Application Failure OC79D5.EXE

[Frankster]

I am so sick of these errors.

I've got 4 XP SP2 workstations that intermittently produce errors like seen
below. The errors happened before and after SP2. Each of these machines
are 100 percent patched via the Microsoft update site. Every single update
applied successfully until there were no more updates (I get 0 updates
available in all three categories). I run an enterprise AV program that is
auto-updated daily with sig files (if/when available). Scanning the entire
disk turns up nothing noteworthy.

The offending program is always a combination of numbers and letters and
does not exist on my hard drive. I have also searched the registry for the
offending program, when it occurs, and cannot find it anywhere. Usually I
get, just as below, the first error logged during shutdown (normally never
displayed on the screen) and the next message during bootup asking if I
would like to send Microsoft this information about this previous error.

What the heck are these things? Whatever the error is, it seems not to be a
problem. Everything I'm aware of works as expected. Help!

I can say, that I upgraded 3 of the 4 of these XP machines from W2K to XP.
The 4th came with XP installed. None ever did this with W2K. They all do
it with XP? Help!

-Frank

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1004
Date: 10/27/2004
Time: 5:54:53 PM
User: N/A
Computer: KENO
Description:
Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4f 43 37 ure OC7
0018: 39 44 35 2e 45 58 45 20 9D5.EXE
0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0028: 69 6e 20 4f 43 37 39 44 in OC79D
0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 30 30 64 62 30 62 0000db0b

Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 10/27/2004
Time: 6:34:01 AM
User: N/A
Computer: KENO
Description:
Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 4f 43 37 ure OC7
0018: 39 44 35 2e 45 58 45 20 9D5.EXE
0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0028: 69 6e 20 4f 43 37 39 44 in OC79D
0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
0040: 20 6f 66 66 73 65 74 20 offset
0048: 30 30 30 30 64 62 30 62 0000db0b

 

[Frankster]

I should add, no, I have not clicked on the MS help link. Well, I have, but
it then tells me that it has to send this info to MS, I click no, and all
stops. If the answer is that I sould follow through and allow this info to
be sent to MS, I will. But geeze... this is so consistant I would expect
many others to have this problem too.

-Frank

 

[Dave Patrick]

Most likely spyware and or remnants thereof.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am so sick of these errors.
|
| I've got 4 XP SP2 workstations that intermittently produce errors like
seen
| below. The errors happened before and after SP2. Each of these machines
| are 100 percent patched via the Microsoft update site. Every single update
| applied successfully until there were no more updates (I get 0 updates
| available in all three categories). I run an enterprise AV program that
is
| auto-updated daily with sig files (if/when available). Scanning the
entire
| disk turns up nothing noteworthy.
|
| The offending program is always a combination of numbers and letters and
| does not exist on my hard drive. I have also searched the registry for
the
| offending program, when it occurs, and cannot find it anywhere. Usually I
| get, just as below, the first error logged during shutdown (normally never
| displayed on the screen) and the next message during bootup asking if I
| would like to send Microsoft this information about this previous error.
|
| What the heck are these things? Whatever the error is, it seems not to be
a
| problem. Everything I'm aware of works as expected. Help!
|
| I can say, that I upgraded 3 of the 4 of these XP machines from W2K to XP.
| The 4th came with XP installed. None ever did this with W2K. They all do
| it with XP? Help!
|
| -Frank
|
| Event Type: Error
| Event Source: Application Error
| Event Category: (100)
| Event ID: 1004
| Date: 10/27/2004
| Time: 5:54:53 PM
| User: N/A
| Computer: KENO
| Description:
| Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
| OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 41 70 70 6c 69 63 61 74 Applicat
| 0008: 69 6f 6e 20 46 61 69 6c ion Fail
| 0010: 75 72 65 20 20 4f 43 37 ure OC7
| 0018: 39 44 35 2e 45 58 45 20 9D5.EXE
| 0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
| 0028: 69 6e 20 4f 43 37 39 44 in OC79D
| 0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
| 0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
| 0040: 20 6f 66 66 73 65 74 20 offset
| 0048: 30 30 30 30 64 62 30 62 0000db0b
|
| Event Type: Error
| Event Source: Application Error
| Event Category: (100)
| Event ID: 1000
| Date: 10/27/2004
| Time: 6:34:01 AM
| User: N/A
| Computer: KENO
| Description:
| Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
| OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 41 70 70 6c 69 63 61 74 Applicat
| 0008: 69 6f 6e 20 46 61 69 6c ion Fail
| 0010: 75 72 65 20 20 4f 43 37 ure OC7
| 0018: 39 44 35 2e 45 58 45 20 9D5.EXE
| 0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
| 0028: 69 6e 20 4f 43 37 39 44 in OC79D
| 0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
| 0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
| 0040: 20 6f 66 66 73 65 74 20 offset
| 0048: 30 30 30 30 64 62 30 62 0000db0b
|
|
|
|

 

[Frankster]

I just ran Adaware with the latest sig file and did not find any apps like
this.

HOWEVER.... it now occurs to me that possibly my firewall is working I
have my network firewall (Winroute Firewall 6) set to block a number of
spyware sites. Mostly I got my info on which sites to block from Adaware.
Adaware finds one and I ad it to my Firewall blocking.

Hmm... could it be that when I hit one of these sites, although it runs the
code obtained from the foreign machine, since I requested it, it later
produces a failure error on my machine when it finds that it cannot connect
with it's home due to my firewall? I could see that I guess. Yes? No?

-Frank

Most likely spyware and or remnants thereof.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I am so sick of these errors.
|
| I've got 4 XP SP2 workstations that intermittently produce errors like
seen
| below. The errors happened before and after SP2. Each of these
machines
| are 100 percent patched via the Microsoft update site. Every single
update
| applied successfully until there were no more updates (I get 0 updates
| available in all three categories). I run an enterprise AV program that
is
| auto-updated daily with sig files (if/when available). Scanning the
entire
| disk turns up nothing noteworthy.
|
| The offending program is always a combination of numbers and letters and
| does not exist on my hard drive. I have also searched the registry for
the
| offending program, when it occurs, and cannot find it anywhere. Usually
I
| get, just as below, the first error logged during shutdown (normally
never
| displayed on the screen) and the next message during bootup asking if I
| would like to send Microsoft this information about this previous error.
|
| What the heck are these things? Whatever the error is, it seems not to
be
a
| problem. Everything I'm aware of works as expected. Help!
|
| I can say, that I upgraded 3 of the 4 of these XP machines from W2K to
XP.
| The 4th came with XP installed. None ever did this with W2K. They all
do
| it with XP? Help!
|
| -Frank
|
| Event Type: Error
| Event Source: Application Error
| Event Category: (100)
| Event ID: 1004
| Date: 10/27/2004
| Time: 5:54:53 PM
| User: N/A
| Computer: KENO
| Description:
| Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
| OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 41 70 70 6c 69 63 61 74 Applicat
| 0008: 69 6f 6e 20 46 61 69 6c ion Fail
| 0010: 75 72 65 20 20 4f 43 37 ure OC7
| 0018: 39 44 35 2e 45 58 45 20 9D5.EXE
| 0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
| 0028: 69 6e 20 4f 43 37 39 44 in OC79D
| 0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
| 0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
| 0040: 20 6f 66 66 73 65 74 20 offset
| 0048: 30 30 30 30 64 62 30 62 0000db0b
|
| Event Type: Error
| Event Source: Application Error
| Event Category: (100)
| Event ID: 1000
| Date: 10/27/2004
| Time: 6:34:01 AM
| User: N/A
| Computer: KENO
| Description:
| Faulting application OC79D5.EXE, version 0.0.0.0, faulting module
| OC79D5.EXE, version 0.0.0.0, fault address 0x0000db0b.
|
| For more information, see Help and Support Center at
| http://go.microsoft.com/fwlink/events.asp.
| Data:
| 0000: 41 70 70 6c 69 63 61 74 Applicat
| 0008: 69 6f 6e 20 46 61 69 6c ion Fail
| 0010: 75 72 65 20 20 4f 43 37 ure OC7
| 0018: 39 44 35 2e 45 58 45 20 9D5.EXE
| 0020: 30 2e 30 2e 30 2e 30 20 0.0.0.0
| 0028: 69 6e 20 4f 43 37 39 44 in OC79D
| 0030: 35 2e 45 58 45 20 30 2e 5.EXE 0.
| 0038: 30 2e 30 2e 30 20 61 74 0.0.0 at
| 0040: 20 6f 66 66 73 65 74 20 offset
| 0048: 30 30 30 30 64 62 30 62 0000db0b
|
|
|
|

 

[Dave Patrick]

Start|Run|msconfig and look at the startup, win.ini, system.ini and non MS
services for something suspicious.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I just ran Adaware with the latest sig file and did not find any apps like
| this.
|
| HOWEVER.... it now occurs to me that possibly my firewall is working I
| have my network firewall (Winroute Firewall 6) set to block a number of
| spyware sites. Mostly I got my info on which sites to block from Adaware.
| Adaware finds one and I ad it to my Firewall blocking.
|
| Hmm... could it be that when I hit one of these sites, although it runs
the
| code obtained from the foreign machine, since I requested it, it later
| produces a failure error on my machine when it finds that it cannot
connect
| with it's home due to my firewall? I could see that I guess. Yes? No?
|
| -Frank

 

[Andrew Morton]

I just ran Adaware with the latest sig file and did not find any apps
like this.

Try "Spybot Search & Destroy" too. Also, does your firewall generate a
log of denied access attempts?

Andrew

 

[hebe gebe]

I have the exact same issue and it seems to be occuring on fairly fresh
XP loads. Did you ever figure out what the culpret was? I've ran
Spybot\adaware, in house corporate virus scans as well as on-line virus
scans and I've come up with squat! Any help would be greatly
appreciated. Thanks

 

[dtm1tampa]

I too am having the same problem. I am running WinXP SP2 and Trend
Micro Office Scan client, I believe one or both of these to be the root
of the problem

 

[FLI-Tech]

We are running into the same problem on an assortment of computers
(Dell's and Toshiba's). We are running the trend micro office scan as
well with xp sp2. Has anyone come up with a solution for this?

Scott

 

[hebe gebe]

I too am having the same problem. I am running WinXP SP2 and Trend
Micro Office Scan client, I believe one or both of these to be the root
of the problem

We're using Trend Micro on Dell's too!!!!!!