Application 1000 errors

Has anyone encountered errors like this in Event Viewer.  How can I determine if this is an Application problem or an Windows 2003 error?


Event Type:      Error
Event Source:      Application Error
Event Category:      None
Event ID:      1000
Date:            02/05/2008
Time:            9:15:22 AM
User:            N/A
Computer:      Server1
Description:
Faulting application pre.exe, version 2.0.0.0, faulting module pre.exe, version 2.0.0.0, fault address 0x0018ed2b.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 6c 70 6d   ure  pre
0018: 2e 65 78 65 20 32 2e 30   .exe 2.0
0020: 2e 30 2e 30 20 69 6e 20   .0.0 in
0028: 6c 70 6d 2e 65 78 65 20   pre.exe
0030: 32 2e 30 2e 30 2e 30 20   2.0.0.0
0038: 61 74 20 6f 66 66 73 65   at offse
0040: 74 20 30 30 31 38 65 64   t 0018ed
0048: 32 62 0d 0a               2b..    
LVL 1
mystikal1000Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

santhoshuCommented:
Find out which folder is pre.exe residing and also find out which application is using that folder.
You will have to contact that application vendor to get this fixed.  Event ID 1000 is a generic one.
0
briancassinCommented:
It is calling pre.exe which appears to be one of two things either a malware or a legit program depending on where it is located. From what I see it is a malware

You need to find where this PRE.EXE is located if it is in a temp file then it is definately a malware.

You will need to scan your machine using the following tools I will post them in the next post
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
briancassinCommented:
Download  combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also run these

your going to need some anti spyware /malware utlities run too

http://www.superantispyware.com

http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11    - select to only download and install spyware doctor.

Additionally you may want to run a rootkit tester...
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx
0
Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

mystikal1000Author Commented:
Sorry I should of told you this pre.exe is ingrown home application on the windows 2003 servers, its not malware...
0
briancassinCommented:
then your going to need to look at that application using a debugging tool to see what it is doing.  If that is an application that was create in house your programmers are going to have to use debuggers and look at its memory usage it is crashing itself.

Something like ollydbg or microsofts debugger will be needed
0
santhoshuCommented:
Yes.  As I mentioned in my first comment, this is something the developers of the pre.exe should look and resolve.
0
briancassinCommented:
santhoshu,

wasn't trying to copy your answer had the questioner told me PRE.EXE was an in house app I would have simply agreed with you in the first place. I thought it was a malware because of the very generic name and a malware that is known to carry that name.
0
santhoshuCommented:
no problem braincassin.  you are right.  I was just cursing myself of not seeing it from the malware view (as the author didn't inform us that it is a in house applicaiton).  Your thoughts were in the right direction.
:)
0
mystikal1000Author Commented:
Sorry I should of mentioned the apps is homegrown...

Thanks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.