|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
My son’s computer is giving us a “Data Execution Prevention” error whenever he invokes any kind of program that uses Windoze Explorer. This included file explorer, the control panel, and others. Updating Symantec did nothing to correct the problem. Does anybody out there have any suggestions?
TIA, Douglas
I agree with Al here. I always run Adaware and Spybot until they say I’m clean. Just to be sure. 
Have a look here to see if it sheads any light on the DEP error. It does sound as though something is trying to run Windows Explorer without the proper permissions.
Douglas,
I’m glad you clarified who the box belongs to. That explains alot and also gives us a bit more latitude with our handling of the situation. My experience is that 12 year olds don’t have much in the way of “critical” data to worry about. That’s not to say that I would not respect his data in my efforts. Just that I can be a bit less “sure” about something and know I’m not going to block access to the only copy of a doctoral thesis or irreplaceable family photographs. 
And if something were to happen ………… as you so wisely pointed out, you don’t recall learning anything from your parents lectures, but the experiences of life’s mistakes….. GREAT Teacher !!! We first need to get back control of the system. So if you are willing I’ll give it a shot and see if we can clean this up.
Run another HijackThis scan and this time when it finishes have it remove the following items …………
O2 – BHO: (no name) – {82948568-39AA-6E27-ABFD-6C134A8E66C3} – C:WINDOWSsystem32coygezhh.dll
O2 – BHO: (no name) – {83948568-39DE-1853-ABF3-6213308766CD} – C:WINDOWSsystem32coygezhh.dll
O2 – BHO: (no name) – {D6C7826D-3C8A-1504-AFF3-6213308767C4} – C:WINDOWSsystem32ejqssx.dll
O3 – Toolbar: (no name) – {014DA6C9-189F-421a-88CD-07CFE51CFF10} – (no file)
O4 – HKLM..Run: [Fqkjozs] C:Program FilesEhnkkdVgpn.exe
O4 – HKCU..Run: [Enae] C:Documents and SettingsLittle KahunaApplication Databaat.exe
O9 – Extra button: (no name) – {120E090D-9136-4b78-8258-F0B44B4BD2AC} – C:WINDOWSsystem32ms.exe (file missing)
O9 – Extra ‘Tools’ menuitem: MaxSpeed – {120E090D-9136-4b78-8258-F0B44B4BD2AC} – C:WINDOWSsystem32ms.exe (file missing)
Reboot the system and see how much, if any functionality you get back. Also be sure that the system is not connected to the internet (unplug the cable or phone line) while you are doing this. Then run another HijackThis scan and post the results as an attachment.
One last thing. Some of the things I checked out had to do with translation and looking at webpages in your “native” language. Any clue what that is all about ?? If it’s something particular to your situation I’ll avoid anything with a reference to that.
Douglas,
Glad to hear that you got back in. 
You didn’t say how much control you have over the machine so I’ll assume you can do most basic things. I would next recommend that you try to uninstall MyWebSearch from the machine. It is questionable as to the true nature of the program and whether or not it is spyware/adware, but it may be interfering with some things and is definitely not necessary. I found these instructions here. The last line I’d be suspicious of. Help from the people who are promoting the program?? 
See if this helps and then post back. Good Luck 
“First close all open browser windows. Then click ‘Start’ menu, then select ‘Control Panel’ and open the ‘Add/Remove Programs’ option. Find “My Search Bar” in the list of programs, and click ‘Change/Remove’ and follow the prompts to remove them. Other components to look for and remove are:
My Web Search (Smiley Central or FWP product as applicable)
My Way Speedbar (Smiley Central or other FWP as applicable)
My Way Speedbar (AOL and Yahoo Messengers) (beta users only)
My Way Speedbar (Outlook, Outlook Express, and IncrediMail)
Search Assistant – My Way
Fun Web Products Easy Installer
Reboot your PC to ensure the uninstall process is complete.
If required you can change your browser home page by clicking Tools > Internet Options on your browser.
This procedure should completely remove MySearch and MyWebSearch. If you do have any problems removing MyWebSearch/MySearch, NoAdware Customer Support is happy to personally assist any of its registered users to manually remove MyWebSearch or MySearch, if that’s what you want.”
Douglas,
I ran your second log through the HijackThis’ “auto check system” and it gave me these results ….
Remove These –
C:Program FilesViewpointViewpoint ManagerViewMgr.exe
Do you know this site? –> R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = file://C:WINDOWSsystem32SearchBar.htm
Do you know this site? –> R1 – HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page =
O4 – HKLM..Run: [BearShare] “C:Program FilesBearSharebearshare.exe” /pause
O4 – HKLM..Run: [ViewMgr] C:Program FilesViewpointViewpoint ManagerViewMgr.exe
O4 – HKCU..Run: [NCLAUNCH] C:WINDOWSNCLAUNCH.EXe
O23 – Service: WUSB54Gv4SVC – Unknown owner – C:Program FilesLinksys Wireless-G USB Wireless Network MonitorWLService.exe” “WUSB54Gv4.exe (file missing) <– Always Remove
O23 – Service: X10 Device Network Service (x10nets) – Unknown owner – C:PROGRA~1ATIMUL~1RemCtrlx10nets.exe (file missing) <– Always Remove
The bold text items were links in their report. The took you to information about the file or process. HTH 
Hi Douglas,
I checked that thread out and they were on track to get things straightened out for you. Unfortunately, your son has been mucking about with BearShare, a peer-to-peer file sharing program (I noticed it in the log you posted here too) and has downloaded a .zip file supposedly containing cracks for MS programs like Windows XP 2003, Office 11 and Longhorn Pro Professional Home Server Enterprise, but actually contains a Trojan Horse virus and is likely the source of most of your troubles.
As to his denials, I have to be very suspicious here, because the file was in two places when found by the Panda scan. On his desktop, and in the Shared folder that is part of BearShare, where only files that he, or someone who uses his computer and BearShare, are downloaded to.
The reason I say he knew is simple. The file was hidden on the desktop inside a file named Misc.zip where it must have been copied for easier access. The original .zip file is in the Shared folder (or was until Panda cleaned it). I’d bet that if you checked the properties of each file you’d find the file in the Shared folder was created first.
Here are the file paths from the log. Use Windows Explorer to check and see if the files are still there or if Panda removed them. If they’re still there, check the file properties.
C:Documents and SettingsLittle KahunaDesktopMisc.zip[Microsoft Product Activation Crack All Products Office 11 Windows Xp 2003 Longhorn Pro Professional Home Server Enterprise.zip][Microsoft Product Activation Crack All Products Office 11 Windows Xp 2003 and
C:Documents and SettingsLittle KahunaSharedMicrosoft Product Activation Crack All Products Office 11 Windows Xp 2003 Longhorn Pro Professional Home Server Enterprise.zip[Microsoft Product Activation Crack All Products Office 11 Windows Xp 2003 Longhorn Pr
Then ask your son what’s been going on and ask for a more plausable explaination from him than the one I just gave you.
I believe that your copy of Windows is legit and that your son has been playing Hacker with limited knowledge of how to do it. Good Luck with this increasingly sticky wicket !! Post back and let us know how you make out with your son and with GeeksToGo. If you PM Kat, the administrator, tell her of my / your suspicions and ask what to do to prove that your copy is legit they may understand and have mercy on you.
Hey Douglas !!
That’s great news !!! 
I’m glad you were able to get the help you needed. Those folks on those forums are very dedicated and do a super job when they finally are able to get to you. They are Soooo busy !!!
I think you’ll find the solution to your file permissions quandry here. The instructions for XP Home are about halfway down the page. You have to make the changes in Safe Mode HTH
Nope. I’m the confused one here. 
Let’s try this. Open My Computer and click Tools -> Folder Options. Select the View tab and under Advanced Settings scroll down and check
Thanks Dave. I was beginning to suspect that. Douglas is very competent and I just wanted to be sure he wasn’t simply “missing” something. Everything I’ve read tells me that the option is set by default in XP Home.
I was going to suggest that he setup his own account on the machine as an administrator and block acess to his profile. That way, he will always (almost) have unfettered access to the system and all of it’s settings and can’t be permissioned out by his son.
Editied by Doc to add … It would also allow him to backup his son’s data and then delete the boy’s profile and create a new profile for him and restore his data. He may lose some of his settings and have to do some tweaking, but it’s a small price to pay for what he put his dad through getting the system back in order for him. ‘Course, that’s just my 
.
Went there … did that. No Joy !!! Poked around a bit and think there may be an answer in How to take ownership of a file or folder in Windows XP.
[indent]
The folder icon next to Little Kahuna has a hand under the folder as if it was holding it
[/indent]If it looks like the attached icon, it means it’s a shared folder. I’ll wait on your reply before adding to the confusion. Joe’s suggestion is a particularly good idea. 
[indent]
Joe (how apt, that is my son’s name as well)
[/indent]You mean his name isn’t Kahuna !?!?!?? Glad you got it worked out. From what you said when you trashed his profile, I was concerned I’d be hearing about you on the 6:00 news.
The “brute force” copy should be the same as the copy command from the menu. Two roads to the same destination.
Douglas,
At this point, I’d cut my losses (even if they add to the kid’s losses) and see if you can recover any of his contacts from the address book . I’m afraid that it has become corrupt and this might prove difficult, if not impossible, to save. If you export it or back it up, and it’s corrupt, you will have a corrupt file to import or a corrupt backup. No good either way. And since you can’t open it, you can’t copy the contacts manually to a document you can save and use to copy back from.
What happens if you remove the JOEBERT from his address book file name ?? Wasn’t that added when you tried to “take control” of his profile earlier ?? Is his new profile just LittleKahuna or is the JOEBERT extension added to it ?? That coud be that cause of all this.
Are his contacts available in Thunderbird ?? Perhaps you could delete his .wab file and then import the contacts list from Thunderbird into a new, clean address book file for him.
Personally, I’d remove OE from his system and tell him to use Thunderbird for awhile. Then, at my leasure, I’d try to resolve his OE troubles. I’m pretty sure it’s got something to do with a corrupt address book. One last thing to try. Create a new folder in Local Folders & call it New Mail or something. Then try to copy the messages from the Inbox to this folder and open them there. This is just a shot-in-the-dark, so post back and let me know what happens.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
