Application 1000 errors

Posted on 2008-02-05
Medium Priority
Last Modified: 2013-11-21
Has anyone encountered errors like this in Event Viewer.  How can I determine if this is an Application problem or an Windows 2003 error?

Event Type:      Error
Event Source:      Application Error
Event Category:      None
Event ID:      1000
Date:            02/05/2008
Time:            9:15:22 AM
User:            N/A
Computer:      Server1
Faulting application pre.exe, version, faulting module pre.exe, version, fault address 0x0018ed2b.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: 41 70 70 6c 69 63 61 74   Applicat
0008: 69 6f 6e 20 46 61 69 6c   ion Fail
0010: 75 72 65 20 20 6c 70 6d   ure  pre
0018: 2e 65 78 65 20 32 2e 30   .exe 2.0
0020: 2e 30 2e 30 20 69 6e 20   .0.0 in
0028: 6c 70 6d 2e 65 78 65 20   pre.exe
0030: 32 2e 30 2e 30 2e 30 20
0038: 61 74 20 6f 66 66 73 65   at offse
0040: 74 20 30 30 31 38 65 64   t 0018ed
0048: 32 62 0d 0a               2b..    
Question by:mystikal1000
  • 4
  • 3
  • 2
LVL 10

Expert Comment

ID: 20824718
Find out which folder is pre.exe residing and also find out which application is using that folder.
You will have to contact that application vendor to get this fixed.  Event ID 1000 is a generic one.
LVL 21

Accepted Solution

briancassin earned 2000 total points
ID: 20824759
It is calling pre.exe which appears to be one of two things either a malware or a legit program depending on where it is located. From what I see it is a malware

You need to find where this PRE.EXE is located if it is in a temp file then it is definately a malware.

You will need to scan your machine using the following tools I will post them in the next post
LVL 21

Assisted Solution

briancassin earned 2000 total points
ID: 20824783
Download  combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Also run these

your going to need some anti spyware /malware utlities run too


http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it

http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11    - select to only download and install spyware doctor.

Additionally you may want to run a rootkit tester...
The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!


Author Comment

ID: 20825203
Sorry I should of told you this pre.exe is ingrown home application on the windows 2003 servers, its not malware...
LVL 21

Expert Comment

ID: 20825343
then your going to need to look at that application using a debugging tool to see what it is doing.  If that is an application that was create in house your programmers are going to have to use debuggers and look at its memory usage it is crashing itself.

Something like ollydbg or microsofts debugger will be needed
LVL 10

Expert Comment

ID: 20825407
Yes.  As I mentioned in my first comment, this is something the developers of the pre.exe should look and resolve.
LVL 21

Expert Comment

ID: 20825437

wasn't trying to copy your answer had the questioner told me PRE.EXE was an in house app I would have simply agreed with you in the first place. I thought it was a malware because of the very generic name and a malware that is known to carry that name.
LVL 10

Expert Comment

ID: 20825722
no problem braincassin.  you are right.  I was just cursing myself of not seeing it from the malware view (as the author didn't inform us that it is a in house applicaiton).  Your thoughts were in the right direction.

Author Closing Comment

ID: 31428177
Sorry I should of mentioned the apps is homegrown...


Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

588 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question