ERROR MESSAGE - Windows Explorer [Archive]

Brian A.

June 6th 04, 05:34 AM

HijackThis appears to be the way to rid of this new parasite. Download/run HjThis.
DO NOT REMOVE ANYTHING EXCEPT WHAT IS SUGGESTED BELOW. HjThis will list many entries
that are needed as well as the bad ones. Do only as suggested below for removal of
this parasite and post as suggested below for further instructions on what is safe to
remove. By not following the instructions as specified may create even more problems.

From MVP Glen Ventura:
We are so far having luck with running Hijack This, marking this entry and clicking
the "Fix Checked" button:
O2 - BHO: Core Library -
{F281FFC7-6C63-4bf9-83F2-AB7A6157B109} -C:\WINDOWS\SYSTEM\KDP2928.DLL

Then find and delete the file KDP2928.DLL

Note that there may be other CLSIDs and file names listed for the BHO "Core
Library", and in that case those should be fixed and the associated file
deleted.
Newly added CLSID's to look for:
BHO "Core
Library":{D4D505DF-D582-400c-91B6-84921012AFE3} -C:\WINDOWS\SYSTEM\PDF1C3B.DLL

The manual removal instructions at:
http://www.pestpatrol.com/PestInfo/s/safeguardprotect.asp
cover all or most of the Safeguard variations, and should work for any of
the versions of that particular malware.

Download, unzip, and run Hijack This from one of these locations:
http://computercops.biz/downloads-cat-14.html
http://www.majorgeeks.com/downloads31.html
http://www.spywareinfo.com/downloads/tools/HijackThis.exe
Unzip to a folder other than your Desktop or the Temp folder, double-click
HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save
Log" button. Press that, save the log somewhere you can find it (Desktop,
My Documents, or
similar). Most of what it lists will be harmless or even required, so do NOT
fix anything yet.

Copy the log files and paste them into a new post at one of these forums:
http://forums.net-integration.net/
http://computercops.biz/forums.html
http://forums.spywareinfo.com/index.php?showforum=30
http://tomcoyote.org/forums/
http://www.lavasoftsupport.com
http://boards.cexx.org/

The folks there will tell you what to remove.

A tutorial for using Hijack This is located here:
http://tomcoyote.com/hjt/
and an in-depth tutorial is here:
http://aumha.org/a/hjttutor.htm

--
Brian A.

Jack of all trades, Master of none.
One can never truly be a master as there is always more to learn.

"Gerry" > wrote in message
...
> When I try to get into WINDOWS EXPLORER, I get the
> following error message:
>
> EXPLORER caused an invalid page fault in
> module <unknown> at 0000:07c7fc6e.
> Registers:
> EAX=004a93b4 CS=0187 EIP=07c7fc6e EFLGS=00010246
> EBX=01c6a940 SS=018f ESP=008dcc38 EBP=008dcc54
> ECX=50002fa8 DS=018f ESI=01c6a948 FS=4cd7
> EDX=008dcc48 ES=018f EDI=008dcf68 GS=0000
> Bytes at CS:EIP:
>
> Stack dump:
> 01b15da1 004a93b4 008dcc48 00000003 00000000 004a93b4
> 004ca478 008dcca0 01b15de2 008dcf68 01c6a948 00000000
> bff741f7 bff713e2 00000187 bff74272
>
> Can anyone please tell me how to correct this?
>