User.exe error

Discussion in 'Malware Help (A Specialist Will Reply)' started by spooner, Mar 28, 2005.

  1. spooner

    spooner Private E-2

    Some forums indicate that its a spyware issue so Ill ask here.

    Upon shutdown only.

    Explorer has caused an error in user.exe.

    When I click on details I get:

    Explorer has caused a general protection fault.
    in module user.exe at 000C:00001f8e.

    Anyone run into this one. Ive ran all sorts of ad-aware and spybot scans.

    Although, havent yet posted a log from HiJackThis. Any suggestions on where to forward a log?

    Thanks
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Standard procedures before posting a HijackThis log must be followed. So if you believe this to be a malware issue, complete the steps below:

    To help us to best help you, please follow the steps below closely and in the order given and do not skip anything. If you have any difficulty, please post back letting us know what steps you have completed, what you found while doing the scans if anything along with details about any problems you may have encountered in completing the steps. The more details you can provide the better. Don't be afraid to ask for additional help if you don't understand something!

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
  3. spooner

    spooner Private E-2

    Ive posted a log already.

    Wondering about the user.exe error now.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You have not posted a HijackThis log on Majorgeeks!
     
  5. spooner

    spooner Private E-2

    Ill post it here now but Ill have to reload as its on desktop at this time.

    Where in the forum should I post this. Thanks.
     
  6. spooner

    spooner Private E-2

    Ok. Log submitted.
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    That's an outdated version of HijackThis and you never ran the steps from the READ ME FIRST sticky.

    However there is not much showing in your log.

    The only items I would fix in your log are below but I doubt these have anything to do with your problem.
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O15 - Trusted Zone: www.apple.com
    O15 - Trusted Zone: www.cibc.com
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18228d35ce619e9f1005/netzip/RdxIE601.cab
     
  8. spooner

    spooner Private E-2

    Alright, sorry guys for the confusion.

    Thought I read to post in a different at first.

    Downloaded the hijack this file sometime ago, however, downloaded and ran the file from the link provided and closed apps.

    Maybe not the notepad though.

    Any event, now what can I do to repair the items and identify where this error message is coming from.

    Thanks
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just run HijackThis and select the below lines and before click Fix make sure you exit your browser (including this one) first:
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O15 - Trusted Zone: www.apple.com
    O15 - Trusted Zone: www.cibc.com
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/18228d3...ip/RdxIE601.cab

    As far as user other problem with user.exe either the Software Forum or check the below out:
    http://www.generation.net/~hleboeuf/errexplo.htm

    Also, next time the error happens press Alt+D to bring up the Detailed Error Message. That will provide some more specific information about the error.

    Copy the first part of the Detailed Error Message, up to the word
    Registers:, and post that information into a message in the Software Forum. Someone there may be able to help.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds