disconecting from the internet!

[rstanley]

for some reasion when I disconect from the internet a window comes up which says.

This program has performed an illegal operation and will be shut down.
then when I go details it says.

IEXPLORE caused an invalid page fault in
module KERNEL32.DLL at 0167:bff87eb5.
Registers:
EAX=c00300ec CS=0167 EIP=bff87eb5 EFLGS=00010206
EBX=01a5fb1c SS=016f ESP=01a1fff0 EBP=01a2005c
ECX=00000000 DS=016f ESI=8169c40c FS=5917
EDX=8169c414 ES=016f EDI=00c7e79c GS=0000
Bytes at CS:EIP:
53 56 57 8b 30 83 7d 10 01 8b 4e 38 89 4d f8 75
Stack dump:

This really isnt much of a problem, atleast from what I can tell, but what is the problem is that I cant close the window.

Eany help will be appreciated!

 

[Rollin' Rog]

The error is probably being caused by a conflict with an installed program. Usually this occurs with hidden "spyware" that comes bundled with certain downloads. McAfee's antivirus program can also cause a kernel32.dll error when closing a browser window.

You may need to install and run Ad-aware from lavasoft

www.lavasoftusa.com/aaw.html

But first we should have a look at what you have loading and running at startup. We can see this if you do the following: Go to start and run msinfo32

Click on "software environment" and "startup programs". Then click: edit>select all>edit>copy. You can paste the copied text in your next reply.

Also if you haven't run an updated antivirus scan, you can do an online one here:

http://housecall.antivirus.com/pc_housecall/

 

[rstanley]

I use mcafee's antivirus program, but I havent updated it in quite some time. I've never had this problem before. Recently I downloaded another antivirus (AVG 6.0), Maybe this is the problem. If so how do I correct it. By the way when I try to open msinfo32, it says, cannot find msinfo32 (or one of its conponents). Make sure the path and filename are correct and that all required libaries are available.

Thanks for all the help!!

 

[Rollin' Rog]

What Windows version are you running? Msinfo32 is not available in Win95.

If you are running two antivirus programs at the same time, you need to disable or uninstall one -- otherwise you are just asking for trouble. They will both try to act at the same time and one or both is likely to fail when needed.

We can use another method to check your startups by using the Startuplog.com application available here:

http://home.earthlink.net/~rmbox/Reticulated/Toys.html

Download and unzip it. When you run it, it will place the file startuplog.txt on your desktop. Just copy and paste the entire contents of that in your next reply. Stubbpaths.txt is not needed.

 

[rstanley]

Thats strange, I'm useing windows 98.

 

[rstanley]

The following is from startUp log, The following is a list of your current Start-Ups
__________________________________________________________________________
__________________________________________________________________________

1. HKLM Run - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="c:\\windows\\scanregw.exe /autorun"
"TaskMonitor"="c:\\windows\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"Compaq Internet Setup"="C:\\Compaq\\Internet\\InetWizard.exe /RUN"
"CISrvr Program"="C:\\COMPAQ\\INTERNET\\CISRVR.EXE"
"Service Connection"="c:\\cpqs\\bwtools\\bwtray.exe"
"AvconsoleEXE"="C:\\Program Files\\Network Associates\\McAfee VirusScan\\avconsol.exe /minimize"
"VsecomrEXE"="C:\\Program Files\\Network Associates\\McAfee VirusScan\\VSECOMR.EXE"
"Vshwin32EXE"="C:\\PROGRAM FILES\\NETWORK ASSOCIATES\\MCAFEE VIRUSSCAN\\VSHWIN32.EXE"
"VsStatEXE"="C:\\Program Files\\Network Associates\\McAfee VirusScan\\VSSTAT.EXE /SHOWWARNING"
"CPQEASYACC"="C:\\Program Files\\Compaq\\Easy Access Button Support\\cpqeadm.exe"
"EACLEAN"="C:\\Program Files\\Compaq\\Easy Access Button Support\\eaclean.exe"
"CompaqPrinTray"="PrinTray.exe"
"CIJ3P2PSERVER"="CIJ3P2PS.EXE"
"EM_EXEC"="C:\\MOUSE\\SYSTEM\\EM_EXEC.EXE"
"McAfeeWebScanX"="C:\\PROGRAM FILES\\NETWORK ASSOCIATES\\MCAFEE VIRUSSCAN\\WebScanX.Exe"
"AVG_CC"="C:\\PROGRA~1\\GRISOFT\\AVG6\\avgcc32.exe /STARTUP"


==========================================================================
__________________________________________________________________________

2. HKCU Run - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Reminder"="C:\\Program Files\\Microsoft Money\\System\\reminder.exe"
"AIM"="C:\\PROGRAM FILES\\AIM95\\aim.exe -cnetwait.odl"
"NSCheck"="C:\\WINDOWS\\SYSTEM\\NSCHECK.EXE /check"


==========================================================================
__________________________________________________________________________

3. HKLM RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

4. HKCU RunOnce - Registry

[RegPath]
"StartUp"


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


==========================================================================
__________________________________________________________________________

5. HKLM RunServices - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"CPQDFWAG"="C:\\WINDOWS\\cpqdiag\\CpqDfwAg.exe -I"
"Vshwin32EXE"="C:\\PROGRAM FILES\\NETWORK ASSOCIATES\\MCAFEE VIRUSSCAN\\VSHWIN32.EXE"
"McAfeeWebScanX"="C:\\PROGRAM FILES\\NETWORK ASSOCIATES\\MCAFEE VIRUSSCAN\\WebScanX.Exe /RUNSERVICES"
"Avgserv9.exe"="C:\\PROGRA~1\\GRISOFT\\AVG6\\Avgserv9.exe"


==========================================================================
__________________________________________________________________________

6. HKLM RunServicesOnce - Registry

[RegPath]
"StartUp"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


==========================================================================
__________________________________________________________________________

7. WIN.INI File - (c:\windows\win.ini)

Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.


These are the run and load lines in your WIN.INI file

run=

load=

==========================================================================
__________________________________________________________________________

8. SYSTEM.INI File - (c:\windows\system.ini)

Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.


This is the shell line in your SYSTEM.INI file

shell=Explorer.exe

==========================================================================
__________________________________________________________________________

9. AUTOEXEC.BAT File - (c:\autoexec.bat)

(Some trojans have been known to start from this file)


These are your program startups and set paths in your autoexec.bat file

@C:\PROGRA~1\GRISOFT\AVG6\bootup.exe
C:\essolo.com

==========================================================================
__________________________________________________________________________

10. StartUp Folder - (c:\windows\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your StartUp folder

C:\WINDOWS\Start Menu\Programs\StartUp\BackWeb.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\EPSON Background Monitor.lnk

==========================================================================
__________________________________________________________________________

11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

Shortcuts to any program will automatically start when placed here.


These are the shortcuts located in your All Users StartUp folder


*(No start-ups found)*

==========================================================================
__________________________________________________________________________

12. Miscellaneous StartUp Configurations

-============================-
Registry StartUp Directories
-============================-

Should show the Start Menu StartUp and All Users StartUp directories

.....................................................................

[1] HKCU - Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

.....................................................................

[2] HKCU - User Shell Folders

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


.....................................................................

[3] HKLM - Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

.....................................................................

[4] HKLM - User Shell Folders

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


.....................................................................

-=======================-
Registry Shell Spawning
-=======================-

Open Commands for Executable File Types

@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)

@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)

@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)

@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)

@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)

@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)

-=========================-
HKLM RunOnceEx - Registry
-=========================-


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


-=========================-
HKU (.Default) Run - Registry
-=========================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"Reminder"="C:\\Program Files\\Microsoft Money\\System\\reminder.exe"
"AIM"="C:\\PROGRAM FILES\\AIM95\\aim.exe -cnetwait.odl"
"NSCheck"="C:\\WINDOWS\\SYSTEM\\NSCHECK.EXE /check"


-==============================-
HKU (.Default) RunOnce - Registry
-==============================-


[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]


-================================-
StubPaths - Registry (Partial Listing)
-================================-

(Please see the StubPath.txt on your desktop for complete listing)

HKLM\Software\Microsoft\Active Setup\Installed Components


"OldStubPath"="c:\\windows\\SYSTEM\\ie4uinit.exe"
"RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
"StubPath"="c:\\windows\\COMMAND\\sulfnbk.exe /L"
"StubPath"=""

-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-

@echo off

c:\mouse\mouse.exe
LH C:\WINDOWS\COMMAND\MSCDEX.EXE /D:IDECD001 /M:12
C:\essolo.com

-=====================-
Screen Saver Settings (Possible system.ini start-up)
-=====================-

SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\FLYING~2.SCR

==========================================================================
__________________________________________________________________________

- Supplemental Environment Information -

TMP=c:\windows\TEMP
TEMP=C:\windows\TEMP
winbootdir=C:\WINDOWS
PATH=C:\WINDOWS;c:\windows;c:\windows\COMMAND
COMSPEC=C:\WINDOWS\COMMAND.COM
windir=C:\WINDOWS

Thanks again!
==========================================================================
__________________________________________________________________________

- End -

 

[Rollin' Rog]

Did you recently uninstall Office97 ?

http://support.microsoft.com/directory/article.asp?ID=KB;EN-US;Q191190

Do a Find Files search for msinfo32 and mfc40.dll

Are both found?

Right click on mfc40.dll if found and select properties>version -- what is the version number?

Startups don't look too bad, but you definitely need to choose between McAfee and AVG. Personally I would disable or uninstall McAfee.

See this link concerning nscheck -- I think you should uninstall that or uncheck it using msconfig

http://www.pacs-portal.co.uk/startup_pages/n.htm

And see this thread concerning problems with "backweb"

http://forums.techguy.org/showthread.php?s=&threadid=61521&highlight=backweb

 

[rstanley]

I may have recently uninstalled office 97, for I had over 3000 virus infected files, it could have been one of them. You wouldnt happen to know why the net seems to slow down when I play media at the same time. Is this supposed to be happening?


thanks!!!

 

[Rollin' Rog]

If you are playing streaming media (radio station or online music, etc), you are using the same "bandwidth" -- it's the same as downloading multiple files. And McAfee's webscan probably slows things up quite a bit

Otherwise it's just a case of processor overload, there will always be some slow down when you do that.