Notepad files keep showing up on my desktop..

Reign

Alright i keep getting random memory dumps, and after they happen i get a notepad file on my desktop...

It says:


An unexpected exception has been detected in native code outside the VM.
Unexpected Signal : EXCEPTION_ACCESS_VIOLATION (0xc0000005) occurred at PC=0x3100
Function=[Unknown.]
Library=(N/A)

NOTE: We are unable to locate the function name symbol for the error
just occurred. Please refer to release documentation for possible
reason and solutions.


Current Java thread:
at sun.plugin.services.WPlatformService.waitEvent(Native Method)
at sun.plugin.viewer.frame.IExplorerEmbeddedFrame.destroy(Unknown Source)


THEN IT GIVES A WHOLE LIST OF DLL FILES AND THEN IT SAYS THIS....


Heap at VM Abort:
Heap
def new generation total 576K, used 177K [0x10020000, 0x100c0000, 0x10780000)
eden space 512K, 22% used [0x10020000, 0x1003cbc0, 0x100a0000)
from space 64K, 97% used [0x100a0000, 0x100af8f0, 0x100b0000)
to space 64K, 0% used [0x100b0000, 0x100b0000, 0x100c0000)
tenured generation total 1408K, used 1081K [0x10780000, 0x108e0000, 0x16020000)
the space 1408K, 76% used [0x10780000, 0x1088e770, 0x1088e800, 0x108e0000)
compacting perm gen total 5120K, used 5044K [0x16020000, 0x16520000, 0x1a020000)
the space 5120K, 98% used [0x16020000, 0x1650d348, 0x1650d400, 0x16520000)

Local Time = Wed Dec 10 17:35:30 2003
Elapsed Time = 9
#
# The exception above was detected in native code outside the VM
#
# Java VM: Java HotSpot(TM) Client VM (1.4.2_01-b06 mixed mode)
#

Dexter

Obviously a Java error of some sort, and if you Google a few of the dump data strings, you will see all kind of similar errors. Does it happen primarily when IE is open? Any particular sites you are visiting? Since the function and library are listed as unknown, I would hazard to guess it is un-friendly Java Applet trying to auto-install something on your computer, but failing to do so.

It would be interesting to see the full DLL list in the dump, to see if there is a discernable application or applet causing the bug.

Dexter...

Thrax

I would dump the JVM, and reinstall it.

profdlp

Thrax had this to say
I would dump the JVM, and reinstall it.

I agree. Dexter made some excellent points, too.

I can send you MSJava VM Version 5.0.3319.0 (about 5MB) if you need it.

...seeing as how you ain't a-gonna get it from MS no more...

Dexter

Thrax had this to say
I would dump the JVM, and reinstall it.

Agreed, that is a good place to start.

Dexter...

Reign

Yeah i just downloaded Java from Suns website...

It happens randomly when i have many windows open, so i thought it was a ram problem. But now that these files have been popping up.. it could be another issue.

If it helps.. heres the dll list:

Dynamic libraries:
0x00400000 - 0x00419000 C:\Program Files\Internet Explorer\iexplore.exe
0x77F50000 - 0x77FF9000 C:\WINDOWS\System32\ntdll.dll
0x77E60000 - 0x77F45000 C:\WINDOWS\system32\kernel32.dll
0x77C10000 - 0x77C63000 C:\WINDOWS\system32\msvcrt.dll
0x77D40000 - 0x77DCD000 C:\WINDOWS\system32\USER32.dll
0x77C70000 - 0x77CB0000 C:\WINDOWS\system32\GDI32.dll
0x77DD0000 - 0x77E5B000 C:\WINDOWS\system32\ADVAPI32.dll
0x77CC0000 - 0x77D35000 C:\WINDOWS\system32\RPCRT4.dll
0x772D0000 - 0x77333000 C:\WINDOWS\system32\SHLWAPI.dll
0x769C0000 - 0x76B09000 C:\WINDOWS\System32\SHDOCVW.dll
0x71950000 - 0x71A34000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll
0x773D0000 - 0x77BC4000 C:\WINDOWS\system32\SHELL32.dll
0x77340000 - 0x773CB000 C:\WINDOWS\system32\comctl32.dll
0x771B0000 - 0x772CA000 C:\WINDOWS\system32\ole32.dll
0x5AD70000 - 0x5ADA4000 C:\WINDOWS\system32\uxtheme.dll
0x75F80000 - 0x7607C000 C:\WINDOWS\System32\BROWSEUI.dll
0x72430000 - 0x72442000 C:\WINDOWS\System32\browselc.dll
0x75F40000 - 0x75F5D000 C:\WINDOWS\system32\appHelp.dll
0x76FD0000 - 0x77048000 C:\WINDOWS\System32\CLBCATQ.DLL
0x77120000 - 0x771AB000 C:\WINDOWS\system32\OLEAUT32.dll
0x77050000 - 0x77115000 C:\WINDOWS\System32\COMRes.dll
0x77C00000 - 0x77C07000 C:\WINDOWS\system32\VERSION.dll
0x76200000 - 0x76297000 C:\WINDOWS\system32\WININET.dll
0x762C0000 - 0x7634A000 C:\WINDOWS\system32\CRYPT32.dll
0x762A0000 - 0x762AF000 C:\WINDOWS\system32\MSASN1.dll
0x76F90000 - 0x76FA0000 C:\WINDOWS\System32\Secur32.dll
0x76620000 - 0x7666E000 C:\WINDOWS\System32\cscui.dll
0x76600000 - 0x7661B000 C:\WINDOWS\System32\CSCDLL.dll
0x76670000 - 0x76754000 C:\WINDOWS\System32\SETUPAPI.dll
0x10000000 - 0x1000B000 C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
0x01B50000 - 0x01B6C000 C:\Program Files\Norton AntiVirus\NavShExt.dll
0x01B70000 - 0x01B8A000 C:\WINDOWS\System32\ccTrust.dll
0x76080000 - 0x760E1000 C:\WINDOWS\System32\MSVCP60.dll
0x76B20000 - 0x76B35000 C:\WINDOWS\System32\ATL.DLL
0x760F0000 - 0x76168000 C:\WINDOWS\system32\urlmon.dll
0x74810000 - 0x74ABD000 C:\WINDOWS\System32\mshtml.dll
0x76170000 - 0x761F8000 C:\WINDOWS\System32\shdoclc.dll
0x74770000 - 0x747FF000 C:\WINDOWS\System32\MLANG.dll
0x76400000 - 0x765FB000 C:\WINDOWS\System32\msi.dll
0x75E90000 - 0x75F31000 C:\WINDOWS\System32\SXS.DLL
0x746F0000 - 0x74719000 C:\WINDOWS\System32\msimtf.dll
0x74720000 - 0x7476B000 C:\WINDOWS\System32\MSCTF.dll
0x746C0000 - 0x746E7000 C:\WINDOWS\System32\MSLS31.DLL
0x76390000 - 0x763AA000 C:\WINDOWS\System32\IMM32.DLL
0x32520000 - 0x32532000 C:\Program Files\Microsoft Office\Office10\msohev.dll
0x1C000000 - 0x1C006000 C:\Program Files\AIM\idlemon.dll
0x71AD0000 - 0x71AD8000 C:\WINDOWS\System32\wsock32.dll
0x71AB0000 - 0x71AC5000 C:\WINDOWS\System32\WS2_32.dll
0x71AA0000 - 0x71AA8000 C:\WINDOWS\System32\WS2HELP.dll
0x71A50000 - 0x71A8B000 C:\WINDOWS\system32\mswsock.dll
0x76EE0000 - 0x76F17000 C:\WINDOWS\System32\RASAPI32.DLL
0x76E90000 - 0x76EA1000 C:\WINDOWS\System32\rasman.dll
0x71C20000 - 0x71C6F000 C:\WINDOWS\System32\NETAPI32.dll
0x76EB0000 - 0x76EDA000 C:\WINDOWS\System32\TAPI32.dll
0x76E80000 - 0x76E8D000 C:\WINDOWS\System32\rtutils.dll
0x76B40000 - 0x76B6C000 C:\WINDOWS\System32\WINMM.dll
0x71A90000 - 0x71A98000 C:\WINDOWS\System32\wshtcpip.dll
0x722B0000 - 0x722B5000 C:\WINDOWS\System32\sensapi.dll
0x75A70000 - 0x75B13000 C:\WINDOWS\system32\USERENV.dll
0x76F20000 - 0x76F45000 C:\WINDOWS\System32\DNSAPI.dll
0x76FB0000 - 0x76FB7000 C:\WINDOWS\System32\winrnr.dll
0x76F60000 - 0x76F8C000 C:\WINDOWS\system32\WLDAP32.dll
0x76FC0000 - 0x76FC5000 C:\WINDOWS\System32\rasadhlp.dll
0x028D0000 - 0x028EB000 C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll
0x029F0000 - 0x02A0E000 C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll
0x76C30000 - 0x76C5B000 C:\WINDOWS\System32\wintrust.dll
0x76C90000 - 0x76CB2000 C:\WINDOWS\system32\IMAGEHLP.dll
0x0FFD0000 - 0x0FFF2000 C:\WINDOWS\System32\rsaenh.dll
0x73D50000 - 0x73D60000 C:\WINDOWS\System32\cryptnet.dll
0x75C50000 - 0x75CE1000 c:\windows\system32\jscript.dll
0x6BDD0000 - 0x6BE03000 C:\WINDOWS\System32\dxtrans.dll
0x6D430000 - 0x6D439000 C:\WINDOWS\System32\ddrawex.dll
0x73760000 - 0x737A5000 C:\WINDOWS\System32\DDRAW.dll
0x73BC0000 - 0x73BC6000 C:\WINDOWS\System32\DCIMAN32.dll
0x6BE10000 - 0x6BE65000 C:\WINDOWS\System32\dxtmsft.dll
0x71D40000 - 0x71D5B000 C:\WINDOWS\system32\ACTXPRXY.DLL
0x74CB0000 - 0x74D1F000 C:\WINDOWS\System32\mshtmled.dll
0x5FF20000 - 0x5FF43000 C:\WINDOWS\System32\MSRATING.DLL
0x5FF50000 - 0x5FF61000 C:\WINDOWS\System32\msratelc.dll
0x763B0000 - 0x763F5000 C:\WINDOWS\system32\comdlg32.dll
0x76990000 - 0x769B4000 C:\WINDOWS\System32\ntshrui.dll
0x76980000 - 0x76987000 C:\WINDOWS\System32\LINKINFO.dll
0x6D440000 - 0x6D450000 C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll
0x5EDD0000 - 0x5EDEA000 C:\WINDOWS\System32\OLEPRO32.DLL
0x6D310000 - 0x6D327000 C:\Program Files\Java\j2re1.4.2_01\bin\jpiexp32.dll
0x6D380000 - 0x6D398000 C:\Program Files\Java\j2re1.4.2_01\bin\jpishare.dll
0x08000000 - 0x08136000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\client\jvm.dll
0x07250000 - 0x07257000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\hpi.dll
0x07270000 - 0x0727E000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\verify.dll
0x07280000 - 0x07298000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\java.dll
0x072A0000 - 0x072AD000 C:\PROGRA~1\Java\J2RE14~1.2_0\bin\zip.dll
0x07CF0000 - 0x07DFF000 C:\Program Files\Java\j2re1.4.2_01\bin\awt.dll
0x73000000 - 0x73023000 C:\WINDOWS\System32\WINSPOOL.DRV
0x07E10000 - 0x07E60000 C:\Program Files\Java\j2re1.4.2_01\bin\fontmanager.dll
0x73940000 - 0x73A07000 C:\WINDOWS\System32\D3DIM700.DLL
0x6D2F0000 - 0x6D304000 C:\Program Files\Java\j2re1.4.2_01\bin\jpicom32.dll
0x049E0000 - 0x049EF000 C:\Program Files\Java\j2re1.4.2_01\bin\net.dll
0x6D510000 - 0x6D58C000 C:\WINDOWS\system32\DBGHELP.dll
0x07F70000 - 0x07F93000 C:\Program Files\Java\j2re1.4.2_01\bin\jsound.dll
0x72D20000 - 0x72D29000 C:\WINDOWS\System32\wdmaud.drv
0x72D10000 - 0x72D18000 C:\WINDOWS\System32\msacm32.drv
0x77BE0000 - 0x77BF4000 C:\WINDOWS\System32\MSACM32.dll
0x77BD0000 - 0x77BD7000 C:\WINDOWS\System32\midimap.dll
0x76BF0000 - 0x76BFB000 C:\WINDOWS\System32\PSAPI.DLL

mmonnin

Get the microsoft JVM. Keep it on file too. Its much better than Suns.

Dexter

Is there a common thread to having certain pages open? IE, when you have many open, is there a site that is always on that list? EG, a W@rez site or a pr0n site that may be trying to execute some malicious Java script, like a hijacker or auto-installer?

0x028D0000 - 0x028EB000 C:\Program Files\Common Files\Symantec Shared\Script Blocking\scrauth.dll
0x029F0000 - 0x02A0E000 C:\Program Files\Common Files\Symantec Shared\Script Blocking\ScrBlock.dll

I note that your Norton has script blocking enabled, which is good. If you are not accessing the kind of sites I mentioned above, you could try temporarily disabling your script blocking, and see what happens, but indoing so, you run the risk that if it is a malicious script (which I don't know, but is always something to keep in mind in terms of security) then that script may now execute. My thinking here is that perhaps the script is failing because of Norton blocking it's execution. That could be a good thing.

Dexter...

mmonnin

I remember once I think I had a virus or spyware that would put some txt file on my desktop. I would delete and then come back and it was there again.