1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Resolved] Fatal Exception Error } User.exe

Discussion in 'Earlier Versions of Windows' started by garnlee, Sep 24, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. garnlee

    garnlee Thread Starter

    Joined:
    Jul 6, 2003
    Messages:
    36
    Hi there,

    Just been having a problem starting up the computer the last few times...its comes up with the fatal exception screen then the next screen to come up says:

    Kernel 32 caused a general protection fault in module USER.EXE at 0001.000003d2


    When i use the ctrl alt del to restart it all seems to work.
    If you could let me know what this error is i would reallly appreciate it.

    Thank you,
    anita
     
  2. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    It might be caused by a firewall or antivirus program. Have you installed or uninstalled anything new recently?

    If you have WinME you can try a System Restore or a scanreg /restore. In WinME scanreg /restore can be run from Start> Run. You can only go back a few days though.

    In Win98 you must restart in MS-DOS mode and enter:

    scanreg /restore

    I wouldn't do this if you have uninstalled anything in the last 4 days though.


    You can post a HijackThis Scanlog and some further suggestions might be offered.

    http://www.tomcoyote.org/hjt/
     
  3. garnlee

    garnlee Thread Starter

    Joined:
    Jul 6, 2003
    Messages:
    36
    hi there,

    We have Zone Alarm and Norton Anti Virus Corporate Edition installed... i dont believe that we have installed/uninstalled anything recently. HEre is our latest post of Hijack this:Logfile of HijackThis v1.95.0
    Scan saved at 10:06:49 AM, on 9/26/03
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v5.00 (5.00.2614.3500)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\RTVSCN95.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\DEFWATCH.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\MIXER.EXE
    C:\WINDOWS\SYSTEM\CARPSERV.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\HIJACK THIS\HIJACKTHIS.EXE
    C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\AUPDATE.EXE
    C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\LUCOMSERVER.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.iprimus.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%6f%75%74%2e%74%72%75%65%2d%63%6f%75%6e%74%65%72%2e%63%6f%6d/%63/?%33%34%34%30%31%32
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak=http://www.iprimus.com.au/
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [CARPService] carpserv.exe
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\NORTON~2\vptray.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKLM\..\RunServices: [rtvscn95] C:\PROGRA~1\NORTON~2\rtvscn95.exe
    O4 - HKLM\..\RunServices: [defwatch] C:\PROGRA~1\NORTON~2\defwatch.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
    O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...pple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp

    Thanks again
    anita
     
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Well, I see the remnants of a search/IE hijack there, but no doubt unrelated to your problem.

    I can't read what this is doing without translating the hex, but I'd remove (check and "fix" it and the "style sheet" which you probably didn't create either:

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://%6f%75%74%2e%74%72%75%65%2d%63%6f%75%6e%74%65%72%2e%63%6f%6d/%63/?%33%34%34%30%31%32

    O19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp

    Here's the the deal. IF this problem began in the last 4 days you can click Start > Shutdown > Restart in MS DOS mode and at the c:\windows> prompt enter:

    scanreg /restore

    You will see a set of 4 backed up registry archives (and a 5th, which usually fails to restore). If one of those 4 days represents a date, the morning of which precedes the problem, you can try restoring that. It reverses any registry changes that could be involved in the problem.

    If no dates which precede the problem are available, or that fails to help, then you must "clean boot" troubleshoot by not starting suspect items such as ZoneAlarm. You can disable ZoneAlarms automatic startup through its user interface Or uncheck the startup items listed under msconfig > startups (start > run: msconfig

    Note: if you restore a previous registry AFTER using HijackThis to remove registry entries, they will be returned, so you will need to repeat that.

    ZoneAlarm can still be started manually AFTER the desktop completely loads.

    The same can be said for your Antivirus.

    http://support.microsoft.com/defaul...port/kb/articles/Q281/9/65.ASP&NoWebContent=1

    That particular User.exe error address is not a common one, and this is one reason why I was suspicious of a firewall association:

    http://groups.google.com/[email protected]&rnum=1
     
  5. garnlee

    garnlee Thread Starter

    Joined:
    Jul 6, 2003
    Messages:
    36
    hey there,



    :) I just did a scanreg/restore for the day before this problem began, so hopefully that will fix it...

    Thanks heaps for all your help (again..lol)

    anita
     
  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    You're welcome, good luck with it and let us know how it goes.
     
  7. garnlee

    garnlee Thread Starter

    Joined:
    Jul 6, 2003
    Messages:
    36
    hey there :) Have started up several times and not had the error message...think its fixed..whoopeeee thanks for you help!!!

    anita
     
  8. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Great, and you're welcome. Not to jinks you, but we'll put a "resolved" on this for now. If it returns, just let us know :)
     
  9. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/167243

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice