5 replies to this topic

[TUTUTKAMEN]

PostPosted: Fri May 27, 2005 9:16 am Post subject: I sure could use help over here. Thanx
Reply with quote Edit/Delete this post
Anyone explain this to me in english. Popped up on my desktop a little while ago. Does this mean my firewall has been breached and I have been hacked or what?

I appreciate any assistance I recieve. Respectfully, TUT Rolling Eyes


Unexpected Signal : EXCEPTION_ACCESS_VIOLATION occurred at PC
Function=[Unknown.]
Library=C:\PROGRA~1\Java\J2RE14~1.1_0\bin\client\jvm.dll

NOTE: We are unable to locate the function name symbol for the error
just occurred. Please refer to release documentation for possible
reason and solutions.


Current Java thread:
at java.lang.Thread.run(Unknown Source)

Dynamic libraries:
0x00400000 - 0x00A69000 C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
0x7C900000 - 0x7C9B0000 C:\WINDOWS\system32\ntdll.dll
0x7C800000 - 0x7C8F4000 C:\WINDOWS\system32\kernel32.dll
0x60070000 - 0x600C4000 C:\PROGRA~1\MOZILL~1\js3250.dll
0x60130000 - 0x60156000 C:\PROGRA~1\MOZILL~1\nspr4.dll
0x77DD0000 - 0x77E6B000 C:\WINDOWS\system32\ADVAPI32.dll
0x77E70000 - 0x77F01000 C:\WINDOWS\system32\RPCRT4.dll
0x71AD0000 - 0x71AD9000 C:\WINDOWS\system32\WSOCK32.dll
0x71AB0000 - 0x71AC7000 C:\WINDOWS\system32\WS2_32.dll
0x77C10000 - 0x77C68000 C:\WINDOWS\system32\msvcrt.dll
0x71AA0000 - 0x71AA8000 C:\WINDOWS\system32\WS2HELP.dll
0x602D0000 - 0x60330000 C:\PROGRA~1\MOZILL~1\xpcom.dll
0x60200000 - 0x60207000 C:\PROGRA~1\MOZILL~1\plc4.dll
0x60210000 - 0x60216000 C:\PROGRA~1\MOZILL~1\plds4.dll
0x7C9C0000 - 0x7D1D4000 C:\WINDOWS\system32\SHELL32.dll
0x77F10000 - 0x77F56000 C:\WINDOWS\system32\GDI32.dll
0x77D40000 - 0x77DD0000 C:\WINDOWS\system32\USER32.dll
0x77F60000 - 0x77FD6000 C:\WINDOWS\system32\SHLWAPI.dll
0x774E0000 - 0x7761D000 C:\WINDOWS\system32\ole32.dll
0x60230000 - 0x6024A000 C:\PROGRA~1\MOZILL~1\smime3.dll
0x60160000 - 0x601B5000 C:\PROGRA~1\MOZILL~1\nss3.dll
0x60250000 - 0x602AA000 C:\PROGRA~1\MOZILL~1\softokn3.dll
0x602B0000 - 0x602CB000 C:\PROGRA~1\MOZILL~1\ssl3.dll
0x60330000 - 0x60344000 C:\PROGRA~1\MOZILL~1\xpcom_compat.dll
0x763B0000 - 0x763F9000 C:\WINDOWS\system32\comdlg32.dll
0x773D0000 - 0x774D2000 C:\WINDOWS\WinSxS\X86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\COMCTL32.dll
0x77120000 - 0x771AC000 C:\WINDOWS\system32\OLEAUT32.dll
0x77C00000 - 0x77C08000 C:\WINDOWS\system32\VERSION.dll
0x73000000 - 0x73026000 C:\WINDOWS\system32\WINSPOOL.DRV
0x5CB70000 - 0x5CB96000 C:\WINDOWS\system32\ShimEng.dll
0x71590000 - 0x71604000 C:\WINDOWS\AppPatch\AcLayers.DLL
0x769C0000 - 0x76A73000 C:\WINDOWS\system32\USERENV.dll
0x6F880000 - 0x6FA4A000 C:\WINDOWS\AppPatch\AcGenral.DLL
0x76B40000 - 0x76B6D000 C:\WINDOWS\system32\WINMM.dll
0x77BE0000 - 0x77BF5000 C:\WINDOWS\system32\MSACM32.dll
0x5AD70000 - 0x5ADA8000 C:\WINDOWS\system32\UxTheme.dll
0x76390000 - 0x763AD000 C:\WINDOWS\system32\IMM32.DLL
0x629C0000 - 0x629C9000 C:\WINDOWS\system32\LPK.DLL
0x74D90000 - 0x74DFB000 C:\WINDOWS\system32\USP10.dll
0x71A50000 - 0x71A8F000 C:\WINDOWS\system32\mswsock.dll
0x662B0000 - 0x66308000 C:\WINDOWS\system32\hnetcfg.dll
0x58D40000 - 0x58D47000 C:\WINDOWS\System32\wship6.dll
0x63000000 - 0x63014000 C:\WINDOWS\system32\SynTPFcs.dll
0x77B40000 - 0x77B62000 C:\WINDOWS\system32\apphelp.dll
0x755C0000 - 0x755EE000 C:\WINDOWS\system32\msctfime.ime
0x77920000 - 0x77A13000 C:\WINDOWS\system32\SETUPAPI.dll
0x76FD0000 - 0x7704F000 C:\WINDOWS\system32\CLBCATQ.DLL
0x77050000 - 0x77115000 C:\WINDOWS\system32\COMRes.dll
0x10000000 - 0x10006000 C:\PROGRA~1\MOZILL~1\components\qfaservices.dll
0x01650000 - 0x01675000 C:\PROGRA~1\MOZILL~1\components\FULLSOFT.DLL
0x71A90000 - 0x71A98000 C:\WINDOWS\System32\wshtcpip.dll
0x746F0000 - 0x7471A000 C:\WINDOWS\System32\msimtf.dll
0x74720000 - 0x7476B000 C:\WINDOWS\System32\MSCTF.dll
0x6D830000 - 0x6D83F000 C:\Program Files\Java\j2re1.4.1_02\bin\NPOJI610.dll
0x6D7A0000 - 0x6D7B7000 C:\Program Files\Java\j2re1.4.1_02\bin\jpins32.dll
0x6D7C0000 - 0x6D7D4000 C:\Program Files\Java\j2re1.4.1_02\bin\jpishare.dll
0x60020000 - 0x6002D000 C:\PROGRA~1\MOZILL~1\components\jar50.dll
0x20000000 - 0x202C5000 C:\WINDOWS\system32\xpsp2res.dll
0x76F20000 - 0x76F47000 C:\WINDOWS\system32\DNSAPI.dll
0x76FC0000 - 0x76FC6000 C:\WINDOWS\system32\rasadhlp.dll
0x76380000 - 0x76385000 C:\WINDOWS\system32\msimg32.dll
0x77A80000 - 0x77B14000 C:\WINDOWS\system32\CRYPT32.dll
0x77B20000 - 0x77B32000 C:\WINDOWS\system32\MSASN1.dll
0x75CF0000 - 0x75D81000 C:\WINDOWS\System32\mlang.dll
0x76C30000 - 0x76C5E000 C:\WINDOWS\system32\WINTRUST.dll
0x76C90000 - 0x76CB8000 C:\WINDOWS\system32\IMAGEHLP.dll
0x72D20000 - 0x72D29000 C:\WINDOWS\system32\wdmaud.drv
0x72D10000 - 0x72D18000 C:\WINDOWS\system32\msacm32.drv
0x77BD0000 - 0x77BD7000 C:\WINDOWS\system32\midimap.dll
0x67DD0000 - 0x67DE3000 C:\Program Files\IncrediMail\bin\ImHook.dll
0x601C0000 - 0x601F6000 C:\PROGRA~1\MOZILL~1\nssckbi.dll
0x02560000 - 0x026EE000 C:\PROGRA~1\MOZILL~1\plugins\npswf32.dll
0x771B0000 - 0x77256000 C:\WINDOWS\system32\WININET.dll
0x69000000 - 0x6900E000 C:\WINDOWS\system32\Macromed\Common\SwSupport.dll
0x77A20000 - 0x77A74000 C:\WINDOWS\System32\cscui.dll
0x76600000 - 0x7661D000 C:\WINDOWS\System32\CSCDLL.dll
0x75F80000 - 0x7607C000 C:\WINDOWS\System32\browseui.dll
0x76990000 - 0x769B5000 C:\WINDOWS\system32\ntshrui.dll
0x76B20000 - 0x76B31000 C:\WINDOWS\system32\ATL.DLL
0x5B860000 - 0x5B8B4000 C:\WINDOWS\system32\NETAPI32.dll
0x77760000 - 0x778CC000 C:\WINDOWS\System32\shdocvw.dll
0x754D0000 - 0x75550000 C:\WINDOWS\system32\CRYPTUI.dll
0x76F60000 - 0x76F8C000 C:\WINDOWS\system32\WLDAP32.dll
0x4EC50000 - 0x4EDF3000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\gdiplus.dll
0x73B30000 - 0x73B44000 C:\WINDOWS\system32\mscms.dll
0x5CB00000 - 0x5CB6E000 C:\WINDOWS\System32\shimgvw.dll
0x01F40000 - 0x01F50000 C:\Program Files\ProxyWay\hook.dll
0x6D340000 - 0x6D46A000 C:\PROGRA~1\Java\J2RE14~1.1_0\bin\client\jvm.dll
0x6D1E0000 - 0x6D1E7000 C:\PROGRA~1\Java\J2RE14~1.1_0\bin\hpi.dll
0x6D310000 - 0x6D31E000 C:\PROGRA~1\Java\J2RE14~1.1_0\bin\verify.dll
0x6D220000 - 0x6D239000 C:\PROGRA~1\Java\J2RE14~1.1_0\bin\java.dll
0x6D330000 - 0x6D33D000 C:\PROGRA~1\Java\J2RE14~1.1_0\bin\zip.dll
0x6D000000 - 0x6D105000 C:\Program Files\Java\j2re1.4.1_02\bin\awt.dll
0x6D190000 - 0x6D1E0000 C:\Program Files\Java\j2re1.4.1_02\bin\fontmanager.dll
0x73760000 - 0x737A9000 C:\WINDOWS\system32\ddraw.dll
0x73BC0000 - 0x73BC6000 C:\WINDOWS\system32\DCIMAN32.dll
0x73940000 - 0x73A10000 C:\WINDOWS\system32\D3DIM700.DLL
0x6D2E0000 - 0x6D2EE000 C:\Program Files\Java\j2re1.4.1_02\bin\net.dll
0x76FB0000 - 0x76FB8000 C:\WINDOWS\System32\winrnr.dll
0x6D140000 - 0x6D162000 C:\Program Files\Java\j2re1.4.1_02\bin\dcpr.dll
0x74B30000 - 0x74B76000 C:\WINDOWS\System32\webcheck.dll
0x77FE0000 - 0x77FF1000 C:\WINDOWS\system32\Secur32.dll
0x77260000 - 0x772FE000 C:\WINDOWS\system32\urlmon.dll
0x7D4A0000 - 0x7D785000 C:\WINDOWS\System32\mshtml.dll
0x746C0000 - 0x746E7000 C:\WINDOWS\System32\msls31.dll
0x59A60000 - 0x59B01000 C:\WINDOWS\system32\DBGHELP.dll
0x76BF0000 - 0x76BFB000 C:\WINDOWS\system32\PSAPI.DLL

Local Time = Thu May 26 22:35:45 2005
Elapsed Time = 6388
#
# HotSpot Virtual Machine Error : EXCEPTION_ACCESS_VIOLATION
# Error ID : 4F530E43505002E6
# Please report this error at
# http://java.sun.com/...n/bugreport.cgi
#
# Java VM: Java HotSpot™ Client VM (1.4.1_02-b06 mixed mode)
#


Java knows nothing is that your error ID?

Thank you, who ever replies. It has been a problem and a half.

TUT

[gunner]

msctfime.ime is an invalid Korean language input. Probably searched a site or whatever with korean language?

[DjLizard]

Korean? What the .. ? No...

Try uninstalling Java completely from Add/Remove programs, and download and install the one you find here: http://ryanvm.msfn.org/

(it is much newer than your current version, and has been customized to be a silent-install -- it rules)

[TUTUTKAMEN]

Thanx Lizard, I upgraded to jre 5 shortly after this incident after I did a system restore to the day before and recovered all my password access's.

However my initial question still remains. The cause?

Quote

msctfime.ime is an invalid Korean language input. Probably searched a site or whatever with korean language?

Now this is interesting. I tracked down a clever clown, i do not believe he is malevolent, however, he was running a hack program. I can not remember the name of it. I do know he was bouncing it off a North Korean signal in the end to cover his tracks. Could this be the trigger. What say Gunner?

Thanx

TUT

Because I have been to no Korean language sites. Could it have been an external probe, a hack.

[DjLizard]

This is why I said "Korean? What the.. ? No." : that file has nothing to do with Korean. At all. Ever.

It's part of the framework that makes alternate input method editors work (IME). IME makes foreign languages work. "msctfime.ime" in no way represents any individual language.

[TUTUTKAMEN]

Thank you sir have a good day.

Tut