1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Need Help! WinME-clicking Start Button Causes Kernel32.dll error and forced to close

Discussion in 'Earlier Versions of Windows' started by LulabelleK, Apr 25, 2004.

Thread Status:
Not open for further replies.
  1. LulabelleK

    LulabelleK Thread Starter

    Apr 25, 2004
    I'm working on a friend's Dell laptop running Windows ME. When I click on the Start Menu button, it gives me the error "Explorer caused an error in Kernel32.dll and will close". When I go to My Computer, c:\windows\start menu folder, it gives me the error "Explorer caused an error in Shell32.dll and will now close".

    Everything else works fine - I can open programs, documents, get online, everything so long as I don't have to click on the Start Menu to do it.

    The even better part of this is that this laptop doesn't even have a floppy drive, so I can't use a boot floppy disk. Starting in safe mode produces the same errors.

    I really don't want to have to re-install windows as I don't have her recovery disks (she isn't even sure if she got them to begin with).

    It has Norton SystemWorks2002 Corp and Norton Anti-virus 2004 - no viruses or anything, as I've done a complete scan.

    Any help or suggestions to save me from having to reinstall Windows is much appreciated!!


    Portland, OR :eek:
  2. Demaxy


    Apr 26, 2004
    well, i have a problem similar to that, kernel32.dll shuts itself off, whenever the hell it wants. I've got norton and it doesn't pick anything up. You maybe be able to use the startup disk by plugging in an external floppy disk drive and borrowing a system disk from a freind or something.
  3. Unlucky Luke

    Unlucky Luke

    Sep 2, 2004

    I seem to have the same problem at my friends computer, how did you solve this ?
  4. dvk01

    dvk01 Moderator Malware Specialist

    Dec 14, 2002
    First Name:
    go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
    make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
    Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
    It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
    so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
  5. Unlucky Luke

    Unlucky Luke

    Sep 2, 2004
    Hi Derek,
    Thanks for the quick response, but since my friend doesn't have any internet connection, i will have to do this via a diskette, hope the report fits on one.
    In the meantime i discovered i can temp fix the problem by renaming the folder "start menu" and putting another folder "start menu", then start button works, but if i do restart the computer, i go back to the error message, so i rename the start menu again and renamed the old one to start menu and the start button works again until i do a restart, i can repeat this as often as i want, so i don't quite understand what happens during restart!!!
    I will post the required report as soon as i get it.
    So in the meantime I got the log:

    Logfile of HijackThis v1.98.2
    Scan saved at 11:32:46, on 3/09/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v5.50 (5.50.4134.0100)

    Running processes:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/PBNET/OFFLINE/IE5/NEDERLA.HTM
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    O3 - Toolbar: &Kangaroo - {663C7429-E454-11D3-B9AE-0000B4C32B4D} - C:\IDC\WEBKA.DLL
    O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
    O4 - HKLM\..\Run: [reminder.exe] C:\Program Files\BackWeb\tuner\reminder.exe
    O4 - HKLM\..\Run: [gnetmous] C:\Program Files\Trust\Ami Mouse Optical\TAMOMOUS.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
    O4 - HKLM\..\Run: [SetIcon] C:\Program Files\SMSC\Seticon.exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
    O4 - Startup: Norton System Doctor.lnk = C:\Program Files\Norton Utilities\SYSDOC32.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra button: Kangaroo - {06A18DC1-FE86-11d3-B9AF-0000B4C32B4D} - http://knowledge-assistant.com/webka/toolbar/tbie.asp (file missing)
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
    O12 - Plugin for .mts: C:\Program Files\MetaCreations\MetaStream\npmetastream.dll

    Thanks very much again
  6. Unlucky Luke

    Unlucky Luke

    Sep 2, 2004
    Hi again,

    Could it be Kangaroo is causing the problem ?
  7. dvk01

    dvk01 Moderator Malware Specialist

    Dec 14, 2002
    First Name:
    it could well be

    lets see what happens when we take it out and we'll stop a couple of other unneeded startups taht might be causing the problem

    try to uninstall kangaroo from add/remove programs in control panel if it's there

    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file:///C:/PBNET/OFFLINE/IE5/NEDERLA.HTM
    O3 - Toolbar: &Kangaroo - {663C7429-E454-11D3-B9AE-0000B4C32B4D} - C:\IDC\WEBKA.DLL
    O4 - HKLM\..\Run: [reminder.exe] C:\Program Files\BackWeb\tuner\reminder.exe
    O4 - HKLM\..\Run: [SetIcon] C:\Program Files\SMSC\Seticon.exe
    O9 - Extra button: Kangaroo - {06A18DC1-FE86-11d3-B9AF-0000B4C32B4D} - http://knowledge-assistant.com/webka/toolbar/tbie.asp (file missing)

    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    and Delete these folders


    then go to C:\Documents and Settings\USER NAME\Local Settings\Temp and select everything in that folder and delete it

    as XP will not let you delete files less than 24 hours old as it thinks it might need them please also do this
    while in the temp folder, select view and select details.
    then right click a blank part and select arrange icons by, and select show in groups and modified, that will give a list of all files in date order with today at the top of the page.
    select all the files/folders except the today ones and delete them all.

    and select EVERYTHING in C:\windows\temp except temporary internet files, cookies and history folders and delete all that as well

    1) Open Control Panel
    2) Click on Internet Options
    3) On the General Tab, in the middle of the screen, click on Delete Files
    4) You may also want to check the box "Delete all offline content"
    5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
    6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive

    Reboot normally &

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware SE from http://www.lavasoft.de/support/download

    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &


    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least SE1R6 30.08.2004 or a higher number/later date
    Then ........
    click the "Scan" button. and select full scan

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries. You can safely ignore any MRU entries though and not delete them

    reboot again

    then post a new hijackthis log to check what is left
  8. Unlucky Luke

    Unlucky Luke

    Sep 2, 2004
    :) Hello,

    Thanks for the help, but none of the above solved the problem.
    But, after some thought, I decided to create a new user called test.
    Before I had one user with my friends name and ofcourse windows with no user; both gave the same problem.
    Creating the user test unexpectadely removed the user with my friends name, I copied nothing in the options.
    The start button worked with test.
    So I created another user with my friends name in which I copied everything except the folder my documents and I deleted user test.
    To my biggest surprise, now everything works, as wel with my friends user as windows straight on.
    Eventhough I don't quite understand everything, I hope to be of some help for somebody.

    Thanks for your quick response anyway and hopefully we can work together some more.
  9. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/223894

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice