6 replies to this topic

[Slick]

I few weeks ago I purchased and installed MBam v1.38 on a Vista 64 sp1 system. The next day I started getting "Windows Explorer has stopped working" errors, and the Desktop would go blank and then the icons would reappear. I can't say it was MBam but the timing is suspicious. I am also running NOD 4.0.437.0. I upgraded to MBam v1.39 but still have the issue so I've temporarily removed MBam to see if the issue still occurs. Too early to say yet. My system doesn't have a lot of software installed and it's clean of malware. I've decided to post some information just for the heck of it. Maybe it means something to you guys. I see nothing mentioning Mbam but again, the timing of the issue just seemed to occur the next day after installing MBam. Do you need any more info on my system configuration?


Event Viewer

Log Name: Application
Source: Application Error
Date: 7/22/2009 7:44:54 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: PC1-Vista64
Description:
Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e791, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791adec, exception code 0xc015000f, fault offset 0x000000000005fda9, process id 0x62c, application start time 0x01ca0b09ce0c28ba.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-07-22T23:44:54.000Z" />
<EventRecordID>802</EventRecordID>
<Channel>Application</Channel>
<Computer>PC1-Vista64</Computer>
<Security />
</System>
<EventData>
<Data>Explorer.EXE</Data>
<Data>6.0.6001.18164</Data>
<Data>4907e791</Data>
<Data>ntdll.dll</Data>
<Data>6.0.6001.18000</Data>
<Data>4791adec</Data>
<Data>c015000f</Data>
<Data>000000000005fda9</Data>
<Data>62c</Data>
<Data>01ca0b09ce0c28ba</Data>
</EventData>
</Event>

And from Vista's Problem reportss and Solutions page...

Problem signature
Problem Event Name: APPCRASH
Application Name: Explorer.EXE
Application Version: 6.0.6001.18164
Application Timestamp: 4907e791
Fault Module Name: ntdll.dll
Fault Module Version: 6.0.6001.18000
Fault Module Timestamp: 4791adec
Exception Code: c015000f
Exception Offset: 000000000005fda9
OS Version: 6.0.6001.2.1.0.256.1
Locale ID: 1033
Additional Information 1: e6be
Additional Information 2: 67f1b658acdbd9306bff030957c77dcd
Additional Information 3: b7df
Additional Information 4: e2e3fdc4c5a7f59c47a6ee41f1f3c0d7

Extra information about the problem
Bucket ID: 3117879


And the contents of Report.wer....

Version=1
EventType=APPCRASH
EventTime=128927798945935002
ReportType=2
Consent=1
UploadTime=128927798976375002
Response.BucketId=3117879
Response.BucketTable=4
Response.type=4
Sig[0].Name=Application Name
Sig[0].Value=Explorer.EXE
Sig[1].Name=Application Version
Sig[1].Value=6.0.6001.18164
Sig[2].Name=Application Timestamp
Sig[2].Value=4907e791
Sig[3].Name=Fault Module Name
Sig[3].Value=ntdll.dll
Sig[4].Name=Fault Module Version
Sig[4].Value=6.0.6001.18000
Sig[5].Name=Fault Module Timestamp
Sig[5].Value=4791adec
Sig[6].Name=Exception Code
Sig[6].Value=c015000f
Sig[7].Name=Exception Offset
Sig[7].Value=000000000005fda9
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=6.0.6001.2.1.0.256.1
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
DynamicSig[22].Name=Additional Information 1
DynamicSig[22].Value=e6be
DynamicSig[23].Name=Additional Information 2
DynamicSig[23].Value=67f1b658acdbd9306bff030957c77dcd
DynamicSig[24].Name=Additional Information 3
DynamicSig[24].Value=b7df
DynamicSig[25].Name=Additional Information 4
DynamicSig[25].Value=e2e3fdc4c5a7f59c47a6ee41f1f3c0d7
UI[2]=C:\Windows\Explorer.EXE
UI[3]=Windows Explorer has stopped working
UI[4]=Windows can check online for a solution to the problem and try to restart the program.
UI[5]=Check online for a solution and restart the program
UI[6]=Check online for a solution later and close the program
UI[7]=Close the program
State[0].Key=Transport.DoneStage1
State[0].Value=1
FriendlyEventName=Stopped working
ConsentKey=APPCRASH
AppName=Windows Explorer
AppPath=C:\Windows\Explorer.EXE

[Slick]

I meant to say I'm running NOD32. Sorry!

[yardbird]

Welcome to the forum Post your log in the HJK forum, please... see no. 1 & 2 below and read the rest...

Scan and post logs - read note at bottom in green
If you're having Malware related issues with your computer that you're unable to resolve.

• Please read and follow the instructions provided here: I'm infected - What do I do now?
  
• If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
  
• When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.

[Slick]

Neither one below applies. Where do I post when the issue is likely an MBam issue?

# Please read and follow the instructions provided here: I'm infected - What do I do now?
# If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs

[yardbird]

Slick all the instructions are above: I'll post them below:

Read number #1 and number # 2 will tell you where to post, which is the HiJack Log Forum
and read the rest please...



Scan and post logs - read note at bottom in green
If you're having Malware related issues with your computer that you're unable to resolve.

• Please read and follow the instructions provided here: I'm infected - What do I do now?
  
• If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
  
• When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.

• Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  
• Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  
• Using these other tools often makes the cleanup task more difficult and time consuming.
  
• If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  
• Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  
• There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review

• NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.

[Slick]

I read them. They do not apply. I'm not going to pursue this further. I don't have the issue with MBam removed and I'm going to leave it that way.

[AdvancedSetup]

Sorry for the issues. Every system is different to be sure, but often many share the same or similar issues. Some users have reported issues with NOD32 blocking or freezing the system when MBAM is installed and the Protection Module enabled.

If you like we can attempt to track down where the conflict may reside and assist you in correcting it. If you have the paid version you can also send an email to the helpdesk@malwarebytes.org and they can assist you in working on fixing it. However we don't like to work on such issues in the General forum because many other users can and do often reply in the forum and it just makes the job more difficult to work on.