Kernel32.dll???

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
I've been getting a lot of trouble with my computer lately; specifically, the desktop will disappear and show nothing but my background, then reappear, but some things in the taskbar tray will be gone, including Norton. Some programs reappear, but Norton never does until I restart. First off, is this Explorer crashing?


I'll get error reports from time to time that include the file:

C:\Docume~1\ChrisL~\Locals~1\Temp\WER5.tmp.dir00\appcompat.txt

I've done a search of the appcompat.txt to no success, so I tried searching the file and found this inside of it:

EXE NAME="SYSTEM INFO" FILTER="GRABMI_FILTER_SYSTEM">
<MATCHING_FILE NAME="advapi32.dll" SIZE="558080" CHECKSUM="0x7B6E5DDA" BIN_FILE_VERSION="5.1.2600.1106"

I did a search for this line:

EXE NAME="SYSTEM INFO" FILTER="GRABMI_FILTER_SYSTEM">

And discovered that someone else has the EXACT same problem as me (seemingly).

http://www.mcse.ms/archive64-2003-12-230972.html

The file he copied and pasted resembles mine from what I can see exactly. So, I followed the lead given to him to this:

http://aumha.org/win4/a/kernel32.htm

And discovered the problem may be the kernel32.dll or something. The problem is I'm fairly computer illiterate and am not sure how to fix this problem, or even ensure that the kernel32.dll IS the problem. I'm at the end of my rope, so please, any assistance provided would be GREATLY appreciated.
 
Joined
Sep 15, 2004
Messages
3,791
You could be under a malware attack. If you don't already have them, go to http://www.majorgeeks.com and download SPybot Search and Destroy, SpywareBlaster and Ad-Aware, install them and allow each to visit their sites for updates then reboot into Safe Mode and scan with Spybot and Ad-Aware. SpywareBlaster doesn't scan - it's resident and on guard all the time you're switched on.

Allow them to fix anything they find then reboot back into Normal Mode and go to http://www.trendmicro.com for a free online virus scan.

Please post back with details of what these trackers find.
 

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
I got rid of several things with adaware, one being something called Alexa, but I don't think that's the cause of my problem. (I also got rid of something Alexa related with Spybot). I used to heavily rely on TrendMicro in the past, and after my problems began I used it to find two trojans, one in the system32 folder. One was deleted, but the other unaccessable (the one in the system32 folder). However, I tried running the scan in safemode but this time the scanner only scanned about half of my computer files, then said I had no viruses when I KNOW I do. Since then I've tried scanning with several other scanners which have helped, but not solved the problem (I'm not even sure I still have that trojan).
 
Joined
Sep 15, 2004
Messages
3,791
There will be more information on this error message in Control Panel>Administrative Tools>Event Viewer, Christoph. Scroll through the System and Application logs until you find a relevant error or warning message and post that message back here, please. Someone may have a better idea but I'm guessing you may need the second Repair option after popping in your XP CD.

Hold back on that until you post back the error messages in full and someone (or even I) may have a better way forward.
 

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
I found the list, and it has numerous errors reported, but how can I copy and paste them onto here?
 
Joined
Sep 15, 2004
Messages
3,791
I suggets you go Start>All Propgrammes>Accessories and Notepad. Once the document is opened, name it (anything you like) and copy and paste the first message into it, highlighting the text, click Control and C together then at the top of the document, Control and V together. Hit enter a couple of times to give some gaps between messages then repeat that part the process for each error message. The Notepad document will disappear into the Taskbar every time you revisit the Event Viewer but will come back on a click, ready for the next paste.

When you've finished and are ready to come back here, Control and A together will highlight the whole document, Control C top put it in the clipboard then Control V into the Reply box here after you've written any introduction you want.
 

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
Application Errors:


Hanging application spywareblaster.exe, version 3.3.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.


This next one is a warning message:
Windows saved user CHRIS\Chris LeBlanc registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.



Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206.



The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.



Virus Found!Virus name: Downloader.Psyme in File: C:\documents and settings\chris leblanc\local settings\temporary internet files\content.ie5\opqrstuv\navigation[1].chm by: Manual scan. Action: Clean failed : Leave Alone succeeded :



Fault bucket 184291038.


Faulting application explorer.exe, version 6.0.2800.1106, faulting module unknown, version 0.0.0.0, fault address 0x00142c69.


Faulting application explorer.exe, version 6.0.2800.1106, faulting module ntdll.dll, version 5.1.2600.1106, fault address 0x00001f72.


Faulting application explorer.exe, version 6.0.2800.1106, faulting module ntdll.dll, version 5.1.2600.1106, fault address 0x00002b6a.





If this is enough information, or if you need the system error reports, please let me know. Thanks for your help!
 
Joined
Sep 15, 2004
Messages
3,791
I sauppose the most obvious issue is the Psyme virus - more like a Trojan, which makes this a security issue so there will be better opinions than mine on this. For the time being, though, have a look at http://securityresponse.symantec.com/avcenter/venc/data/downloader.psyme.html and follow the removal instructions, carefully noting those filenames in case they don't quite disappear. Note you also have to turn off System Restore. I can't recall which Virus Scan you have but hopefully it may find and destroy this Trojan. If it doesn't, go to http://www.swatit.org and download SwatIt, which is free and which ought to do the trick.
 
Joined
Jan 17, 2004
Messages
9,600
After following Saga's advice, it would be wise to run HijackThis and let the good folks here see the scan results. Most times when one problem is found---there are others.
Download and unzip HJT to its own folder, and then run a scan. Save logfile and post it. DO NOT FIX ANYTHING.
I think a look at running processes is called for. Best of luck >f
Click here>> http://www.majorgeeks.com/download3155.html
 

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
I plan do all of your suggestions tomorrow when I have spare time, thank you for your help.

However, it just occured again and I immediately checked the event viewer, and found this message:

Under source it has winlogin

and in the message it has:

The shell stopped unexpectedly and Explorer.exe was restarted.


This has to be the problem, but what does it mean?
 

Christoph

Thread Starter
Joined
Apr 30, 2003
Messages
231
I read somewhere that replacing Explorer.exe with another computer can do the trick to fixing this problem. My brother has service pack 2 though, and I have service pack 1 (i could always get it from someone else though) and I'd like to try this. What are the precautions I should take in trying this, or should I try it at all?
 
Joined
Apr 3, 2008
Messages
1
I had the same issue, I found K-lite Codec pack to be the culprit. I renamed "mpegsplitter.ax" found in C:\program files\k-lite codec pack\filters' folder and the issue was fixed.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Top