Inexplicable net activity

[ravisunny2]

wucrtupd & lexplore : illegal operation

I am getting the error messages for wucrtupd & lexplore.

Msg is : The system has performed an illegal operation and will shut down. ...

This error msg comes intermittently, and IE6 does not always crash.

I had applied the unofficial update for Win 98SE yesterday. Also had downloaded from driverguide, driver scan (non-activeX) & Driver Guide Tool.

AVG free says that the following files have changed : kernel32.dll, user32.dll & shell32.dll (perhaps due to the update). No viruses.

Spybot & Ad-aware give a clean chit.

Is it possible that some files have been corrupted ?

Can you please see the HJT attached. Please remember, most tools are not available on Win 98SE.

Thank you.

 

[howard_hopkinso]

You have posted your HJT log from safe mode.

Please post a fresh HJT log from normal mode.

Regards Howard

This thread is for the use of ravisunny only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[ravisunny2]

Thanks, Howard.

But I reformatted. As you had advised, I had taken a full backup.

Ravi

 

[ravisunny2]

Lexplore & illegal ops in Explorer

I am having lexplore problem (especially when trying to print from within hotmail).

Ocassionally I am getting 'illegal operation' for/from Explorer.

AVG shows that user32.dll has changed.

No other virus/error detected.

Spybot & Ad-aware are clean.

Can you please have a look at the attached HJT & Autoruns logs ?

 

[howard_hopkinso]

Have HJT fix this entry.

O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup

Reboot your system.

Other than the above, I can`t see any problems.

Regards Howard

This thread is for the use of ravisunny only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[ravisunny2]

lexplore has performed an illegal operation

I did as advised, but the 'lexplore' problem is still there.

As I wrote before, I get this problem : 'lexplore has performed an illegal operation...', when taking a print from hotmail ( windows live).

I have attached the new HJT log.

Any other suggestions, please ?

 

[DelJo63]

\windows\command\sulfnbk.exe is suspect!

see Symantec notes

 

[howard_hopkinso]

The sulfnbk.exe file, is normally a legit Windows file and is responsible for long file names.

However, it is possible the file can be come infected.

Navigate to c:\windows\command\sulfnbk.exe and zip the file up into an archive, then delete the sulfnbk.exe file. That way, should you have cause to suddenly need the sulfnbk.exe file, you have it readily available in the zip archive. Even if the file is infected, it can`t do any harm as long as it`s zipped up.

Your HJT log is clean.

Regards Howard

This thread is for the use of ravisunny only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[ravisunny2]

I zipped the file c:\windows\command\sulfnbk.exe, then deleted it and ran ccleaner.

Rebooted. All else seems to be working fine but the 'lexplore error' when printing from within hotmail is still there, unfortunately.

 

[howard_hopkinso]

I`m not sure what`s causing your printing problem. However, I don`t think it`s malware related.

I suggest you open a new thread for your problem in our Other Hardware forum.

Regards Howard

This thread is for the use of ravisunny only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[ravisunny2]

Okay, thanks.

I will post in Other Hardware forum.

Regards,

Ravi