Forum - DLL-files.com

Steve wrote:
> Explorer is locking up every time I try to delete a folder or try to open the
> properties. Then writes a DrWtsn32.log and tries to send a report off but
> stops shorts. Everything appears to be working and all my applications
> appear to be working fine. I'm using Norton 360, WinXP Professional. I have
> virus scanned and run Registry Mechanic in hpoes it wouls resolve it. I have
> no idea where else to check the problem. Would appreciate some guidance...
> The below is the DrWtsn32.log, I have shorten it but can sent the whole file
> if helpful. Steve
>
> Microsoft (R) DrWtsn32
> Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
>
>
>
> Application exception occurred:
> App: C:\WINNT\explorer.exe (pid=1244)
> When: 3/28/2009 @ 20:03:42.041
> Exception number: c0000005 (access violation)
>
> *----> System Information <----*
> Computer Name: CJ976820-A
> User Name: Stephen Rice
> Terminal Session Id: 0
> Number of Processors: 1
> Processor Type: x86 Family 6 Model 4 Stepping 4
> Windows Version: 5.1
> Current Build: 2600
> Service Pack: 3
> Current Type: Uniprocessor Free
> Registered Organization:
> Registered Owner: Steve
>
> *----> Task List <----*
> 0 System Process
> 4 System
> 488 smss.exe
> 540 csrss.exe
> 564 winlogon.exe
> 608 services.exe
> 628 lsass.exe
> 796 svchost.exe
> 844 svchost.exe
> 912 svchost.exe
> 1104 svchost.exe
> 1232 svchost.exe
> 1336 spoolsv.exe
> 1752 type32.exe
> 1816 ctfmon.exe
> 1824 RUNDLL32.EXE
> 1852 ImgIcon.exe
> 1880 point32.exe
> 1912 rundll32.exe
> 1932 RoxWatchTray9.exe
> 1992 ISUSPM.exe
> 2040 bagent.exe
> 172 ATKKBService.exe
> 236 svchost.exe
> 364 IntuitUpdateService.exe
> 416 jqs.exe
> 476 mdm.exe
> 900 ccSvcHst.exe
> 2480 svchost.exe
> 2512 uphclean.exe
> 2632 ccSvcHst.exe
> 2648 ViewpointService.exe
> 2672 svchost.exe
> 2716 dmadmin.exe
> 388 RoxMediaDB9.exe
> 264 alg.exe
> 2280 RoxWatch9.exe
> 2364 CPSHelpRunner.exe
> 1244 explorer.exe
> 3136 drwtsn32.exe
>
> *----> Module List <----*
> (0000000000400000 - 0000000000409000: C:\WINNT\system32\normaliz.dll
> (0000000000d10000 - 0000000000d4d000: C:\WINNT\system32\webcheck.dll
> (0000000001000000 - 00000000010ff000: C:\WINNT\explorer.exe
> (0000000001440000 - 0000000001705000: C:\WINNT\system32\xpsp2res.dll
> (0000000001d70000 - 0000000001d7e000: C:\WINNT\system32\eappprxy.dll
> (0000000002000000 - 0000000002a91000: C:\WINNT\system32\ieframe.dll
> (0000000002c50000 - 0000000002c78000: C:\WINNT\system32\OneX.DLL
> (0000000003260000 - 0000000003289000: C:\WINNT\system32\msls31.dll
> (0000000004390000 - 00000000043eb000: C:\Program Files\Common
> Files\Microsoft Shared\INK\SKCHUI.DLL
> (0000000004b70000 - 0000000004b7f000: C:\Program
> Files\Ontrack\ZipMagic\ZMCopy.dll
> (0000000008d40000 - 0000000008e10000: C:\WINNT\system32\chkidgif.dll
> (00000000090a0000 - 00000000091d5000: C:\WINNT\system32\ipxascal.dll
> (0000000009b50000 - 0000000009bab000: C:\Program Files\Common
> Files\Adobe\Acrobat\ActiveX\PDFShell.dll
> (0000000009bb0000 - 0000000009be6000: C:\Program
> Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
> (000000000a470000 - 000000000a487000: C:\WINNT\system32\odbcint.dll
> (000000000aef0000 - 000000000af4e000: C:\WINNT\system32\mataldsk.dll
>
> -- Removes to shorten --
>
> *----> State Dump for Thread Id 0x4c0 <----*
>
> eax=00000001 ebx=00000003 ecx=03430288 edx=00002013 esi=01ecc5d8 edi=00000000
> eip=7c90e4f4 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
>
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> C:\WINNT\system32\ntdll.dll -
> function: ntdll!KiFastSystemCallRet
> 7c90e4da e829000000 call ntdll!RtlRaiseException (7c90e508)
> 7c90e4df 8b0424 mov eax,[esp]
> 7c90e4e2 8be5 mov esp,ebp
> 7c90e4e4 5d pop ebp
> 7c90e4e5 c3 ret
> 7c90e4e6 8da42400000000 lea esp,[esp]
> 7c90e4ed 8d4900 lea ecx,[ecx]
> ntdll!KiFastSystemCall:
> 7c90e4f0 8bd4 mov edx,esp
> 7c90e4f2 0f34 sysenter
> ntdll!KiFastSystemCallRet:
> 7c90e4f4 c3 ret
> 7c90e4f5 8da42400000000 lea esp,[esp]
> 7c90e4fc 8d642400 lea esp,[esp]
> ntdll!KiIntSystemCall:
> 7c90e500 8d542408 lea edx,[esp+0x8]
> 7c90e504 cd2e int 2e
> 7c90e506 c3 ret
> 7c90e507 90 nop
> ntdll!RtlRaiseException:
> 7c90e508 55 push ebp
> 7c90e509 8bec mov ebp,esp
>
> *----> Stack Back Trace <----*
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> C:\WINNT\system32\SHELL32.dll -
> WARNING: Stack unwind information not available. Following frames may be
> wrong.
> *** ERROR: Module load completed but symbols could not be loaded for
> C:\WINNT\explorer.exe
> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
> C:\WINNT\system32\kernel32.dll -
> ChildEBP RetAddr Args to Child
>
> -- And on and on it goes.....

What file are you trying to delete or access?

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm

Steve - Dr Watson is not intended for "local" diagnosis - the file is for
interepation by Microsoft support - "Symbols" provide support personnel with
information regarding the file. Diagnosis procedures and symbol tables can
be downloaded (usually from the MSDN or TechNet sites) however expertise is
required.

Failure of Explorer.exe (Windows Explorer) is often due to malware.

Steve wrote:
> Empty folders in Local Disk (C:) drive. Really the're subdirectories of the
> "C" drive. Windows likes to call them folders. I can delete individual
> files without a problem but not the folders themselves. When I open "My
> Computer" and right click on the drive, I get the "Windows Explorer has
> encountered a problem and needs to close."
> The event Viewer shows:
> Faulting application explorer.exe, version 6.0.2900.5512, faulting module ,
> version 0.0.0.0, fault address 0x00000000.
> 0000: 41 70 70 6c 69 63 61 74 Applicat
> 0008: 69 6f 6e 20 46 61 69 6c ion Fail
> 0010: 75 72 65 20 20 65 78 70 ure exp
> 0018: 6c 6f 72 65 72 2e 65 78 lorer.ex
> 0020: 65 20 36 2e 30 2e 32 39 e 6.0.29
> 0028: 30 30 2e 35 35 31 32 20 00.5512
> 0030: 69 6e 20 20 30 2e 30 2e in 0.0.
> 0038: 30 2e 30 20 61 74 20 6f 0.0 at o
> 0040: 66 66 73 65 74 20 30 30 ffset 00
> 0048: 30 30 30 30 30 30 0d 0a 000000..
> Steve
>
> "Lem" wrote:
>
>> Steve wrote:
>>> Explorer is locking up every time I try to delete a folder or try to open the
>>> properties. Then writes a DrWtsn32.log and tries to send a report off but
>>> stops shorts. Everything appears to be working and all my applications
>>> appear to be working fine. I'm using Norton 360, WinXP Professional. I have
>>> virus scanned and run Registry Mechanic in hpoes it wouls resolve it. I have
>>> no idea where else to check the problem. Would appreciate some guidance...
>>> The below is the DrWtsn32.log, I have shorten it but can sent the whole file
>>> if helpful. Steve
>>>
>>> Microsoft (R) DrWtsn32
>>> Copyright (C) 1985-2001 Microsoft Corp. All rights reserved.
>>>
>>>
>>>
>>> Application exception occurred:
>>> App: C:\WINNT\explorer.exe (pid=1244)
>>> When: 3/28/2009 @ 20:03:42.041
>>> Exception number: c0000005 (access violation)
>>>
>>> *----> System Information <----*
>>> Computer Name: CJ976820-A
>>> User Name: Stephen Rice
>>> Terminal Session Id: 0
>>> Number of Processors: 1
>>> Processor Type: x86 Family 6 Model 4 Stepping 4
>>> Windows Version: 5.1
>>> Current Build: 2600
>>> Service Pack: 3
>>> Current Type: Uniprocessor Free
>>> Registered Organization:
>>> Registered Owner: Steve
>>>
>>> *----> Task List <----*
>>> 0 System Process
>>> 4 System
>>> 488 smss.exe
>>> 540 csrss.exe
>>> 564 winlogon.exe
>>> 608 services.exe
>>> 628 lsass.exe
>>> 796 svchost.exe
>>> 844 svchost.exe
>>> 912 svchost.exe
>>> 1104 svchost.exe
>>> 1232 svchost.exe
>>> 1336 spoolsv.exe
>>> 1752 type32.exe
>>> 1816 ctfmon.exe
>>> 1824 RUNDLL32.EXE
>>> 1852 ImgIcon.exe
>>> 1880 point32.exe
>>> 1912 rundll32.exe
>>> 1932 RoxWatchTray9.exe
>>> 1992 ISUSPM.exe
>>> 2040 bagent.exe
>>> 172 ATKKBService.exe
>>> 236 svchost.exe
>>> 364 IntuitUpdateService.exe
>>> 416 jqs.exe
>>> 476 mdm.exe
>>> 900 ccSvcHst.exe
>>> 2480 svchost.exe
>>> 2512 uphclean.exe
>>> 2632 ccSvcHst.exe
>>> 2648 ViewpointService.exe
>>> 2672 svchost.exe
>>> 2716 dmadmin.exe
>>> 388 RoxMediaDB9.exe
>>> 264 alg.exe
>>> 2280 RoxWatch9.exe
>>> 2364 CPSHelpRunner.exe
>>> 1244 explorer.exe
>>> 3136 drwtsn32.exe
>>>
>>> *----> Module List <----*
>>> (0000000000400000 - 0000000000409000: C:\WINNT\system32\normaliz.dll
>>> (0000000000d10000 - 0000000000d4d000: C:\WINNT\system32\webcheck.dll
>>> (0000000001000000 - 00000000010ff000: C:\WINNT\explorer.exe
>>> (0000000001440000 - 0000000001705000: C:\WINNT\system32\xpsp2res.dll
>>> (0000000001d70000 - 0000000001d7e000: C:\WINNT\system32\eappprxy.dll
>>> (0000000002000000 - 0000000002a91000: C:\WINNT\system32\ieframe.dll
>>> (0000000002c50000 - 0000000002c78000: C:\WINNT\system32\OneX.DLL
>>> (0000000003260000 - 0000000003289000: C:\WINNT\system32\msls31.dll
>>> (0000000004390000 - 00000000043eb000: C:\Program Files\Common
>>> Files\Microsoft Shared\INK\SKCHUI.DLL
>>> (0000000004b70000 - 0000000004b7f000: C:\Program
>>> Files\Ontrack\ZipMagic\ZMCopy.dll
>>> (0000000008d40000 - 0000000008e10000: C:\WINNT\system32\chkidgif.dll
>>> (00000000090a0000 - 00000000091d5000: C:\WINNT\system32\ipxascal.dll
>>> (0000000009b50000 - 0000000009bab000: C:\Program Files\Common
>>> Files\Adobe\Acrobat\ActiveX\PDFShell.dll
>>> (0000000009bb0000 - 0000000009be6000: C:\Program
>>> Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
>>> (000000000a470000 - 000000000a487000: C:\WINNT\system32\odbcint.dll
>>> (000000000aef0000 - 000000000af4e000: C:\WINNT\system32\mataldsk.dll
>>>
>>> -- Removes to shorten --
>>>
>>> *----> State Dump for Thread Id 0x4c0 <----*
>>>
>>> eax=00000001 ebx=00000003 ecx=03430288 edx=00002013 esi=01ecc5d8 edi=00000000
>>> eip=7c90e4f4 esp=0007fef0 ebp=0007ff08 iopl=0 nv up ei pl nz na pe nc
>>> cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
>>>
>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
>>> C:\WINNT\system32\ntdll.dll -
>>> function: ntdll!KiFastSystemCallRet
>>> 7c90e4da e829000000 call ntdll!RtlRaiseException (7c90e508)
>>> 7c90e4df 8b0424 mov eax,[esp]
>>> 7c90e4e2 8be5 mov esp,ebp
>>> 7c90e4e4 5d pop ebp
>>> 7c90e4e5 c3 ret
>>> 7c90e4e6 8da42400000000 lea esp,[esp]
>>> 7c90e4ed 8d4900 lea ecx,[ecx]
>>> ntdll!KiFastSystemCall:
>>> 7c90e4f0 8bd4 mov edx,esp
>>> 7c90e4f2 0f34 sysenter
>>> ntdll!KiFastSystemCallRet:
>>> 7c90e4f4 c3 ret
>>> 7c90e4f5 8da42400000000 lea esp,[esp]
>>> 7c90e4fc 8d642400 lea esp,[esp]
>>> ntdll!KiIntSystemCall:
>>> 7c90e500 8d542408 lea edx,[esp+0x8]
>>> 7c90e504 cd2e int 2e
>>> 7c90e506 c3 ret
>>> 7c90e507 90 nop
>>> ntdll!RtlRaiseException:
>>> 7c90e508 55 push ebp
>>> 7c90e509 8bec mov ebp,esp
>>>
>>> *----> Stack Back Trace <----*
>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
>>> C:\WINNT\system32\SHELL32.dll -
>>> WARNING: Stack unwind information not available. Following frames may be
>>> wrong.
>>> *** ERROR: Module load completed but symbols could not be loaded for
>>> C:\WINNT\explorer.exe
>>> *** ERROR: Symbol file could not be found. Defaulted to export symbols for
>>> C:\WINNT\system32\kernel32.dll -
>>> ChildEBP RetAddr Args to Child
>>>
>>> -- And on and on it goes.....
>> What file are you trying to delete or access?
>>
>> --
>> Lem -- MS-MVP
>>
>> To the moon and back with 2K words of RAM and 36K words of ROM.
>> http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
>> http://history.nasa.gov/afj/compessay.htm
>>

Even empty folders (or subdirectories) have names ...

Your use of "Registry Mechanic" may have caused or exacerbated the
problem. "If you think your Registry needs to be 'cleaned' or
'repaired,' read http://aumha.net/viewtopic.php?t=28099 and draw your
own conclusions."

You could try disabling Roxio Media Manager from scanning files; or
running MalwareBytes AntiMalware from http://malwarebytes.org/
but you also might follow this advice from MVP PA Bear:

*****************************************
1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwa ... fault.mspx

2. Run the Windows Live Safety Center's 'Protection' scan (only!) in
Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the
requested logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/pag ... ng_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachines ... board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://aumha.net/viewforum.php?f=30, or other appropriate forums.**

If the procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

--
Lem -- MS-MVP

To the moon and back with 2K words of RAM and 36K words of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer
http://history.nasa.gov/afj/compessay.htm