1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Invalid page fault in kernel32.dll

Discussion in 'Earlier Versions of Windows' started by Joe Soap, Aug 26, 2001.

Thread Status:
Not open for further replies.
Advertisement
  1. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Hi

    For the last few days I've been getting the "invalid page fault in kernel32.dll" error regularly when attempting various things on my pc.

    My OS is Windows 98 SE and I've got 128 M ram.

    The error pops up under the following circumstances:

    1. When I try to access my email (it's similar to hotmail. The url is mail.ananzi.co.za) under IE, once I've entered my username and password and the page starts to load, bang, down she goes.

    Here's the msg:
    IEXPLORE caused an invalid page fault in
    module KERNEL32.DLL at 017f:bff8f963.
    Registers:
    EAX=00000023 CS=017f EIP=bff8f963 EFLGS=00010207
    EBX=00000000 SS=0187 ESP=0156d62c EBP=0156d64c
    ECX=00000068 DS=0187 ESI=81c11870 FS=4567
    EDX=00000000 ES=0187 EDI=83895000 GS=0000
    Bytes at CS:EIP:
    0f b7 3c 5a 0f b6 5d f8 03 fb 0f b7 3c 7a 33 d2
    Stack dump:
    81c11870 83890000 0156de98 00000000 70bd60b8 00000004 0156d806 00000207 0156d688 bff7d115 81c11870 0156de98 0156dede 00000000 00000000 83890000

    2. When I try to burn a cd with NTI cd-maker 2000 professional everything is fine until the application starts the testing process (I usually choose the "test first and then write" option). The testing process appears to do all the preliminaries, fills the cache and then some ways into the test-write (after testing about 23M of approx 580M) it bombs out. And it says:
    CDMKR32 caused an invalid page fault in
    module KERNEL32.DLL at 017f:bff94508.
    Registers:
    EAX=00000000 CS=017f EIP=bff94508 EFLGS=00010283
    EBX=00000084 SS=0187 ESP=008fea18 EBP=00910001
    ECX=cfd87370 DS=0187 ESI=45080000 FS=4cbf
    EDX=bffc9490 ES=0187 EDI=ce7016e0 GS=0000
    Bytes at CS:EIP:
    a4 f6 ff ff e8 9d ee ff ff 0f a4 c2 10 0b c2 e9
    Stack dump:
    00000000 0091b238 bff7c8cc 00000084 0000ea60 00000000 0059ac43 00000084 0000ea60 0091b238 00910001 00000000 00000000 00595d33 0091b238 00910001

    3. Outlook express: I create a new msg and when I click on SEND, this is the result:
    MSIMN caused an invalid page fault in
    module KERNEL32.DLL at 017f:bff8f963.
    Registers:
    EAX=00000011 CS=017f EIP=bff8f963 EFLGS=00010206
    EBX=00000000 SS=0187 ESP=0056d8c4 EBP=0056d8e4
    ECX=00000054 DS=0187 ESI=81c11870 FS=4aef
    EDX=00000000 ES=0187 EDI=83895000 GS=0000
    Bytes at CS:EIP:
    0f b7 3c 5a 0f b6 5d f8 03 fb 0f b7 3c 7a 33 d2
    Stack dump:
    81c11870 83890000 004d35ac 000d0000 bfb742b3 00000000 4800a205 0000d9c8 0056d920 bff7d115 81c11870 004d35ac 004d35ce 00000000 00000000 83890000

    Interestingly enough, Netscape does not bomb. After a while it appears to go slower and I have to reboot to access sites. Only on the very rare occasion does it fall over.

    I've gone through the Win98 troubleshooter bit (graphics accelerator, etc), the housecall scan, testing memory at boot time, Ad Aware scan and cleanup (boy, did it find a lot of junk!), etc, etc. All to no avail. I do not have McAfee virus scan on my pc - I had it but subsequently removed it. I do have Norton anti-virus 2001 installed.

    I've probably done a few other things too and I'm willing to do them again if it helps to solve this problem.

    And that's it. I'm at my wit's end. Any help will be appreciated. Help that solves the problem will be greatly appreciated ;-)

    Cheers
    Joe
     
  2. Bryan

    Bryan

    Joined:
    Jul 3, 1999
    Messages:
    11,942
    Personally, I first like to get a good picture of what's loading in the backgound at startup and go from there. If you can, go <a href=http://home.earthlink.net/~rmbox/Reticulated/Only_IE.html> here</a> and download Startlog.com

    Once it's downloaded, double left click on it to execute it. You'll then see the log appear on the screen at the end. Copy/Paste the contents of the log to a reply here.
     
  3. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Hi Bryan

    Here's the whole lot from startlog.com.

    Thanks
    Joe

    ---------- C:\WINDOWS\desktop\StartUp.Log

    Start-Ups checked at 26/08/2001 19:22:49.10
    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log for Windows 95/98 - Freeware by rmbox
    __________________________________________________________________________
    __________________________________________________________________________

    Comments:

    This is a log of all the programs on your computer that
    are starting automatically every time you start Windows.
    Using this log can be a quick way to spot trojans.

    StartUp Log (version 1.53) - Release Date 8/19/2001

    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log Index

    1. HKLM Run
    2. HKCU Run
    3. HKLM RunOnce
    4. HKCU RunOnce
    5. HKLM RunServices
    6. HKLM RunServicesOnce
    7. WIN.INI file
    8. SYSTEM.INI file
    9. AUTOEXEC.BAT file
    10. StartUp folder
    11. All Users StartUp
    12. Misc. StartUp Configurations

    __________________________________________________________________________
    __________________________________________________________________________

    The following is a list of your current Start-Ups
    __________________________________________________________________________
    __________________________________________________________________________

    1. HKLM Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SystemTray"="SysTray.Exe"
    "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
    "PWSTray"="PwsTray.exe"
    "mdac_runonce"="C:\\WINDOWS\\SYSTEM\\runonce.exe"
    "NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\DEFALERT.EXE"
    "Norton eMail Protect"="C:\\Program Files\\Norton AntiVirus\\POPROXY.EXE"
    "InterBaseGuardian"="C:\\Program Files\\InterBase Corp\\InterBase\\bin\\ibguard.exe"
    "Norton Auto-Protect"="C:\\PROGRA~1\\NORTON~1\\NAVAPW32.EXE /LOADQUIET"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"


    ==========================================================================
    __________________________________________________________________________

    2. HKCU Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Taskbar Display Controls"="RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY"


    ==========================================================================
    __________________________________________________________________________

    3. HKLM RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    4. HKCU RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    5. HKLM RunServices - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "MSDTC"="msdtcw -start"
    "inetinfo.exe"="C:\\WINDOWS\\SYSTEM\\inetsrv\\inetinfo.exe -e w3svc"
    "ScriptBlocking"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\SBServ.exe\" -reg"
    "Machine Debug Manager"="C:\\WINDOWS\\SYSTEM\\MDM.EXE"
    "SchedulingAgent"="mstask.exe"


    ==========================================================================
    __________________________________________________________________________

    6. HKLM RunServicesOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


    ==========================================================================
    __________________________________________________________________________

    7. WIN.INI File - (c:\windows\win.ini)

    Your win.ini run/load lines should look like run= and load= exclusively.
    There should be nothing to the right of the equal signs.


    These are the run and load lines in your WIN.INI file

    run=

    ;load=C:\RIVA128\vi_grm.exe
    ;load=D:\RIVA128\vi_grm.exe

    ==========================================================================
    __________________________________________________________________________

    8. SYSTEM.INI File - (c:\windows\system.ini)

    Your system.ini shell line should look like shell=Explorer.exe exclusively.
    You should only see Explorer.exe following the equal sign.


    This is the shell line in your SYSTEM.INI file

    shell=Explorer.exe

    ==========================================================================
    __________________________________________________________________________

    9. AUTOEXEC.BAT File - (c:\autoexec.bat)

    (Some trojans have been known to start from this file)


    These are your program startups and set paths in your autoexec.bat file

    SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\ORAWIN95\BIN;C:\PROGRA~1\BORLAND\DELPHI5\BIN;C:\PROGRA~1\BORLAND\VBROKER\BIN;C:\PROGRA~1\BORLAND\VBROKER\JRE\BIN;C:\PROGRA~1\BORLAND\DELPHI5\PROJECTS\BPL;C:\PROGRA~1\COMMON~1\BORLAN~1\DEBUGGER\BIN
    SET LIB=%LIB%;%LIB%
    SET INCLUDE=%INCLUDE%;%INCLUDE%
    SET NLSPATH=%NLSPATH%;C:\IBMCON~1\ENCINA\%%L\%%N
    IF EXIST d:\IMNNQ_95\IMNENV.BAT CALL d:\IMNNQ_95\IMNENV.BAT
    SET LOCPATH=d:\IBMDebug\LOCALE;
    SET PATH=%PATH%;d:\IBMDebug\bin;d:\IBMCON~1\ENCINA\bin
    SET NLSPATH=d:\IBMDebug\msg\%L\%N;%NLSPATH%;d:\IBMCON~1\ENCINA\%%L\%%N
    SET CLASSPATH=d:\IBMDebug\lib\dertrjrt.jar;%CLASSPATH%;d:\IBMCON~1\CLASSES;C:\PROGRA~1\BORLAND\VBROKER\lib\vbcpp.jar
    SET DER_DRIVER_PATH=d:\IBMDebug
    REM Environment Settings For McAfee VirusScan
    SET PATH=%PATH%;C:\PROGRA~1\NETWOR~1\MCAFEE~1
    mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
    mode con codepage select=850

    ==========================================================================
    __________________________________________________________________________

    10. StartUp Folder - (c:\windows\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your StartUp folder

    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your All Users StartUp folder


    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    12. Miscellaneous StartUp Configurations

    -============================-
    Registry StartUp Directories
    -============================-

    Should show the Start Menu StartUp and All Users StartUp directories

    .....................................................................

    [1] HKCU - Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

    "Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [2] HKCU - User Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


    .....................................................................

    [3] HKLM - Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

    "Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [4] HKLM - User Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


    .....................................................................

    -=======================-
    Registry Shell Spawning
    -=======================-

    Open Commands for Executable File Types

    @="\"%1\" %*"
    (.exe file - RegPath = HKCR\exefile\shell\open\command)

    @="\"%1\" %*"
    (.com file - RegPath = HKCR\comfile\shell\open\command)

    @="\"%1\" /S"
    (.scr file - RegPath = HKCR\scrfile\shell\open\command)

    @="\"%1\" %*"
    (.bat file - RegPath = HKCR\batfile\shell\open\command)

    @="\"%1\" %*"
    (.pif file - RegPath = HKCR\piffile\shell\open\command)

    @="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
    (.hta file - RegPath = HKCR\htafile\shell\open\command)

    -=========================-
    HKLM RunOnceEx - Registry
    -=========================-


    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


    -====================-
    StubPaths - Registry (Partial Listing)
    -====================-

    (Please see the StubPath.txt on your desktop for complete listing)

    HKLM\Software\Microsoft\Active Setup\Installed Components


    "StubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
    "RealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "OldRealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "StubPath"=""
    "RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "OldRealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "StubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
    "StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
    "StubPath"="C:\\WINDOWS\\msnmgsr1.exe"

    -=================-
    DOSSTART.BAT File - (c:\windows\dosstart.bat)
    -=================-

    C:\WINDOWS\COMMAND\MSCDEX.EXE /D:MTMIDE01 /L:E /M:10

    -=====================-
    Screen Saver Settings (Possible system.ini start-up)
    -=====================-


    ==========================================================================
    __________________________________________________________________________

    - Supplemental Environment Information -

    TMP=C:\WINDOWS\TEMP
    TEMP=C:\WINDOWS\TEMP
    winbootdir=C:\WINDOWS
    COMSPEC=C:\COMMAND.COM
    LIB=;
    INCLUDE=;
    IMNINSTSRV=d:\IMNNQ_95
    IMNINST=help
    LOCPATH=d:\IBMDebug\LOCALE;
    NLSPATH=d:\IBMDebug\msg\N;;C:\IBMCON~1\ENCINA\%L\%N;d:\IBMCON~1\ENCINA\%L\%N
    CLASSPATH=d:\IBMDebug\lib\dertrjrt.jar;;d:\IBMCON~1\CLASSES;C:\PROGRA~1\BORLAND\VBROKER\lib\vbcpp.jar
    DER_DRIVER_PATH=d:\IBMDebug
    PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\ORAWIN95\BIN;C:\PROGRA~1\BORLAND\DELPHI5\BIN;C:\PROGRA~1\BORLAND\VBROKER\BIN;C:\PROGRA~1\BORLAND\VBROKER\JRE\BIN;C:\PROGRA~1\BORLAND\DELPHI5\PROJECTS\BPL;C:\PROGRA~1\COMMON~1\BORLAN~1\DEBUGGER\BIN;D:\IMNNQ_95;D:\IBMDEBUG\BIN;D:\IBMCON~1\ENCINA\BIN;C:\PROGRA~1\NETWOR~1\MCAFEE~1
    windir=C:\WINDOWS

    File - c:\windows\deletefi.ini

    ==========================================================================
    __________________________________________________________________________

    - End -
     
  4. Bryan

    Bryan

    Joined:
    Jul 3, 1999
    Messages:
    11,942
    Joe, I'm on my way out the door so I don't have time to respond in detail but I'm sure other will jump in. I'll check back later.
     
  5. Bryan

    Bryan

    Joined:
    Jul 3, 1999
    Messages:
    11,942
    Before getting to the startup routine, since I'm not sure what you've cleaned up, here's what I suggest you do first to be sure your clean.

    Start>Shutdown>Restart in MSDOS Mode. Once you get an MSDOS prompt, key in the following and press enter after each.

    smartdrv
    deltree /y tempor~1
    deltree /y history
    deltree /y cookies
    exit

    Once Windows restarts do this,

    Start>Settings>CP>InternetOptions>Content>AutoComplete>ClearForms. Also, I'd suggest you also "Clear Passwords" but that's up to you. The effect will be you'll need to reenter any passwords and userids on any webpages you visit to rebuild the saved data but the saved data can get corrupted so I suggest you clear it and start from scratch.

    Then have you looked to see what's accumulated in your Temp folder at c:\windows\temp? Is it empty or does it have a bunch of files in it?
     
  6. WhitPhil

    WhitPhil Gone but never forgotten Trusted Advisor

    Joined:
    Oct 4, 2000
    Messages:
    8,684
    A couple of items that you can unselect from startup.

    1. MDAC Runonce

    2. MDM

    3. MSDTC??? This note indicates it is installed on Windows 2000, yet you are running Win98??

    4. INETINFO??? You are also running Windows IIS?
     
  7. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I'm wondering whether some of these problems could be related to this entry running at startup (Personal Web Server?):

    "inetinfo.exe"="C:\\WINDOWS\\SYSTEM\\inetsrv\\inetinfo.exe -e w3svc"

    Maybe even some vulnerabilty to Codered worm...?
     
  8. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Thanks for all the advice. I'll only be able to act on it at about 7 pm GMT and will post results as soon as I have it.
     
  9. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Ok, here's the feedback:

    I did as you suggested Bryan and picked up the first error when trying to delete the history. The pc came back with a "sector not found reading drive c" error. Several scandisks, defrags, etc later, I got the delete done.

    I cleared the forms and passwords.

    I unselected the 4 items mentioned by WhitPhil from the startup (via msconfig). Not sure what to do about Personal Web Server so I left that untouched.

    Anyhoo, the same error still occurs at the same time. Can this possibly be caused by a hard drive that is showing it's age?

    Here's the latest output from the startup log:


    ---------- C:\WINDOWS\desktop\StartUp.Log

    Start-Ups checked at 28/08/2001 7:02:24.54
    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log for Windows 95/98 - Freeware by rmbox
    __________________________________________________________________________
    __________________________________________________________________________

    Comments:

    This is a log of all the programs on your computer that
    are starting automatically every time you start Windows.
    Using this log can be a quick way to spot trojans.

    StartUp Log (version 1.53) - Release Date 8/19/2001

    __________________________________________________________________________
    __________________________________________________________________________

    StartUp Log Index

    1. HKLM Run
    2. HKCU Run
    3. HKLM RunOnce
    4. HKCU RunOnce
    5. HKLM RunServices
    6. HKLM RunServicesOnce
    7. WIN.INI file
    8. SYSTEM.INI file
    9. AUTOEXEC.BAT file
    10. StartUp folder
    11. All Users StartUp
    12. Misc. StartUp Configurations

    __________________________________________________________________________
    __________________________________________________________________________

    The following is a list of your current Start-Ups
    __________________________________________________________________________
    __________________________________________________________________________

    1. HKLM Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SystemTray"="SysTray.Exe"
    "ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
    "PWSTray"="PwsTray.exe"
    "NAV DefAlert"="C:\\PROGRA~1\\NORTON~1\\DEFALERT.EXE"
    "Norton eMail Protect"="C:\\Program Files\\Norton AntiVirus\\POPROXY.EXE"
    "InterBaseGuardian"="C:\\Program Files\\InterBase Corp\\InterBase\\bin\\ibguard.exe"
    "Norton Auto-Protect"="C:\\PROGRA~1\\NORTON~1\\NAVAPW32.EXE /LOADQUIET"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    "NoChange"="1"
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    "Installed"="1"


    ==========================================================================
    __________________________________________________________________________

    2. HKCU Run - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Taskbar Display Controls"="RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY"


    ==========================================================================
    __________________________________________________________________________

    3. HKLM RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    4. HKCU RunOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    ==========================================================================
    __________________________________________________________________________

    5. HKLM RunServices - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "ScriptBlocking"="\"C:\\Program Files\\Common Files\\Symantec Shared\\Script Blocking\\SBServ.exe\" -reg"
    "SchedulingAgent"="mstask.exe"


    ==========================================================================
    __________________________________________________________________________

    6. HKLM RunServicesOnce - Registry

    [RegPath]
    "StartUp"


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]


    ==========================================================================
    __________________________________________________________________________

    7. WIN.INI File - (c:\windows\win.ini)

    Your win.ini run/load lines should look like run= and load= exclusively.
    There should be nothing to the right of the equal signs.


    These are the run and load lines in your WIN.INI file

    run=

    ;load=C:\RIVA128\vi_grm.exe
    ;load=D:\RIVA128\vi_grm.exe
    load=D:\RIVA128\vi_grm.exe

    ==========================================================================
    __________________________________________________________________________

    8. SYSTEM.INI File - (c:\windows\system.ini)

    Your system.ini shell line should look like shell=Explorer.exe exclusively.
    You should only see Explorer.exe following the equal sign.


    This is the shell line in your SYSTEM.INI file

    shell=Explorer.exe

    ==========================================================================
    __________________________________________________________________________

    9. AUTOEXEC.BAT File - (c:\autoexec.bat)

    (Some trojans have been known to start from this file)


    These are your program startups and set paths in your autoexec.bat file

    SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\ORAWIN95\BIN;C:\PROGRA~1\BORLAND\DELPHI5\BIN;C:\PROGRA~1\BORLAND\VBROKER\BIN;C:\PROGRA~1\BORLAND\VBROKER\JRE\BIN;C:\PROGRA~1\BORLAND\DELPHI5\PROJECTS\BPL;C:\PROGRA~1\COMMON~1\BORLAN~1\DEBUGGER\BIN
    SET LIB=%LIB%;%LIB%
    SET INCLUDE=%INCLUDE%;%INCLUDE%
    SET NLSPATH=%NLSPATH%;C:\IBMCON~1\ENCINA\%%L\%%N
    IF EXIST d:\IMNNQ_95\IMNENV.BAT CALL d:\IMNNQ_95\IMNENV.BAT
    SET LOCPATH=d:\IBMDebug\LOCALE;
    SET PATH=%PATH%;d:\IBMDebug\bin;d:\IBMCON~1\ENCINA\bin
    SET NLSPATH=d:\IBMDebug\msg\%L\%N;%NLSPATH%;d:\IBMCON~1\ENCINA\%%L\%%N
    SET CLASSPATH=d:\IBMDebug\lib\dertrjrt.jar;%CLASSPATH%;d:\IBMCON~1\CLASSES;C:\PROGRA~1\BORLAND\VBROKER\lib\vbcpp.jar
    SET DER_DRIVER_PATH=d:\IBMDebug
    REM Environment Settings For McAfee VirusScan
    Rem TShoot: SET PATH=%PATH%;C:\PROGRA~1\NETWOR~1\MCAFEE~1
    rem SET PATH=%PATH%;C:\PROGRA~1\NETWOR~1\MCAFEE~1
    mode con codepage prepare=((850) C:\WINDOWS\COMMAND\ega.cpi)
    mode con codepage select=850

    ==========================================================================
    __________________________________________________________________________

    10. StartUp Folder - (c:\windows\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your StartUp folder

    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    11. All Users Folder - (c:\windows\all users\start menu\programs\startup)

    Shortcuts to any program will automatically start when placed here.


    These are the shortcuts located in your All Users StartUp folder


    *(No start-ups found)*

    ==========================================================================
    __________________________________________________________________________

    12. Miscellaneous StartUp Configurations

    -============================-
    Registry StartUp Directories
    -============================-

    Should show the Start Menu StartUp and All Users StartUp directories

    .....................................................................

    [1] HKCU - Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

    "Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [2] HKCU - User Shell Folders

    HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders


    .....................................................................

    [3] HKLM - Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders

    "Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"

    .....................................................................

    [4] HKLM - User Shell Folders

    HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders


    .....................................................................

    -=======================-
    Registry Shell Spawning
    -=======================-

    Open Commands for Executable File Types

    @="\"%1\" %*"
    (.exe file - RegPath = HKCR\exefile\shell\open\command)

    @="\"%1\" %*"
    (.com file - RegPath = HKCR\comfile\shell\open\command)

    @="\"%1\" /S"
    (.scr file - RegPath = HKCR\scrfile\shell\open\command)

    @="\"%1\" %*"
    (.bat file - RegPath = HKCR\batfile\shell\open\command)

    @="\"%1\" %*"
    (.pif file - RegPath = HKCR\piffile\shell\open\command)

    @="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
    (.hta file - RegPath = HKCR\htafile\shell\open\command)

    -=========================-
    HKLM RunOnceEx - Registry
    -=========================-


    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]


    -====================-
    StubPaths - Registry (Partial Listing)
    -====================-

    (Please see the StubPath.txt on your desktop for complete listing)

    HKLM\Software\Microsoft\Active Setup\Installed Components


    "StubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
    "RealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "OldRealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
    "StubPath"=""
    "RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "OldRealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
    "StubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
    "StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
    "StubPath"="C:\\WINDOWS\\msnmgsr1.exe"

    -=================-
    DOSSTART.BAT File - (c:\windows\dosstart.bat)
    -=================-

    C:\WINDOWS\COMMAND\MSCDEX.EXE /D:MTMIDE01 /L:E /M:10

    -=====================-
    Screen Saver Settings (Possible system.ini start-up)
    -=====================-


    ==========================================================================
    __________________________________________________________________________

    - Supplemental Environment Information -

    TMP=C:\WINDOWS\TEMP
    TEMP=C:\WINDOWS\TEMP
    winbootdir=C:\WINDOWS
    COMSPEC=C:\COMMAND.COM
    LIB=;
    INCLUDE=;
    IMNINSTSRV=d:\IMNNQ_95
    IMNINST=help
    LOCPATH=d:\IBMDebug\LOCALE;
    PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\ORAWIN95\BIN;C:\PROGRA~1\BORLAND\DELPHI5\BIN;C:\PROGRA~1\BORLAND\VBROKER\BIN;C:\PROGRA~1\BORLAND\VBROKER\JRE\BIN;C:\PROGRA~1\BORLAND\DELPHI5\PROJECTS\BPL;C:\PROGRA~1\COMMON~1\BORLAN~1\DEBUGGER\BIN;D:\IMNNQ_95;D:\IBMDEBUG\BIN;D:\IBMCON~1\ENCINA\BIN
    NLSPATH=d:\IBMDebug\msg\N;;C:\IBMCON~1\ENCINA\%L\%N;d:\IBMCON~1\ENCINA\%L\%N
    CLASSPATH=d:\IBMDebug\lib\dertrjrt.jar;;d:\IBMCON~1\CLASSES;C:\PROGRA~1\BORLAND\VBROKER\lib\vbcpp.jar
    DER_DRIVER_PATH=d:\IBMDebug
    windir=C:\WINDOWS

    File - c:\windows\deletefi.ini

    ==========================================================================
    __________________________________________________________________________

    - End -

    Any help will, of course, be much appreciated.

    Regards
    Joe
     
  10. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Hallo?

    Anybody out there? Any ideas? Anybody...
     
  11. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I would try testing the specific issues as far as possible by "clean booting" and using msconfig to load the different boot options outlined in the Startup Troubleshooter.

    http://support.microsoft.com/support/kb/articles/q188/8/67.asp

    Errors 1 and 3, particularly, should be easy to test this way. You can narrow the focus to specific files if the error doesn't occur in one of those configurations.
     
  12. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    I clean booted the machine and the error kept occurring. In desperation I reinstalled windows, but specified another drive for the windows directory. It seems to have worked. I've not tested all the conditions which caused the errors, but the ones that I have tested worked just fine.

    Which brings me to my next question: Can this kind of error be caused by a faulty hard drive or is it more likely to be caused by "utility" software that malfunctions?

    Joe
     
  13. janib

    janib

    Joined:
    Mar 16, 2001
    Messages:
    46
    Looking at latest startup log noticed this item repeated and is not REM'd out.

    . WIN.INI File - (c:\windows\win.ini)

    Your win.ini run/load lines should look like run= and load= exclusively.
    There should be nothing to the right of the equal signs.


    These are the run and load lines in your WIN.INI file

    run=

    ;load=C:\RIVA128\vi_grm.exe
    ;load=D:\RIVA128\vi_grm.exe
    load=D:\RIVA128\vi_grm.exe

    ==================================================
     
  14. Joe Soap

    Joe Soap Thread Starter

    Joined:
    Aug 26, 2001
    Messages:
    7
    Thanks janib, I'll check it out. Do you know why this is so? Is it just part of the clean boot process or is there some other reason for it?

    Thanks
    Joe
     
  15. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I was wondering about the win.ini item as well, it looked like you had intentionally disabled it but your video card reinstalled it. I figured if it was the source of the problem it would be revealed in a "clean boot".

    The reason why I doubt the hard drive issue is because the errors are so specific and repeatable. You'd think a "wobbly" hard drive would give more erratic results.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/51788