[Resolved] Fatal Exception Error } User.exe

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

garnlee

Thread Starter
Joined
Jul 6, 2003
Messages
36
Hi there,

Just been having a problem starting up the computer the last few times...its comes up with the fatal exception screen then the next screen to come up says:

Kernel 32 caused a general protection fault in module USER.EXE at 0001.000003d2


When i use the ctrl alt del to restart it all seems to work.
If you could let me know what this error is i would reallly appreciate it.

Thank you,
anita
 
Joined
Dec 9, 2000
Messages
45,855
It might be caused by a firewall or antivirus program. Have you installed or uninstalled anything new recently?

If you have WinME you can try a System Restore or a scanreg /restore. In WinME scanreg /restore can be run from Start> Run. You can only go back a few days though.

In Win98 you must restart in MS-DOS mode and enter:

scanreg /restore

I wouldn't do this if you have uninstalled anything in the last 4 days though.


You can post a HijackThis Scanlog and some further suggestions might be offered.

http://www.tomcoyote.org/hjt/
 

garnlee

Thread Starter
Joined
Jul 6, 2003
Messages
36
hi there,

We have Zone Alarm and Norton Anti Virus Corporate Edition installed... i dont believe that we have installed/uninstalled anything recently. HEre is our latest post of Hijack this:Logfile of HijackThis v1.95.0
Scan saved at 10:06:49 AM, on 9/26/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2614.3500)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\MIXER.EXE
C:\WINDOWS\SYSTEM\CARPSERV.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HIJACK THIS\HIJACKTHIS.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\AUPDATE.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\LUCOMSERVER.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.iprimus.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%6f%75%74%2e%74%72%75%65%2d%63%6f%75%6e%74%65%72%2e%63%6f%6d/%63/?%33%34%34%30%31%32
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak=http://www.iprimus.com.au/
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~2\vptray.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~2\rtvscn95.exe
O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~2\defwatch.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp

Thanks again
anita
 
Joined
Dec 9, 2000
Messages
45,855
Well, I see the remnants of a search/IE hijack there, but no doubt unrelated to your problem.

I can't read what this is doing without translating the hex, but I'd remove (check and "fix" it and the "style sheet" which you probably didn't create either:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%6f%75%74%2e%74%72%75%65%2d%63%6f%75%6e%74%65%72%2e%63%6f%6d/%63/?%33%34%34%30%31%32

O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp

Here's the the deal. IF this problem began in the last 4 days you can click Start > Shutdown > Restart in MS DOS mode and at the c:\windows> prompt enter:

scanreg /restore

You will see a set of 4 backed up registry archives (and a 5th, which usually fails to restore). If one of those 4 days represents a date, the morning of which precedes the problem, you can try restoring that. It reverses any registry changes that could be involved in the problem.

If no dates which precede the problem are available, or that fails to help, then you must "clean boot" troubleshoot by not starting suspect items such as ZoneAlarm. You can disable ZoneAlarms automatic startup through its user interface Or uncheck the startup items listed under msconfig > startups (start > run: msconfig

Note: if you restore a previous registry AFTER using HijackThis to remove registry entries, they will be returned, so you will need to repeat that.

ZoneAlarm can still be started manually AFTER the desktop completely loads.

The same can be said for your Antivirus.

http://support.microsoft.com/defaul...port/kb/articles/Q281/9/65.ASP&NoWebContent=1

That particular User.exe error address is not a common one, and this is one reason why I was suspicious of a firewall association:

http://groups.google.com/[email protected]&rnum=1
 

garnlee

Thread Starter
Joined
Jul 6, 2003
Messages
36
hey there,



:) I just did a scanreg/restore for the day before this problem began, so hopefully that will fix it...

Thanks heaps for all your help (again..lol)

anita
 

garnlee

Thread Starter
Joined
Jul 6, 2003
Messages
36
hey there :) Have started up several times and not had the error message...think its fixed..whoopeeee thanks for you help!!!

anita
 
Joined
Dec 9, 2000
Messages
45,855
Great, and you're welcome. Not to jinks you, but we'll put a "resolved" on this for now. If it returns, just let us know :)
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top