MY system crashes quite often. A window pops up displaying "windows explorer has encountered an error and needs to close....' or words to that effect. The desktop then disappears for about 3 seconds and then reappears. It seems to happen mainly when i am opening a file of some sort (e.g. a picture) or when windows movie maker is running.

Windows is fully updated running service pack 1.

Any help would be much appreciated.

Its getting to be quite annoying now. Damn unstable windows!!!!

Hi DrGreenthumb and welcome to PC Help Forum. What i may suggest to you is run Ad aware 6.0, Spybot S&D and hijackthis!. These can be found in the downloads section of thge site and i think Hengis has added Spywareblaster. Spywareblaster keeps spyware from installing on your system. As i say if he hasnt added it yet download it from http://www.javacoolsoftware.com/sbdownload.html

Post your results from all the scans back here and we may be able to figure out the problem for you. Also have you installed any new programmes recently?

I installed spy-bot and ran it. It picked up a number of entries and corrected them. After correcting the entries I scanned again and it picked up 5 entries again. Every time it fixes these entries they reappear on the next scan.

I also installed ad aware. This picked up a number of objects and I proceeded to remove them. I scanned again with ad aware and nothing was picked up; totally clean.

I also ran spy-bot after ad-aware said the system was clean, and scanned again. The same 5 entries appeared again. The spy bot log is listed below:

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1292428093-790525478-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Inter net Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Internet Settings\Zones\0\1004!=W=3


--- Spybot - Search && Destroy version: 1.3 ---
2004-07-09 Includes\Cookies.sbi
2004-07-09 Includes\Dialer.sbi
2004-07-09 Includes\Hijackers.sbi
2004-07-09 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-07-09 Includes\Malware.sbi
2004-07-09 Includes\Revision.sbi
2004-07-02 Includes\Security.sbi
2004-07-09 Includes\Spybots.sbi
2004-07-09 Includes\Tracks.uti
2004-07-09 Includes\Trojans.sbi

Also, here is the log that highjack this created:


Logfile of HijackThis v1.97.7
Scan saved at 23:51:17, on 19/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Apps\ActivBoard\nhksrv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\gsicon.exe
C:\WINDOWS\System32\dslagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG6\AVGCC32.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Rich\My Documents\downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ukonline.co.uk
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 4.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Microsoft Update] wserv32.exe
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\M.

Looks like your initial thought could be right, there could be some sneaky little spy or ad ware messing about.

Hope the logs are helpful.

Another quick question, I ran the trial version of Registry Mechanic 3 and it picked up about 300 problems. As it is a trial version it would only correct about 40 of these, so the others remain. Is it worth shelling out for the upgraded version, or are there any other free programmes that do the same job.

It may be worth buying reg mechanic so that you can correct all the registry problems. Also try running spybot in Safe Mode. To do this

1) Restart PC
2) keep tapping the F8 key untill you gwt a menu come up.
3) Choose Safe Mode
4) Run Spybot

It also may be worth running a full virus scan of your machine.

@DrGreenthumb

Your exploit is a nasty(ish) one - this should Zap it!

1 Open Spybot and select 'advanced' mode.
2 Select 'settings' in the left column.
3 Select 'ignore product' in the left column.
4 Select 'security' tab.
5 Place check mark in box beside DSO Exploit.
6 Close program
7 Open Spybot and run a scan.

You will find that DSO Exploit has been eliminated and if your computer does not harbour any other spyware you will see a congratulatory message.

Thanks a lot guys especially Hengis. Did what you said and ran SpyBot and success! No threats detected.

Cheers.