Random 98SE Windows Explorer Illegal Operation 2

[wackydj]

This is an ongoing problem which all past efforts have faild to resolve; a Kernel 32.DLL error appears randomly even when no operations are being performed on the PC. I have removed all start up programmes except Scan reg. Have run SFC (but not in safe mode) and restored Kernal32 from the windows 98SE CD, and also disabled my firewall..however the problem still exists and although it does not effect windows if the box is closed right away, windows does freeze if the error box is left. It does however appear more often when checking stuff like My Computer and disc space. Any help on getting rid of this problem would be very very welcome.

wackydj

 

[TekTippy4U]

Pop the 98 SE CDROM in (or use the IE CD if you installed IE from one) and restart, then Start > Run Msinfo32 > tools > IE Repair Tool..choose Repair, not restore....run it a couple of times before restarting (when it asks, say no for the first few). Using this method we're trying to get all the correct DLL versions for IE. It's possible another installed application either replaced or overwrote a system DLL, or it's a DLL the app uses (usually located in said App's folder, or subfolder) that is the wrong version to use.

also try;
Start > Run Drwatson
and an icon will now sit in the Systray, where you can right click, and choose run Drwatson. A snapshot of Sys will be taken an can be reviewed. After Starting Drwatson thru Start > Run -- let it sit in the Tray, and see if the Kernel32 errors invoke Drwatson first. -- if not, then "after" an error, right click the Tray Icon and run. You have to save the file to review later in more detail....and there's also an Advanced option to show all tabs/details.
See if we can learn something.
Sounds like some DLL probs

Try to post some more info
IE version? and SP1?
Do you recall "when" this started happening...perhaps after installing some software?


TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[wackydj]

Many thanks for your help. I ran Msinfo32 a few times as advised and no problems were found. I then started drwatson and the icon appeared. Very soon the error occured and this time there was file building activity at the bottom of the error box, drwatson?, however as soon as the reeor occured the drwatson icon was removed from the systray. I located it in windows and right clicked but it refused to open or display any log. Am using IE6. I have no clear idea of when this started but it may have bbeen after installing Studio V9. while writting this the error has occured twice, sorry if this is not a lot of help.

regards

wackydj

 

[TekTippy4U]

sounds like malware/spyware.....do a full Virus scan (AVG from Grisoft is free)....D/l and run Adaware and SpyBot 1.3....run them in Safe Mode and Kill the Mofos

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[wackydj]

Many thanks, I ran a number of spyware programmes and a number of problems were found and cleared. So far the problem has not returned. Spykiller and CWS Shredder reported 7 infections in the reg. linked to explorer.

Thanks again

wackydj

 

[wackydj]

Sorry, far to quick in thinking the problem was solved as the error returned again! Running Spybot and other killers reports no problems, but the Kernel 32 error seems to happen at random, removing icons from the Systray although the programmes continue to run. Any further suggestions would be very very welcome.

wackydj

 

[TekTippy4U]

Hi agan wackydj;
IE and/or Explorer are basically crashing and reloading explorer when that happens, same as if you choose Start > Log off <username> and then Log on again. It could be a number of many things.
I suspect though either corrupt password list files, and/or a corrupt user profile.

Do you have User Profiles enabled?
Easy way to look and see is -- go to C:\WINDOWS\Profiles - are there any folders here? (it'll be a username folder, with specific settings for that profile contained in the subfolders below).
I need to know "what" profiles/user specifics you need to keep, though you 'may' have to blow away a profile and start fresh.

If not using Profiles, see this Faq615-1553 from cdogg to delete corrupt password list files, and to logon without havin to type in a password in the future, to logon to windows. If for some reason, you 'need' to type a logon password, then make sure you have your password handy to 're-type' in at prompt, once deleting old .pwl files

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[TekTippy4U]

see this as well;
"Explorer Caused an Invalid Page Fault in Module Kernel32.dll"

http://support.microsoft.com/default.aspx?scid=kb;en-us;187965

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[wackydj]

TT4U

Thanks for your promp reply, I am not at my home PC at present but will check your suggestions later and get back to you.
Thanks
wackydj

 

[wackydj]

Hi TT4U,

In my profiles I have- Home (file folder) under that application data, Mircosoft, Internet explorer, quick launch, Sonic My DVD. I have no idea why these exist as i do not have a log on or as far as i am aware have not set the profiles up. I did install sonic My DVD recently. Each of these items appear as a folder box and not as a tree, clicking on each one poens the next until the last which opens the Sonic application. as a click on the folders the address line gets longer to include the items. Can i get rid of them? Over to you.

Thanks again

wackydj

 

[TekTippy4U]

Haven't used Sonic MyDVD, so don't know if it's (those entries) are "entirely" necessary. The Application install obviously created it's own "Home" Profile on your System. Now - whether it's the application "itself" at fault, or the fact that the User Profile exists for it - I'm not sure.

Do you recall if the app asked for a User name (Profile) during Install?
It's possible the app (MyDVD) is trying to resolve a profile mismatch with IE or Explorer.

I would think that -
If nothing else is in "all" (each successive) of those folders EXCEPT the Application Shortcut for quick launch, I'd say it (the shortcut) can be moved to this folder.
C:\WINDOWS\Application Data\Microsoft\Internet Explorer\Quick Launch
[1] Do you already have a Shortcut in the above listed folder for MyDVD?

Go
Start > Settings > Folder Options > View tab
"Show all files" (tick)
"Hide extensions for known file types" (untick)
click APPLY...OK
Now....navigate to Profiles and look -
In Windows Explorer > View menu > click Details
[2] Does anything else "besides" that shortcut exist in ANY of those folders beneath Profiles? Is it only a shortcut?
[3] Go through the steps in that FAQ I posted and See if -
Control Panel > Passwords > User Profiles tab
Is "All users have the same preferences" ticked?
[4] Do you have the Sonic MyDVD Application exe or zip available for reinstall should something go wrong?? tucked safely away?

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[wackydj]

TT4U,

Thanks, I will try tonight, I did try removing the profile compleatly and removed *.wpw but the problem still occured. One thing that may be of help is that after I re-instlled my fiewall last night it kept reporting that SonicMyDVD was attempting to access the internet, I don't remember if I was asked to set up a profle when installing sonic. I have the installation disc so I may remove the software and re-install. Will check your suggestons tonight and get back to you, again many thanks for you continued help in sorting this, I am determined to eliminate it.

wackydj

 

[TekTippy4U]

wackydj;
Your welcome, that's why we're here;
also check System.ini as shown in the Faq for any stray entries in [password lists] .
Also re run the spyware killing programs, as I see it stopped temporarily and perhaps you got reinfected, and the errors started again. Not good that Sonic is trying to access the internet behind you're back.
Got any of these installed? - KAZAA, GATOR, GAIN, COMET, just to name a few - some can be removed from Add/Remove Programs in Control Panel. Remove any of these, run SpyKillers, and if necessary remove Sonic.

oh,
and just to clarify (probably just a typo) -- the files have the extension *.pwl( for password list files)

and to completely remove the profile as well;
Start > Run REGEDIT
drill to HKEY_USERS\<profilename> (Home?) and remove the whole <profilename> Key

Starting to lean more towards a spyware/malware (nasty App?) problem - might want to try an online trojan scan

http://www.windowsecurity.com/trojanscan/

also see this cocerning SpyBot's Immunize function

http://www.voiceofthepublic.com/SSD/SI/teatimer.swf.html

I found this while perusing some threads - courtesy of someone else here at tek-tips.

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[wackydj]

Hi TT4U

I have been quite busy removing, deleating and checking for spyware. I did find 4 instances of Kazza which I have removed and also taken off MyDVD. Removed profiles from My Computer but was not sure about the path in HKEY_Users, there is a profile name there but it contants strange stuff so left it in place. Did a full trojan scan an all is clean, also ran spyware programmes. So far tonight all is well except for one instance when windows explorer shut down and restarted without the error message appearing. Will report on progress soon but have not found any real cause for the problem as yet.

Thanks

Wackydj

 

[TekTippy4U]

wackydj;
Under HKEY_USERS\<profilename> What is there??..you can Export (it's a Copy) the Profilename key and view and manipulate as a text file if necessary (it "is" a text file with a .reg extension, instead of a .txt extension)

If you go in Regedit and click on that Key (<profilename>) and go
Registry >>Export Registry File ...you'll save a Backup copy , in case it needs to be re-merged into the registry. Save it in a Folder that you can easily find it , just not Desktop..more like anywhere in My Documents or beneath (subfolder)

Then --> Delete that sucker!!!..it's old and leftover and has no use, and can cause mucho problemos

- NOT the HKEY_USERS\.Default -- Don't touch this one!


TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[TekTippy4U]

one more thing;
Go here
and d/l and run CWShredder

also Have you Start > Run SYSEDIT >> System.ini and deleted all found underneath [password lists] area and - File > Save the changes to file??
When you do this, also use Find (*.pwl) to search the whole HDD and delete all .pwl files?? Do this before rebooting.

Now, in [password lists] there's usually One .pwl there, even if you have no Login password, (same as mine) . What happens is - Windows will create a New one on Reboot (both - when deleted in System.ini - and when you outright delete all .pwl files on the HDD using the Find function.).....
Upon a Reboot....just Type in your usual Login Name and leave the login prompt box (password area) blank if it reappears after deleting and click "OK".

Start > look at Logoff <loginName> will give you your Login Name..
*or
Start > Run MSinfo32 it'll say something like On "KF7ES2" as "WackyDj"
*or
Right click My Computer >> Properties it'll say "Registered to" <loginName>
I gave you all these choices in case the name is too long to read entirely from the start menu

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs

 

[Cresby]

This may not be related but I started getting WinExploer "illeagle error" reports and finally nailed it in the "Temporary Internet Files" directory. I was looking for a file (probably lost during such an incedent) and Explorer kept bombing-out. I decided to chase.........

It turned-out to be in one of the internet directories which exitted Explorer when I tried to look at any folder from "Temporary Internet Files" down. Even after cleaning-out all files and cookies in IE5.5 (and Firefox for that matter) next day most of the directories were still there. I supect adware (no virus reports) because it tried to load IE. It was hidden effectively by not displaying.

I managed to delete the files but couldn't replicate the process. So I clicked on a file above "Temporary Internet Files" and used the arrow keys, this meant I was not clicking (and by inference loading) any HTML. I could then delete any folder I chose - all of them from 'IE5 down.

I expect to find them returning but they didn't after the next boot. The chase is still on - until I find the offending app or site. The list is very short and so is my temper................. they have been warned

 

[wackydj]

TT4u, Cresby,

Thanks for the info, I am having a pc-less evening tonight so will try the things suggested on Thusday and get back to you..I am going to crack this....!!
Talk soon

wackydj

 

[wackydj]

Hi Wackydj again,

I will be attempting the profile removal stuff later but one more bit of info, I can force the error by going into windows explorer and opening and closing folders, after the error occures I am excluded from some funtions one of which is creating a new folder, the menue simply fails to appear, also (not sure if relatd) am unable to print Print (grayed out) from the explorer menue but can print by using right click and print on the page. Will report back but am getting frustrated with this one.

wackydj

 

[TekTippy4U]

try it out and let us know;
Thinking corrupt User32.dll, Explorer.exe, Kernel32.dll ...which can all be replaced
WinKey + F --> Find each one - make sure C:\ is "Look In"
User32.dll and Kernel.dll in SYSTEM folder
and
Explorer.exe in WINDOWS folder .

Start > Settings > Folder Options > View > "show all files"....and untick
"hide extensions for known file types"

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs