp.dll. version 5.1.2600.2800, FAulot address 0x0001295." I tried to repair the OS but that didn't work, also if i boot into Safe Mode I have no problems with this explorer problem. Any help or ideas here would be appreciated!!

 

[bcastner]

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/dbghelp_versions.asp

To turn off the Dr Watson debugger, apply the following Windows NT / Windows 2000 / Windows XP registry change, by doing Start, Run, regedit and navigatating to this key:

Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug
Name: Auto
Type: REG_DWORD
Value: 0 disable <==== set the value to 0
Value: 1 enable

To re-enable Dr Watson, you can change Auto back to 1 or from the command line type drwtsn -i.

 

[Frank4d]

If you are having this problem when right clicking, Spysweeper may be the cuplrit. Start up Spysweeper and in Options, uncheck the "Add to Windows Context Menu" box.

 

[bobo0605]

I disabled Dr. Watson and changed spysweeper but still having the same problem!!

 

[bobw]

A utility in Windows I have used quite often is "sfc", better know from Windows 98 days as "System File Checker" - it's in W2k and XP, but you need to run it from a command line. I usually use the /scannow option and get good results. It should restore any protected windows files to their original - you will need the disk for your version of windows. I hope this helps.
Bob W

 

[LloydSev]

Yay! Spyware! So you did a repair? I would search the registry for anything pertaining to "explore.exe" and see if any of the keys have other executable filenames attached to it.

Computer/Network Technician
CCNA

 

[bobo0605]

The problem was solved!! I deleted dlder.exe from the registry and it solved the problem. Thanks for all you help!!!

 

[kevinmt]

i have the exact same problem with explore.exe as you described in feb 7 post. really a pain i can't get to any 'explore' related functions such as just looking at files/folders, recyle bin, search, nothing. i didn't quite understand the thread. what should i do step by step to recover this. also, ie is corrupted with the 'about:blank" home address virus. i can't find the file you mentioned that you deleted.

 

[brianck04]

I too am having the same problem. I'm working on a Dell D600 laptop with XP Pro on it. I've run Microsoft's Antispyware, Spybot S&D, Hijack This, and the SAV definitions are up-to-date. I'm still getting the explorer.exe The memory couldn't be "written" error message. The Hijack This log looks ok. I've double checked any that I questioned. There was one called sdksq32.exe that lead to a TrojanDownloader.Win32.Agent.ap article by CA but I clicked to Fix It, so I'm confused as to why I'm still having a problem. I also looked for dlder.exe in the registry and couldn't find it.

 

[bcastner]

http://support.microsoft.com/?kbid=883791

 

[brianck04]

That kb article says to start here but I don't even have the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

There's no Explorer key under Policies.

 

[brianck04]

The specific error message I'm getting is:
-----------------------------------------------------
Explorer.EXE - Application Error

The instruction at "0x024a0065" referenced memory at "0x00000000". The memory could not be "written".

Click OK to terminate the program
Click on CANCEL to debug the program
------------------------------------------------------

The first 0x024....... number changes randomly.

 

[bcastner]

The memory address information will not help you. What is important is that something tried to address memory at location "0x00000000", which does not exist.

If you do not have the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer

You may not have Service Pack 2 installed, or your installation was not complete and without error. Remove Service Pack 2 if this is the case:

http://support.microsoft.com/?id=875350

 

[brianck04]

Ok, I checked and it shows that SP2 is installed so I'll remove it. Unfortunately, this is on a Navy site and will need to have SP2 on it eventually. Do you recommend that I simply re-install SP2? I have it on CD from MSDN so I can try using that method.

 

[bcastner]

I am not suggesting you never use SP2, only that if that registry key was there the installation originally of SP2 was done to completion and without errors.

There are a lot of half-SP2 installs that have occured. The Microsoft advice is to remove the install, reboot, and reinstall preferably using the CD Rom image and not Windows Update or a saved download.

 

[brianck04]

Ok, thanks for your help. I removed SP2 and the problem went away. I'm going to try installing off of the CD and see how it goes. That's interesting to know that SP2 caused this issue and there was no other indication that it was the culprit. The user made it sound like the upgrade to SP2 was done days ago and then all of a sudden this issue arose. Thanks again.

 

[bcastner]

It is a funny error, fairly rare, and can be handled if the SP2 registry entries are fully populated. If the registry entry is missing (

http://support.microsoft.com/?kbid=883791)

then you would consistently return a logical zero, which is the opposite of the post-Hotfix desired state.

 

[brianck04]

After removing SP2 it worked well. I re-installed SP2 from the MSDN-provided CD and the problem is back. That kb article only addresses the issue if you've got that specific reg key in there, so I'm not sure what to do. I'll have to leave it with SP2 not on there so that at least it's functional.

 

[bcastner]

Try a different CD image.
This has occured in my experience from a download of the "Network Install" version, rather than a "real" CD.

Microsoft ships these fairly quickly:

http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx

Or you can without licensing or EULA concerns borrow one from somebody else.

If this is the image you are using, please follow carefully the malware removal steps in faq608-4650

 

[kevinmt]

does it matter that i've been using sp2 for at least a couple of months now? my problem originated with a virus then all of sudden i started having the explore.exe problem. i downloaded the sp2 from microsoft and everything seemed to work fine. should i still uninstall sp2 and, if so, is there a one method better than another on the link you provided from microsoft?