Schnoodledorfer
22nd June 2007, 15:04
Can someone tell me what is generating the following popup? I get it frequently when I click on an avi file in Windows Explorer (XP Home SP2). (I don't need to have to play the video, just select it.)
http://mynetimages.com/4812e019.jpg (http://mynetimages.com)
I did a base64 decode on the "Application Data" and I got the following:
Version: WlFBXUJQVFZaRE5DRkNVJClSOyQ7ViAsAAdVPyE8IzBzZHt+dzMkIjskIzZFcnR9eGp/Rzc7R3J4b3FDMQ==
ImageBase: 0CF60000
Eip: A197E30
Eax: D8D0000
Ecx: D784A58
Edx: 0
Ebx: 0
Esi: D7849A0
Edi: D740000
Ebp: 186E64C
Esp: 186E520
-1
Code = [204]
- 0
- 204
- 227
- 0
- []
> D:\WINDOWS\Explorer.EXE
> D:\WINDOWS\system32\ntdll.dll
> D:\WINDOWS\system32\kernel32.dll
> D:\WINDOWS\system32\msvcrt.dll
> D:\WINDOWS\system32\ADVAPI32.dll
> D:\WINDOWS\system32\RPCRT4.dll
(I'm not including the whole thing, but basically a long list of .dlls and .axs follow.) Trying to decode the "version" results in gibberish. The window is owned by Explorer, but what library is triggering it?
I think I started getting these when I uninstalled ffdshow and replaced it with ffdshow tryouts, which is disabled as far as running with Explorer somehow. Actually playing the video with something that uses ffdshow tryouts doesn't cause the popups. So I suppose it is something that is running instead of ffdshow, but I don't know what it is.
Clicking on the "Copy Text" button does nothing, as far as I can tell. (It is possible to select the text in the window and copy the text using Control-C, however.) "Submit Report" button results in another popup that just says "1" or "2", etc., and has an OK box that closes it. Clicking on "OK" closes the window, but typically another one will pop up.
Hopefully someone will recognize this window. As it is, I don't know what software to blame. Whatever it is, it certainly has a shoddy method of reporting errors. I would blame some sort of malware, but it only seems to be triggered by selecting avi files, so that doesn't seem likely.
Thanks in advance for any help.
http://mynetimages.com/4812e019.jpg (http://mynetimages.com)
I did a base64 decode on the "Application Data" and I got the following:
Version: WlFBXUJQVFZaRE5DRkNVJClSOyQ7ViAsAAdVPyE8IzBzZHt+dzMkIjskIzZFcnR9eGp/Rzc7R3J4b3FDMQ==
ImageBase: 0CF60000
Eip: A197E30
Eax: D8D0000
Ecx: D784A58
Edx: 0
Ebx: 0
Esi: D7849A0
Edi: D740000
Ebp: 186E64C
Esp: 186E520
-1
Code = [204]
- 0
- 204
- 227
- 0
- []
> D:\WINDOWS\Explorer.EXE
> D:\WINDOWS\system32\ntdll.dll
> D:\WINDOWS\system32\kernel32.dll
> D:\WINDOWS\system32\msvcrt.dll
> D:\WINDOWS\system32\ADVAPI32.dll
> D:\WINDOWS\system32\RPCRT4.dll
(I'm not including the whole thing, but basically a long list of .dlls and .axs follow.) Trying to decode the "version" results in gibberish. The window is owned by Explorer, but what library is triggering it?
I think I started getting these when I uninstalled ffdshow and replaced it with ffdshow tryouts, which is disabled as far as running with Explorer somehow. Actually playing the video with something that uses ffdshow tryouts doesn't cause the popups. So I suppose it is something that is running instead of ffdshow, but I don't know what it is.
Clicking on the "Copy Text" button does nothing, as far as I can tell. (It is possible to select the text in the window and copy the text using Control-C, however.) "Submit Report" button results in another popup that just says "1" or "2", etc., and has an OK box that closes it. Clicking on "OK" closes the window, but typically another one will pop up.
Hopefully someone will recognize this window. As it is, I don't know what software to blame. Whatever it is, it certainly has a shoddy method of reporting errors. I would blame some sort of malware, but it only seems to be triggered by selecting avi files, so that doesn't seem likely.
Thanks in advance for any help.