Tech Support Guy banner
  • Please post in our Community Feedback thread for help with the new forum software! If you are having trouble logging in, please Contact Us for assistance.
Not open for further replies.
1 - 1 of 1 Posts

1 Posts
Discussion Starter · #1 ·
Since a couple of months, I started having problems with folders containing JPG files: Sometimes (not always, I have still not been able to figure out a pattern to when this happens...) when I am trying to open a folder which contains JPG files, the program (for example Windows Explorer, Internet Explorer, Adobe Photoshop, etc) that I am using simply crashes, leaving me with an error message saying something like "explorer.exe has encountered an error and will shut down". Note that this message is the same no matter which program I am browsing folder with. In other words, it seems as if for example Adobe Photoshop is using some kind of file browsing functionality from Windows Explorer which is malfunctioning.

Some observations:
- Crashing *seems* to occur more frquently when I try to open folders which contain a larger numer of JPG files (e.g., 5 or more).
- Crashing *seems* to occur more frequently (although not exclusively, I think) when I am using a file browser function which displays small thumbnails of the files in a folder.

I am running F-secure Internet Security package, and have searched the computer for viruses, without finding any. I have tried the AdAware spyware finder (which did find 76 suspicious entries (severity level Low and Medium, but removing them didn't help at all..)

I am enclosing below both the event log and the log from HijackThis, in case that would shed any light on this dilemma:

This is how my event log looks when I experience these crashes:

Typ Datum Tid Källa Kategori Händelse Användare Da tor
Information 2004-04-01 22:47:25 Winlogon Ingen 1002 Saknas JONTESDATOR
Fel 2004-04-01 22:44:51 Application Error Ingen 1000 Saknas JONTESDATOR
Information 2004-04-01 22:42:14 Winlogon Ingen 1002 Saknas JONTESDATOR
Fel 2004-04-01 22:42:05 Application Error Ingen 1000 Saknas JONTESDATOR
Information 2004-04-01 22:21:48 fsbwsys Ingen 105 Saknas JONTESDATOR
Information 2004-04-01 22:21:48 BackWeb Client - 4476822 Ingen 2 Saknas JONTESDATOR
Information 2004-03-31 23:41:25 Winlogon Ingen 1002 Saknas JONTESDATOR
Fel 2004-03-31 23:41:17 Application Error Ingen 1001 Saknas JONTESDATOR
Fel 2004-03-31 23:40:17 Application Error Ingen 1000 Saknas JONTESDATOR
Information 2004-03-31 20:49:23 fsbwsys Ingen 105 Saknas JONTESDATOR
Information 2004-03-31 20:49:23 BackWeb Client - 4476822 Ingen 2 Saknas JONTESDATOR
Information 2004-03-30 22:13:28 Winlogon Ingen 1002 Saknas JONTESDATOR
Fel 2004-03-30 22:13:26 Application Hang (101) 1002 Saknas JONTESDATOR
Fel 2004-03-30 18:08:43 Application Error Ingen 1000 Saknas JONTESDATOR
Information 2004-03-30 17:49:58 fsbwsys Ingen 105 Saknas JONTESDATOR
Information 2004-03-30 17:49:58 BackWeb Client - 4476822 Ingen 2 Saknas JONTESDATOR

Sorry for this log being in Swedish... The word "Fel" means "Error" and as you can see for example at 22:44:51 at 2004-04-01 the crash is an application error with event type 1000. If I right click this entry to get more info, it says:

"Felaktigt program explorer.exe, version 6.0.2800.1221, felaktig modul ntdll.dll, version 5.1.2600.1217, felaktig adress 0x000080db.", which means:
"Erroneous program explorer.exe, version 6.0.2800.1221, erroeous module ntdll.dll, version 5.1.2600.1217, erroneous adress 0x000080db."

Does this give any clues?.. Another thing I do note in the event log is the presence of something called "BackWeb Client - 4476822".. Now, in my ears, that doesn't sound too good. Sounds like some spyware, or?

My Hijackthis log looks like this:

Logfile of HijackThis v1.97.7
Scan saved at 23:46:40, on 2004-04-01
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program\F-Secure Internet Security\Common\FSM32.EXE
C:\Program\Delade filer\Real\Update_OB\realsched.exe
C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
C:\Program\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program\F-Secure Internet Security\backweb\4476822\Program\BackWeb-4476822.exe
C:\Program\F-Secure Internet Security\Common\FCH32.EXE
C:\Program\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Documents and Settings\Jonas Vestlund\Skrivbord\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [ZGCleanTemp] zg.exe -cleantemp
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\Program\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ServUTrayIcon] C:\Program\FTPSER~1\SERVUT~1.EXE
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page - res://C:\Program\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) -
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

Extremely greatful for any help!! :) /Jonas from Stockholm, Sweden
1 - 1 of 1 Posts
Not open for further replies.