Windows Vista Word, Browsers etc crash on save or attach

Good morning all!

I've had this problem for a few months, have searched many forums and even asked for help elsewhere to no avail. Word and some browsers crash on save/save as dialog.

Im running vista home premium 64-bit.


When trying to save a file in word, as soon as the box opens up showing the navigation folder, word crashes with the "Microsoft Office Word has stopped working ". In Firefox, when I click a picture and try to save, it does not crash when the folder navigation pops up -- but if I try to change the folder, thats when it will crash.

Also, sometimes, when attaching files, like in gmail or a forum, it will crash as well.

I feel I should note, I recently had the google redirect virus three times...I guess it never fully cleared. In my attempts to clear this I made quite a few changes and this last time I ran combofix. I should note, though, that this problem was prior to running combofix.

I have been working on this for months to no avail. I have tried so many things I'm not sure I can remember them all, but here are some.

I used the Microsoft Fix-it Solution Center and ran "Diagnose and repair Windows File and Folder Problems automatically" and "Fix Windows system performance problems on slow Windows computers ". No fix.

I ran windows startup recovery. I do not have the Vista discs as they never came w/ my computer and when the BBY Geeksquad "optimized" my computer they messed up the gateway built-in recovery. I never had it fixed -- regretting that now.

I ran SFC scannow repair. The only file it could not repair was settings.ini for sidebar (which I dont use). I renamed it settings.ini.old and started sidebar and it automatically made the new file. No fix.

I repaired the Office installation. No fix. I reinstalled office. Same.

I ran Office diagnostics. It repaired a few things, but not this problem.

I updated everything I could from Windows update.

In a quick review here's something interesting I've found -- it crashes on some app saves but not others. For instance:

offending apps when saving:

firefox, word, chrome, IE, and SOMETIMES notepad (only when saving the log files from DDS, oddly - maybe the size??)

non-offending apps

photoshop

excel

notepad, most of the time

wordpad

onenote

It does crash in safe mode as well.

In reviewing other posts here, i ran shellexview and disabled all non-microsoft shell extensions. The problem still persists.

I've posted a BOATLOAD of information in another forum ie eventviewer dds gmer logs if you would like to view them -- but if you would like me to run anything and post i will gladly do so. This is keeping me from getting my work done, as you could imagine.

Thanks in advance for any help you can offer!

 

Welcome aboard.

First of all we have to make sure that your system is clean.

Please read this & post in Malware and Virus Removal forum.

 

Please enter your System Details. It helps us in answering your questions!

 

Have you checked Event Viewer? Look it up in Help and Support.

Although you say

I would still suspect a File System or hard disk problem. Run Error Checking (CHKDSK) on your drive/s. Again, look it up in Help and Support. Also include doing a scan of the hard disk's surface.

I am not sure what you would be saving in Firefox, IE or Google Chrome, but personally, I try to only only run one browser if I can. I have IE and Firefox yet I try to run only one at a time. From my experience, having several programs installed doing the same job can cause problems. Don't try uninstalling IE, but I would choose between Firefox and Chrome.

Is it to do with saving things off the internet (from the browser)?

Matt

 

I ran a check disk as requested, no change.

I have looked at the event viewer but still cant make heads or tails of it. if u wld like me to recreate the problem and then post the EV log please let me know. Just tell me specifically what to post from it....that thing confuses me something fierce, lol.

However I tried it, this is what I saw...

I recreated the problem in word, and this is what i saw for the minutes immediately following under Windows logs: system and also applications -- sorry if the format is screwy, I'm not sure if theres a neater way to copy than the copy command on the side panel there:


This is what pops up after Microsoft tries to fix the problem -- seems these files also show up in the event log below:

Files that help describe the problem:
C:\Users\Owner\AppData\Local\temp\48744150.cvr
C:\Users\Owner\AppData\Local\temp\48744150.od
C:\Users\Owner\AppData\Local\temp\WERC753.tmp.version.txt
C:\Users\Owner\AppData\Local\temp\48715695.od
C:\Users\Owner\AppData\Local\temp\CVR5790.tmp.cvr
C:\Users\Owner\AppData\Local\temp\WER169B.tmp.appcompat.txt
C:\Users\Owner\AppData\Local\temp\WER319B.tmp.mdmp



Log Name: System
Source: Service Control Manager
Date: 9/14/2011 10:27:34 AM
Event ID: 7036
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Owner-PC
Description:
The WinHTTP Web Proxy Auto-Discovery Service service entered the running state.
Event Xml:
<Event xmlns= "http://schemas.microsoft.com/win/2004/08/events/event ">
<System>
<Provider Name= "Service Control Manager" Guid= "{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName= "Service Control Manager" />
<EventID Qualifiers= "16384 ">7036</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime= "2011-09-14T14:27:34.000Z" />
<EventRecordID>667384</EventRecordID>
<Correlation />
<Execution ProcessID= "0" ThreadID= "0" />
<Channel>System</Channel>
<Computer>Owner-PC</Computer>
<Security />
</System>
<EventData>
<Data Name= "param1 ">WinHTTP Web Proxy Auto-Discovery Service</Data>
<Data Name= "param2 ">running</Data>
</EventData>
</Event>





Log Name: Application
Source: Application Error
Date: 9/14/2011 10:27:31 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Owner-PC
Description:
Faulting application WINWORD.EXE, version 12.0.4518.1014, time stamp 0x45428028, faulting module regxplor.dll, version 1.4.4.0, time stamp 0x3d21fbb5, exception code 0xc00000fd, fault offset 0x00007368, process id 0xd68, application start time 0x01cc72ea5e25c8b0.
Event Xml:
<Event xmlns= "http://schemas.microsoft.com/win/2004/08/events/event ">
<System>
<Provider Name= "Application Error" />
<EventID Qualifiers= "0 ">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime= "2011-09-14T14:27:31.000Z" />
<EventRecordID>155434</EventRecordID>
<Channel>Application</Channel>
<Computer>Owner-PC</Computer>
<Security />
</System>
<EventData>
<Data>WINWORD.EXE</Data>
<Data>12.0.4518.1014</Data>
<Data>45428028</Data>
<Data>regxplor.dll</Data>
<Data>1.4.4.0</Data>
<Data>3d21fbb5</Data>
<Data>c00000fd</Data>
<Data>00007368</Data>
<Data>d68</Data>
<Data>01cc72ea5e25c8b0</Data>
</EventData>
</Event>




Log Name: Application
Source: Windows Error Reporting
Date: 9/14/2011 10:30:53 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: Owner-PC
Description:
Fault bucket 528234746, type 1
Event Name: APPCRASH
Response: http://oca.microsoft.com/resredir.a...4746&Cab=7A1DED99608E4A50B514BB58D2E551E2.cab
Cab Id: 0

Problem signature:
P1: WINWORD.EXE
P2: 12.0.4518.1014
P3: 45428028
P4: regxplor.dll
P5: 1.4.4.0
P6: 3d21fbb5
P7: c00000fd
P8: 00007368
P9:
P10:

Attached files:
C:\Users\Owner\AppData\Local\temp\48744150.cvr
C:\Users\Owner\AppData\Local\temp\48744150.od
C:\Users\Owner\AppData\Local\temp\WERC753.tmp.version.txt
C:\Users\Owner\AppData\Local\temp\48715695.od
C:\Users\Owner\AppData\Local\temp\CVR5790.tmp.cvr
C:\Users\Owner\AppData\Local\temp\WER169B.tmp.appcompat.txt
C:\Users\Owner\AppData\Local\temp\WER319B.tmp.mdmp

These files may be available here:
C:\Users\Owner\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report1366dbbd
Event Xml:
<Event xmlns= "http://schemas.microsoft.com/win/2004/08/events/event ">
<System>
<Provider Name= "Windows Error Reporting" />
<EventID Qualifiers= "0 ">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime= "2011-09-14T14:30:53.000Z" />
<EventRecordID>155435</EventRecordID>
<Channel>Application</Channel>
<Computer>Owner-PC</Computer>
<Security />
</System>
<EventData>
<Data>528234746</Data>
<Data>1</Data>
<Data>APPCRASH</Data>
<Data>http://oca.microsoft.com/resredir.aspx?SID=604&amp;iBucketTable=1&amp;iBucket=528234746&amp;Cab=7A1DED99608E4A50B514BB58D2E551E2.cab</Data>
<Data>0</Data>
<Data>WINWORD.EXE</Data>
<Data>12.0.4518.1014</Data>
<Data>45428028</Data>
<Data>regxplor.dll</Data>
<Data>1.4.4.0</Data>
<Data>3d21fbb5</Data>
<Data>c00000fd</Data>
<Data>00007368</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
C:\Users\Owner\AppData\Local\temp\48744150.cvr
C:\Users\Owner\AppData\Local\temp\48744150.od
C:\Users\Owner\AppData\Local\temp\WERC753.tmp.version.txt
C:\Users\Owner\AppData\Local\temp\48715695.od
C:\Users\Owner\AppData\Local\temp\CVR5790.tmp.cvr
C:\Users\Owner\AppData\Local\temp\WER169B.tmp.appcompat.txt
C:\Users\Owner\AppData\Local\temp\WER319B.tmp.mdmp</Data>
<Data>C:\Users\Owner\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report1366dbbd</Data>
</EventData>
</Event>


I do only run one browser at a time -- it was when I started having the issue that I tried the different browsers to see if they all had the issue, which they did.

More specifically, it is when I try to attach something (to an email or forum) or save a picture by right-clicking and save. Downloading is fine. It seems to only be affected when the windows explorer dialog box pops up. Same with saving in word -- when the windows explorer box pops up.

As requested I posted all the logs over in the malware forum -- I'll add the rest of the logs and hopefully the link to it here when my post is approved.


Heres my system specs:

System Vendor
Manufacturer Gateway
Serial Number INVALID
Model P-7805u

BIOS Information
Vendor Phoenix Technologies LTD
Version 9C.17.00
Board Product ID IMV

Processor Information
Summary 1 Physical Processors / 2 Cores / 2 Logical Processors / 64 bits
Name Intel(R) Core(TM)2 Duo CPU P8400 @ 2.26GHz
Vendor GenuineIntel
Original System Clock 266 MHz

Storage Device Information
Disk 0 320.0 GB Hitachi HTS723232L9A360 Hitachi
DVD Writer 0 Optiarc DVD RW AD-7583S Sony Optiarc
DVD-ROM 1 YZQVI W1QVWLQB SCSI CdRom Device YZQVI

Logical Disk Information
C:\ (OS) Local Disk Size: 286.3 (GB) Free: 12.4 (GB)
D:\ DVD
E:\ DVD

Memory Information
Slot 1 DDR3 (PC3-8500F) 2048 MBytes Elpida
Slot 2 DDR3 (PC3-8500F) 2048 MBytes Elpida

Display Adapter Information
NVIDIA GeForce 9800M GTS 1024 MBytes

Sound Adapter Information
Conexant High Definition SmartAudio 221 Conexant
High Definition Audio Device Microsoft

Network Adapter Information
Marvell Yukon 88E8071 PCI-E Gigabit Ethernet Controller WIRED Disconnected [1000 Mbps]
Intel(R) WiFi Link 5100 AGN WIRELESS LAN Connected [54 Mbps]
Motorola USB Networking Driver Connected

Operating System
Type Windows Vista Home Premium x64 Service Pack 2

 

Here's the link to my malware logs here

 

Something that just springs to mind when you say "picture ", do you have any camera software installed? Consider that that might be the problem.

Don't be afraid to uninstall programs if you feel you need to. You can reinstall them, with relevant updates and so, get the "latest version ".

Consider that the problem might stem from a closely related program or one that has been repetitively patched/updated and needs a reinstallation.

Event Viewer: take note of the time the error occurs. Find that time for when errors (not just Information) occur in the Event Viewer. Double-click on the event to see the details. After it happens a few times, you will see a pattern of the same error occurring. Use the details to search for a possible cause.

Matt