IE6 Memory Could Not Be Written Error

[Bob N.]

To All:

I have a client with a Win XP Pro system that had a desktop toolbar
installed by WhenUSrearch, which appears to be a form of malware. When I
was finally able to remove the toolbar, Internet Explorer began to report
the following error every time I tried to open the program:

The instruction at "0x77f581bd" referenced memory at "0x74206572". The
memory could not be "written". Click on OK to terminate the program.

I have run sfc /scannow with no errors. I have removed and reinstalled IE6.
I have also reset the registry entry to make it appear that IE6 was not
installed and then installed a slightly earlier version, all to no avail.

If anyone has successfully resolved this problem, I would appreciate it if
you could share the fix with me.

Thanks in advance,

Bob N.

 

[H Leboeuf]

In case you wish to review WhenUSearch.
http://www.kephyr.com/spywarescanner/library/whenusearch/index.phtml

The error message indicates some other malware. Check further with these
tools.

Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

If you use a HOSTS file, beware of this new issue.
Ad-Aware has decided to include a new detection when scanning the HOSTS
file. This now creates a "Bad hosts file entry" in the log file generated at
the end of a scan. The best thing to do is to place a check in each entry,
right-click and select: "Add selection to ignorelist". Otherwise if you let
AWW "fix" these items it will trash the HOSTS file! Even if you have it
"locked" by [example] SpywareBlaster or Winpatrol. It does not return the
attributes and renames the HOSTS file incorrectly to hosts.

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

More: This may be caused by a third-party program (adware, spyware,
parasite).
Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)


Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

 

[Bob N.]

Hi, Henri,

Thank you for the insighful reply. I probably should have added that a
Spybot scan returned over 120 problems that were successfully repaired.
However, as we both know, Spybot cannot detect every problem in the universe
of malware. The information you have provided confirms my suspicion that
spyware may still be lurking in the background. I will pursue this further
and report back to the group.

Thanks,

Bob N.

In case you wish to review WhenUSearch.
http://www.kephyr.com/spywarescanner/library/whenusearch/index.phtml

The error message indicates some other malware. Check further with these
tools.

Try this: Tools > Internet Options > Advanced > Browsing
Uncheck the Enable 3rd party browser extensions

If this clears your problem then find out who the culprit(s) is/are with
these tools.

Let AD-Aware Scan your system for advertising Spyware
http://www.lavasoftusa.com

If you use a HOSTS file, beware of this new issue.
Ad-Aware has decided to include a new detection when scanning the HOSTS
file. This now creates a "Bad hosts file entry" in the log file generated at
the end of a scan. The best thing to do is to place a check in each entry,
right-click and select: "Add selection to ignorelist". Otherwise if you let
AWW "fix" these items it will trash the HOSTS file! Even if you have it
"locked" by [example] SpywareBlaster or Winpatrol. It does not return the
attributes and renames the HOSTS file incorrectly to hosts.

and:

SpyBot-S&D
http://security.kolla.de/

p.s Reset the 3rd party browser setting.

More: This may be caused by a third-party program (adware, spyware,
parasite).
Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.spywareinfo.com/~merijn/cwschronicles.html
More: Removal tool: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

CWShredder - Tutorial
http://www.bleepingcomputer.com/forums/index.php?showtutorial=47

IMPORTANT:
Before trying to remove spyware, download a copy of LSPFIX from
the URL below - some malware may kill your internet connection when it is
removed, this program will enable you to regain your connection.
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is Win2k or
XP)


Important: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051

--

Henri Leboeuf
Web page: http://www.colba.net/~hlebo49/index.htm
===

To All:

I have a client with a Win XP Pro system that had a desktop toolbar
installed by WhenUSrearch, which appears to be a form of malware. When I
was finally able to remove the toolbar, Internet Explorer began to report
the following error every time I tried to open the program:

The instruction at "0x77f581bd" referenced memory at "0x74206572". The
memory could not be "written". Click on OK to terminate the program.

I have run sfc /scannow with no errors. I have removed and reinstalled IE6.
I have also reset the registry entry to make it appear that IE6 was not
installed and then installed a slightly earlier version, all to no avail.

If anyone has successfully resolved this problem, I would appreciate it if
you could share the fix with me.

Thanks in advance,

Bob N.