OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
SP2 first incompatibility: DivX.

From: Olivier Chami (olivier.chamiFREE.FR)
Date: Wed Aug 11 2004 - 01:44:04 CDT


Hi,

1- Installation of SP2, take a long time but OK.
2- The problem :
        -> SP2 add shortcut to IE and WMP on my Quick lauch bar.
        -> Trying to delete it : 'explorer.exe - Application Error'
        -> Trying with the old fashioned del of command prompt : OK.
        -> From the event viewer :
        'Application popup: explorer.exe - Application Error : The instruction
        at "0x01f9415b" referenced memory at "0x00000000". The memory could
        not be "written".'

        => In fact, each time I right click on desktop Icon, explorer.exe
        hang.

3- The solution :
        -> From sysinternal take 'Filemon'. Activate Filmon and try to do the
        job and see what's happen.
        [...]
        175 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Attributes: A
        176 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Length: 105472
        177 08:15:56 explorer.exe:492 CLOSE C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS
        178 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Attributes: A
        179 08:15:56 explorer.exe:492 OPEN C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Options: Open Access:
        Execute
        180 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Length: 105472
        181 08:15:56 explorer.exe:492 CLOSE C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS
        182 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Attributes: A
        183 08:15:56 explorer.exe:492 QUERY INFORMATION C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Attributes: A
        184 08:15:56 explorer.exe:492 OPEN C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS Options: Open Access:
        Execute
        185 08:15:56 explorer.exe:492 CLOSE C:\Program
        Files\DivX\Dr.DivX\EncodeDivXExt.dll SUCCESS
        [...]
        -> renaming EncodeDivXExt.dll to _EncodeDivXExt.dll
        (or deleting from registry this key :
         [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\EncodeDivXExt])

        => System seems to work like a charm.

Olivier.

-----
NTBugtraq Editor's Note:

Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.
-----