C++ runtime library error for explorer.exe

[mike24house]

Hello there, first of all thanks to everyone here that takes time out of their day to help people out with their problems; I think thats great.


I have Windows XP Service pack 2 and use McAffee

Now, my problem started a few days ago with a bubble popping up on the side from mcAfee telling me that a program that I did not recognize wanted to use the internet. This kept happening and I kept blocking access. Somehow I believe one of them got through because since then I can not open any folders or my computer or anything system related. I can use the internet and other programs just fine.

The following is the error message:

Microsoft Visual C++ Runtime Library
Program: C:\WINDOWS\explorer.exe
This application has requested the Runtime to terminate in an usual way.

Any suggestions would be GREATLY appreciated. I dont want to have to reinstall my OS and everything.

 

[kimsland]

Have a look at:

New Preliminary Removal Instructions

 

[mike24house]

Hello again,

Thanks for that link; i think it was a good start to solving my problem
On the 23rd I ran the Malware scan and the Spyware scan and it quarantined and removed many things. My computer ran good as new for a couple days then the symptoms came back a little bit last night. I started to see random popups and got the C++ error again. So I ran the scans again and sure enough a couple things popped up in each. Attached are the logs of the scans for the 23rd and the scans I ran this morning. If there is anything else I should do please let me know.

Thankyou for your time.

 

[kimsland]

Umm, you forgot one attachment, and doubled up on the other two (although different scans though)

Normally I don't read these logs though, (very time consuming you know)
But how's it all going with the computer now anyway?

 

[mike24house]

It is running perfectly fine again after I have done the second scan, but I feel like there must be some trace of it left because something triggered the same symptoms yesterday. I have been using the new firefox, as all of the pop-ups have been stemming from explorer. Maybe if I steer clear from explorer I will be fine.

 

[Bobbye]

You were badly infected with Trojab FakeAlers, Zlob, Widl Tangeant &. Pop-cap. Mbam has remove the Zlob Trajan, AdwarePopCap, found in the Dell Game Console

Have SAS remove all the Tracking Cookies. You need to get the Cookies undercontrol:
Tools> Internet Options> Privacy tab> Advanced button> CHECK 'allow first party Cookies' and Block or Prompt for third party Cookies. Apply> OK.

SAS has also remove the Trajan FakeAlert and Wild Tangent. Some entries are in Wallpaper you are using for the desktop,

Please run HijackThis and attach the log. IT is important that we check for remaining entries. When the system is clean, we will have you remove the cleaning tools and also the old System Restore points. DO NOT the restore at this point. You're not though with the cleaning yet.

 

[mike24house]

Hello, thankyou for taking the time to look at those logs.

I have just ran hijack this and somehow as a result of doing that the C++ error symptom returned.

As a side note, I have not done a system restore but one of my initial reactions was to do so last week. When I went into system restore I found that there were no system restore points left on my computer except for one just hours before then.

 

[mike24house]

sorry to bump this post up i just didnt want it to get lost

 

[Bobbye]

Part 1:
You should have run the HijackThis log at the same time as mbam and SAS. Did you follow the instructions in Post #6?
One of the reasons you logs havn't been handled yet is because you have so many program loaded, so many startups loading, so many unnecessary processes running that it take four times longer that a log from a machine that is better maintained!
You are also running a program "GoToAssist - Citrix Online" for online Remote Access that it appears you don't want to use. O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below:

C:\DOCUME~1\mike\LOCALS~1\Temp\clclean.0001
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\IK7Nbbfx.exe
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [PeerGuardian] "C:\Program Files\PeerGuardian2\pg2.exe" ******
O4 - Global Startup: SetPoint.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Bluetooth Manager.lnk = ?
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\mike\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\mike\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://gsn.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
O18 - Filter hijack: text/html - {519bb8b5-2ba0-4028-a1cc-d64257881b7b} - (no file)

Now close all windows other than HiJackThis, then click Fix Checked.**Close HiJackThis*and*reboot into Safe Mode:
Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Viewpoint Manager Service - Viewpoint Corporation

Please note any other programs that you don't recognize in that list in your next response.

Using Windows Explorer (to get there right-click your Start button and go to "Explore")> Windows> System 32>please delete these folders (if present):

system32\IK7Nbbfx.exe

Programs> Peer Guardian> Disable this before running the new HijackThis log
Start> Run> type in services.msc> enter. Right click on the Viewpoint Service> Properties> Change Startup type to Disabled> Stop the Service.
After that, Reboot, and post a new HijackThis log here in a reply

Please see Part 2

 

[Bobbye]

Part 2: Consider only AFTER Part 1 has been completed.
Stopping unnecessary startups> Printers and programs don't have to start when you boot. They are still on the hard drive and starting active processes at boot slows the load time, slows the surf time and slows the shutdown time. These processes are using the RAM when they load at start. They can be started manually when they are needed. Stopping them will free resources, make start up and shutdown faster and allow the use of RAM when surfing.

You have over 60 programs installed. You need to go to the Control Panel> Add/Remove Programs and look at what is installed. If you don't use the program uninstall it. If you don't know what a program does, do a Google search to ID it, then decide if you're using it.

I have grouped the following processes that are starting when you boot. NONE are needed on Startup. You can go into each program, take it off of automatic start, or take it off of auto-update, another unnecessary use of resources.
They are:

C:\Program Files\Viewpoint\Common\ViewpointService.exe> 'foistware'
C:\DOCUME~1\mike\LOCALS~1\Temp\clclean.0001
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe> 'foistware'
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll> out of date- need v9
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"> This process just updates java, which one can also do manually

LEXMARK

O4 - HKLM\..\Run: [lxdcmon.exe] "C:\Program Files\Lexmark 1300 Series\lxdcmon.exe"> Lexmark 1300 Series printer device monitor
O4 - HKLM\..\Run: [lxdcamon] "C:\Program Files\Lexmark 1300 Series\lxdcamon.exe"> Lexmark 1300 Series printer device monitor
O4 - HKLM\..\Run: [LXDCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXDCtime.dll,_RunDLLEntry@16> Resolves a timing problem where the Lexmark Communications service tries to communicate with the printer

MISC MEDIA

O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" -startup> System Tray icon for Nokia PC Suite.
O4 - HKCU\..\Run: [PcSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime> Installed by QuickTime player; all it does is eat memory, while sitting idle in the taskbar
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"> Cyberlink PowerCinema, allows you to play DVDs upon insertion.
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe> Drive letter access to HP's and Veritas' version of DirectCD.
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray> Related to Andrea's Superbeam microphone utility
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe> Part of Windows Media Center. Reports system resource utilization after you add your first Media Center extender.

DELL & DELL SUPPORT:

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll c:\windows\system32\
It takes a Google 404 page and directs it to a Dell Page stating the page has a problem and suggestions to correct. But it can be exploited by spyware to get past your firewalls -this particular BHO does come preinstalled on Dell computers.
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"> Starts Dell's remote support program..
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter> self-help tool for Dell users.

CREATIVE:

O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon> Creative Filter AudioControlMB Module
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R> Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player, selecting Tools, then uncheck the Auto Start box. It should not start up automatically again
O4 - HKLM\..\Run: [CTSysVol] "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" /r> Creative sound card volume controls

I have given a short description of most. IF you decide to trim down your system for better performance, you may want to use the AutoRuns program to assist you:
AutoRuns for Windows v9.34
http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx


Or you can use the msconfig utility:
Start> Run> type in ;msconfig' without quotes> enter> Selective Startup> Startup tab> UNCHECK the processes yyou don't want to start at boot> Apply> OK> Reboot> Close the nag message after checking 'don't show this message again'.

 

[mike24house]

I really appreciate the help that you are giving me.
I have followed all of your suggestions through step 1. The only thing that I could not accomplish was when I ran Hijack this, the programs that are running that show up in the log did not come up as an option to be 'fixed'. I did however check off all the other ones and it seemed to work.
I did find the .exe file in system 32 when I was in safe mode and I deleted it.
Now I have attached the new Hijack this log after I have completed all of your steps besides trimming down my computer which I will start to do tomorrow.
Also, I think that GoToAssist program comes from when I needed help for something unrelated through Dell. I don't need it anymore so I suppose it would be okay to get rid of it.
I cant stress enough how much I appreciate your continued help.

 

[Bobbye]

I ran Hijack this, the programs that are running that show up in the log did not come up as an option to be 'fixed'.

When you do a system scan, the program opens with all[ the entries and each has a small check box to the left of each entry. You click on the box to put a check on and when through, click on 'Fix Checked' below the screen. You do the checking from the scan itself, not the saved log. The log is simply a measure to let us know what is running n your system. That's why you have to run HijackThis again.

I will review your log again after you do this and AFTER to remove your unneeded/unused programs and the entries I set up for you. I spent a great deal of time setting things up to help make your computer run better. I don't have the time to wade through those long logs again.

EDIT: For reference, I am running Windows XP, SP2. I ran HijackThis to check the size of the log. My log is 5KB in size. Yours is 16.2KB. My system only starts up with the AV program, firewall, touchpad for laptop and network process for the network. There are no automatic updates running for any programs except the antivirus program. I have uninstall any program I don't need or use. I do regular maintenance. While I do realize that each system is different and not all are configured the same, to have a log that shows three times more content compared to a machine that is clean and runs well, is something you need to take into serious consideration.

 

[mike24house]

I have done everything you have asked of me so far. I eliminated the programs that I do not use anymore from my add/remove programs list. Some of the others that I am not sure what they are even after looking them up I am not sure that I am supposed to remove. I have freed up space on my system and edited all those programs to not start on startup like you suggested by going into msconfig. Granted I only managed to take 3 KB off the size of my log but I put a lot of time into doing so and don't know how to go any further. I am sorry that the size of my log is such and i appreciate you looking at it still. This is a log that I just ran today after cleaning the system.

From time to time I still get the C++ error. Generally it will last a few minutes, not letting me open any folders or anything under the C drive or my computer. Then it will stop and allow me to do so; very strange and I can not find a pattern to why this happens. There must be some trace of something bad still on my computer.

 

[Bobbye]

Mike, the log if the reflection of what's on your system and what's running. I can't imagine you use all of the programs that are installed. You should review them in the Control Panel> Add/Remove Programs. Uninstall ALL of those you don't use- they're dead wood! They take up 'space' on the hard drive.

You don't need printers to start on boot. You don't need Dell Support either- in fact, do you actually use Dell Support? As for the RunTime Error, you're going to need to put it with what you're doing t the time it comes up.

Your original problem was McAfee warning of something in your system wanting internet access- so you blocked it. In general, that's the best practice, but in reality, you need to fined out WHAT is trying to access then handle it accordingly. You may not have recognized it at the time, but since it keeps coming up, you need to find out what it is- maybe it NEED to access the internet and is legitimate.

You don't need to reinstall- just get rid of some of what you have both installed and running at startup.
Your log is clean. To remove the cleaning tools:

* Download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe)
* Click the CleanUp! button.
* It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).

Clear System Restore points:
Control Panel> System> System Restore tab> CHECK 'turn off System Restore> Apply> OK> Reboot
Now go back in and UNCHECK 'turn off System Restore> Apply> OK
Set a new, clean Restore point.