closing IE - error pops up

[Guest]

Everytime one of my users exits IE, an error message pops up......Originally,
it was "The instruction at '0x01a7494e' referenced memory at '0x0000047f'.
The memory could not be read. Click on OK to terminate this program."

Frank Saunders, MS-MVP, IE/OE then suggested that all spyware software be
removed. I have run both AdAware and SpyBot, and have cleared up anything
that showed....rebooted...ran again....nothing. I've tried to find my
original post...unsuccessfully.

The user is now getting a similar message but with different numbers: "The
instruction at '0x02463795' referenced memory at '0x01edead58'. The memory
could not be read. Click on OK to terminate this program."

Any other ideas?

 

[Don Varnau]

Hi,
I can't find the original post. Which version of Windows?

But, jumping ahead, a legitimate program could be causing this. Try
disabling toolbars, ad-blockers, security/privacy programs, etc. Look at any
program that hooks into IE. If running Windows XP, turn on the Windows
Firewall before disabling a third-party firewall.

Don
[MS MVP- IE]

 

[Frank Saunders, MS-MVP OE]

Everytime one of my users exits IE, an error message pops
up......Originally, it was "The instruction at '0x01a7494e'
referenced memory at '0x0000047f'. The memory could not be read.
Click on OK to terminate this program."

Frank Saunders, MS-MVP, IE/OE then suggested that all spyware
software be removed. I have run both AdAware and SpyBot, and have
cleared up anything that showed....rebooted...ran again....nothing.
I've tried to find my original post...unsuccessfully.

The user is now getting a similar message but with different numbers:
"The instruction at '0x02463795' referenced memory at '0x01edead58'.
The memory could not be read. Click on OK to terminate this program."

Any other ideas?

Where did you post your HijackThis log?
Can you supply a link?

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

Hi Don,
I spent the better part of an hour trying to find my original post...and
then gave up. It was back during the summer months (I've just got around to
trying things - summer holidays were interrupting things).... The user is
running Windows XP SP2.
--
Thanks,
Diane

Hi,
I can't find the original post. Which version of Windows?

But, jumping ahead, a legitimate program could be causing this. Try
disabling toolbars, ad-blockers, security/privacy programs, etc. Look at any
program that hooks into IE. If running Windows XP, turn on the Windows
Firewall before disabling a third-party firewall.

Don
[MS MVP- IE]

Everytime one of my users exits IE, an error message pops up......Originally,
it was "The instruction at '0x01a7494e' referenced memory at '0x0000047f'.
The memory could not be read. Click on OK to terminate this program."

Frank Saunders, MS-MVP, IE/OE then suggested that all spyware software be
removed. I have run both AdAware and SpyBot, and have cleared up anything
that showed....rebooted...ran again....nothing. I've tried to find my
original post...unsuccessfully.

The user is now getting a similar message but with different numbers: "The
instruction at '0x02463795' referenced memory at '0x01edead58'. The memory
could not be read. Click on OK to terminate this program."

Any other ideas?

Thanks,
Diane

 

[Guest]

Hi Frank,
I'm sorry, I missed your instructions on posting the log somewhere, so I
unfortunately didn't do that. The user is in a different location than where
I am, and I'm not due back there for another two weeks. Would those logs
still be saved on the computer somewhere? I can pull them off when I'm there
next time.

 

[Frank Saunders, MS-MVP OE]

Hi Frank,
I'm sorry, I missed your instructions on posting the log somewhere,
so I unfortunately didn't do that. The user is in a different
location than where I am, and I'm not due back there for another two
weeks. Would those logs still be saved on the computer somewhere? I
can pull them off when I'm there next time.

If the HijackThis log was saved, the user told it where to save the log.

Go to: http://mvps.org/winhelp2002/unwanted.htm
Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://aumha.net/viewforum.php?f=30 for expert analysis, not here.

Sign in, go to the "Malware Removal" section.
Press "New Topic" and post a description of your symptoms. If they need to
see your log they will ask for it.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Guest]

I'll try this the next time I'm out at the user's workstation.
--
Thanks,
Diane

Hi Frank,
I'm sorry, I missed your instructions on posting the log somewhere,
so I unfortunately didn't do that. The user is in a different
location than where I am, and I'm not due back there for another two
weeks. Would those logs still be saved on the computer somewhere? I
can pull them off when I'm there next time.

If the HijackThis log was saved, the user told it where to save the log.

Go to: http://mvps.org/winhelp2002/unwanted.htm
Download "Hijack This!" [freeware]

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates: "hijackthis.log")

Post your HijackThis log to
http://forums.spywareinfo.com/
http://forums.tomcoyote.org/
http://castlecops.com/forum67.html
http://www.wilderssecurity.com/ or the Spyware forum at
http://aumha.net/viewforum.php?f=30 for expert analysis, not here.

Sign in, go to the "Malware Removal" section.
Press "New Topic" and post a description of your symptoms. If they need to
see your log they will ask for it.

--
Frank Saunders, MS-MVP OE
Please respond in Newsgroup. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/

 

[Robert Aldwinckle]

Everytime one of my users exits IE, an error message pops up......Originally,
it was "The instruction at '0x01a7494e' referenced memory at '0x0000047f'.
The memory could not be read. Click on OK to terminate this program."

Frank Saunders, MS-MVP, IE/OE then suggested that all spyware software be
removed. I have run both AdAware and SpyBot, and have cleared up anything
that showed....rebooted...ran again....nothing. I've tried to find my
original post...unsuccessfully.

Were you perhaps using aliases of umesha or DOW20000 in April?
<eg>


http://groups.google.com/groups?q=0x01a7494e+group:microsoft.*

(Google Groups search for
0x01a7494e group:microsoft.*
)


It looks as if April may have been long enough ago for those threads
to have been removed from the MS web interface cache.
In any case the same search of this newsgroup on its yields only this
thread.

The user is now getting a similar message but with different numbers: "The
instruction at '0x02463795' referenced memory at '0x01edead58'. The memory
could not be read. Click on OK to terminate this program."

Any other ideas?

This changes nothing. The crash is occurring in a unaddressable location
with an invalid pointer. E.g. something is causing a wild branch.
If you want to get some clues about the your crash you would need to extract
the Stack Back Trace for the crashing task (e.g. from drwtsn32.log;
locate the instruction address prefixed by FAULT -> and scroll ahead
to find the Stack Back Trace; occasionally the next section of the dump
Raw Stack Dump may also give helpful clues in the interpreted portion
of its output.



Good luck

Robert Aldwinckle
---