[Resolved] numerous EXPLORER KERNEL32.DLL at 0197 invalid page faults

Last night I downloaded IE 6.0 to supersede the 5.5 version, and ever since I have had an unending succession of error messages which have forced me to reboot again and again and again.

Most of these error messages have been invalid page faults in Kernel32.DLL at 0197:

bff87ede (several of these)

bff9db61

02555e70

bff76843

These problems seem to occur at random. There have been others as well.

I went to OE Newsgroups and got the following message:

An unknow response was receive in response to request for
information from the news server 'news.'

Details:
502 Wrong server, set your server name to: news [Twister
vl.2.0]
Configuration: Account: news
Server: news

Other error messages:

Iexplore caused a general protection fault in module GDI.EXE
at 0001:00001ba7.

Error Signature
AppName: iexplore.exe
AppVer: 6.0.2600.0 ModName:ftapp.dll
ModVer: 1.0.0.1 Offset:00005e70

There have been other such messages, but I simply got tired of writing them down.

I'm wondering if my problem might be serious enough to warrant getting uninstalling and then reinstalling 6.0. I would greatly appreciate whatever help I can get to clear up this overwhelming problem.

Thank you,

Bill

 

The presence of this suggests you probably have other ad related "spyware" as well...

http://vil.mcafee.com/dispVirus.asp?virus_k=99206&

Let's have a look at what is loading in startup. From start, run msinfo32 and click on "software environment' and "startup programs".

Click edit>select all> edit> copy and paste the copied text in your next reply.

Also, download Ad-aware from lavasoft and install it. Read the FAQ and "getting started" pages, then download the current reflist and unzip that to the ad-aware directory and update the current reflist by running it. Before running ad-aware, return here with your startup list

http://www.lavasoftusa.com/

 

Quicken Startup Startup Group C:\QUICKENW\QWDLLS.EXE
AGSatellite Startup Group "C:\Program Files\Audiogalaxy Satellite\AGSatellite.exe" noshow
Billminder Startup Group C:\QUICKENW\BILLMIND.EXE
Microsoft Works Calendar Reminders Startup Group "C:\WINDOWS.000\Application Data\Microsoft\Installer\{9944aa9e-362d-11d3-81ab-00c04fb932ba}\1960F8A9.exe"
Microsoft Office Startup Group <corrupted>
iMesh Auto Update Startup Group "C:\Program Files\iMesh\Client\WiseUpdt.exe" /C
ZoneAlarm Common Startup Group "C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe" -nopopup
run Win.ini hpfsched
eZulaMain Registry (Per-User Run) C:\PROGRA~1\ezula\eZulaMain.exe
MoneyAgent Registry (Per-User Run) "C:\Program Files\Microsoft Money\System\Money Express.exe"
SoniqueQuickStart Registry (Per-User Run) C:\Program Files\Sonique\sqstart.exe -nostick
ScanRegistry Registry (Machine Run) C:\WINDOWS.000\scanregw.exe /autorun
SystemTray Registry (Machine Run) SysTray.Exe
SaveNow Registry (Machine Run) C:\PROGRA~1\SAVENOW\SaveNow.exe
SVAPlayer Registry (Machine Run) C:\Program Files\SVA Player\SVAPLAYER.EXE
LoadQM Registry (Machine Run) loadqm.exe
LoadPowerProfile Registry (Machine Run) Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
NPROTECT Registry (Machine Run) C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
TaskMonitor Registry (Machine Run) C:\WINDOWS.000\taskmon.exe
WinampAgent Registry (Machine Run) "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
RealJukeboxSystray Registry (Machine Run) C:\PROGRAM FILES\REAL\REALJUKEBOX\TSYSTRAY.EXE
AudioHQ Registry (Machine Run) C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
CTSYSVOL Registry (Machine Run) C:\Program Files\Creative\SurroundMixer\CTSYSVOL.EXE
NAV DefAlert Registry (Machine Run) C:\PROGRA~1\NORTON~1\DEFALERT.EXE
Norton Auto-Protect Registry (Machine Run) C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
Advanced Tools Check Registry (Machine Run) C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
Norton eMail Protect Registry (Machine Run) C:\Program Files\Norton AntiVirus\POPROXY.EXE
Alogserv Registry (Machine Run) C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
StillImageMonitor Registry (Machine Run) C:\WINDOWS.000\SYSTEM\STIMON.EXE
MMTray Registry (Machine Run) C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
New.net Startup Registry (Machine Run) rundll32 C:\WINDOWS.000\NEWDOT~4.DLL,NewDotNetStartup
HPHA1MON Registry (Machine Run) C:\WINDOWS.000\SYSTEM\HPHA1MON.EXE
webHancer Agent Registry (Machine Run) "C:\Program Files\webHancer\Programs\whAgent.exe"
Adaptec DirectCD Registry (Machine Run) C:\PROGRA~1\ADAPTEC\DIRECTCD\DIRECTCD.EXE
CreateCD Registry (Machine Run) C:\PROGRA~1\ADAPTEC\EASYCD~1\CREATECD\CREATECD.EXE -r
winmodem Registry (Machine Service) WINMODEM.101\wmexe.exe
SchedulingAgent Registry (Machine Service) C:\WINDOWS.000\SYSTEM\mstask.exe
TrueVector Registry (Machine Service) C:\WINDOWS.000\SYSTEM\ZONELABS\VSMON.EXE -service
MiniLog Registry (Machine Service) C:\WINDOWS.000\SYSTEM\ZONELABS\MINILOG.EXE -service
NPROTECT Registry (Machine Service) C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
ScriptBlocking Registry (Machine Service) "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
LoadPowerProfile Registry (Machine Service) Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

 

As you can see, I have an awful lot of stuff loaded. I guess I need to get rid of some of it.


I tried clicking on both of your links, McAfee and Lavasoft, but both times I received the following error message:

Iexplore invalid page fault in module KERNEL 32.DLL at
0197.bff76843.

 

Well there is a lot there to deal with, but lets take it a couple of steps at a time. First project is to get rid of new.net, savenow and webhancer. All of these should have uninstalls in add/remove.

Have a look at the MrKowz thread, read the advice concerning removal of these programs and have a fail-safe plan to repair your winsock registry key/ and or reinstall DUN if that becomes necessary. The zip file courtesy of lavasoft should be kept on hand and the instructions from Del printed out if you have to use them.

http://support.microsoft.com/default.aspx?scid=kb;en-us;q302463

http://forums.techguy.org/showthread.php?s=&threadid=60253

Hopefully, we'll see you back and we can proceed with the rest of the trimming. It's best not to run ad-aware until the above are removed through add/remove. Be sure to reboot afterwards.

 

I got rid of new.net, savenow, and webhancer using Add/Remove. After removing them I then read your second paragraph telling me to read the advice concerning the removal of these programs. Should I have done things more cautiously? I simply used Add/Remove as I normally do.

My knowledge of computers is for the most part non-technical and therefore rather limited. Unfortunately, 'winsock registry key' and 'DUN' are terms I'm not at all familiar with. I hope that solving my problem(s) won't be too difficult.

As it now stands, I am able to access the Internet and check my e-mail, but I find it frustrating that I am unable to use Newsgroups, to open My Documents, or to get into Windows Explorer. Each time I try to open them I get error messages of one sort or another.

Thank you for your help so far. Like you said, I'll probably have to go about this one step at a time. Still, I don't see how simply downloading IE 6.0 over 5.5 could have caused such a big mess, but then I don't understand much about computers.

Thanks again,

Bill

 

Is there another way to get into Windows Explorer besides Start/Programs? Also, would it make sense for me to just forget about IE 6.0 and revert to 5.5? Could such a move possibly clear things up?

 

I think if you are able to do normal surfing, your winsock registry keys are unscathed.

I just noticed that your windows folder is:

WINDOWS.000

This indicates that at some point you have reinstalled Windows and due to incomplete or corrupt core files, it created a new directory. This may or may not be a problem, I don't know when it occured or whether it is a factor in the errors you are experiencing.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q142545

We can continue at this point, by seeing if Ad-Aware will do further cleaning and perhaps fix the folder opening problem -- I've seen it caused by spyware before.

When you run it, have it scan memory, do a deep scan of registry, and scan your fixed drives.

After it finds entries, click continue, check the items to remove, click the "backup" tab, name and save it, then continue with the removal. Reboot afterwards and rescan to ensure a complete removal.

For getting in to Explorer, try going to start>Run>explorer

Do you still get the error?

You can also try entering c:\windows\explorer.scf in your address bar.

It's possible reverting to your previous version of IE might help, perhaps the upgrade did not install correctly because of the confusion over Windows folders. Just don't know about it. But I'd try completing the cleaning procedures first.

 

I've had the WINDOWS.000 folder for a number of months, so I don't think that would be related to my problem(s).

I clicked on your support.microsoft link and received the same error message.

I tried start>Run>explorer and got the error message.

I tried your address bar suggestion and was told, 'This page cannot be displayed,' or something similar.

I don't know what Ad-Aware is but I presume it's something I already have. Anyhow, tonight I'll try running it and see what happens.

Thanks again for staying with me on all of this.

Bill

 

After you have completed the scan and removal with Ad-aware. Startup in safe mode and see if you can open Explorer without error. If you can, we know it is a conflict with background applications. To start in safe mode press and hold the ctrl key as soon as the system begins booting. The Boot Menu should appear and you can select safe mode.

If no error in safe mode, from start, run msconfig and remove the check for "load startup" group. Restart and test again.

If no error, run msconfig again and click the startup tab;

>> remove the checks for all but

ZoneAlarm
Scanregistry
SystemTray
LoadPowerprofiles (both)
NavDefAlert
Winmodem
Norton Auto protect (navapw32.exe)
NProtect
Scriptblocking
StillImageMonitor

>> test again

If you still get the error, disable all Norton applications through their user interface if possible, or through msconfig and test again.

I see Mcafee Alogserv there and wonder what this remnant is doing when you have Norton as your AV??. It is buggy even when running with McAfee.

Here is an alternate Ad-aware link if you were unable to open the previous one and download the application:

http://www.lavasoftusa.com/aaw.html

download link:

http://www.lavasoftusa.com/downloads.html

 

Thank you very much for your invaluable assistance! You've been a big help, indeed!

I ran the Ad-Aware exactly as you recommended and the whole process went well. I believe I found 11 items that I saved and then removed.

I was able to open Windows Explorer in Safe Mode without any problem.

I ran msconfig and removed the check for 'load startup' and was able to open Explorer.

I removed all checks except for the ones you told me to keep checked and was able to get into Explorer.

My Outlook Express (e-mail and Newsgroups) appears to be functioning properly again. Also, I am once again able to access my documents by clicking on the My Documents icon.

I tried start>Run>explorer and, unlike before, it now works.

I figured that it wasn't necessary to disable all Norton applications and retest, so I didn't bother with that.

In other words, things are MUCH better than before. The one annoying problem I continue to have is the Iexplore invalid page fault in module KERNEL32.DLL at 0917:bff76843, which occurs whenever I go to certain websites and click on links and photographs. For example, I clicked on the lavasoftusa.com link you sent and got the error message. One more thing. I typed c:\windows\explorer.scf in my address bar and pressed Enter and that still didn't work, but maybe that's something I shouldn't be too concerned about.

You mentioned McAfee Alogserv and wondered why I still have it since I now have Norton AV. Is it okay to delete any and all McAfee remnants?

I look forward to any suggestions you may have for eliminating the recurring invalid page fault message.

Thanks again!

Bill

 

For the SCF Try this:
Folder Options>File Types>Windows Explorer Command In the actions box
it should have one entry. OPEN
If it doesn't click the New Button, if it does, double click on the open entry. Either of these will bring up a new Dialog.
Action should say open

Application used to perform action
explorer.exe

Put a check in the use DDE box

Fill out the form like this:
DDE MEssage
[ShellFile("%1","%1",%S)]

Application
Folders
DDE Aplication not running (leave this one blank)

Topic
App Properties

 

Great. I'm glad to see we made some real progress. I don't know what to make of the IE kernel32 error your getting, but we can try a couple of things.

But first let's just get alogserv out of the picture all together and I think you won't have to worry about Mcafee.

If you go to start and run regedit then navigate to:

Hkey_Local_Machine
Software
Microsoft
Windows
CurrentVersion
RUN-

With the run- folder highlighted you should see alogserv in the right hand pane. You can right click and delete it. This folder contains UNchecked (disabled) items in msconfig.


There are also a couple of other items in msconfig that you can experiment with unchecking. Basically for routine purposes you want to have Scanregistry, systray, loadpowerprofiles (if you are using power management options), and your antivirus applications.

Sillimage Monitor is a part of your scanning software and is required when you need to run it. If it is causing a conflict, you can uncheck it and instead make a desktop or quicklaunch shortcut for it to use when needed.

I'm not sure of the function of winmodem in startup. I don't know whether this is something currently required, or a legacy device. If you uncheck it, can you still connect to the internet?

One procedure that might be helpful here is to do a clean up of Temporary Internet and History folders.

To do this best it should be done from DOS. Here are basic instructions.

>> go to Start>Shutdown>Restart in MS-DOS mode

>> at the c:\windows\> prompt enter each line:

smartdrv
deltree history
deltree tempor~1
deltree temp

exit

For each deltree you will be prompted to confirm the target folder (eg. history); if this is correct, press 'y'

smartdrv is necessary to expedite the process, or it could take a long time.

It is also possible that corrupt cookies are involved in the error. You could include a deltree cookies command. If you do, you will have to reset your passwords on all sites that require them, such as this one.

I don't think everyone has their Explorer associated with an .scf extension. As long as it is working in the normal manner I wouldn't worry about it not opening with that particular command.

If you want to try making a desktop or quicklaunch shortcut for Explorer, you can do this:

> right click on the desktop and select New>shortcut.

use this (copy/paste) as the command line:

C:\WINDOWS\EXPLORER.EXE /n,/e,C:\

Also, one more option may be worthwhile. See if you can run a Repair Tool for IE6, much like IE5:

control panel | add/remove programs | microsoft internet 6 & internet tools | add/remove | repair

If the repair option is there, I'd try it.

 

I continue to have the IE KERNEL 32 error, but only while using IE. I don't have the problem whenever I use Netscape or Opera. Still, I would like to correct the problem. (For what it's worth, I'm using a cable modem [email protected] -- for my Internet connection.

I ran a Repair Tool for IE6. Also, I deleted alogserv and then I unchecked Stillimage Monitor and Winmodem as you suggested, but the problem remains. I haven't gone into MS-DOS mode to clean up my Temp. Internet and History folders. I clean them very often in the normal manner, but, like you said, maybe I should try again in MS-DOS if you feel that might clear things up. I'm uncomfortable in MS-DOS mode, but I'll probably attempt it shortly. Do you think that should be my next step? Or should I go back to IE5.5 and try downloading IE6.0 again? I look forward to hearing from you again soon.

Thanks,

Bill

P.S. I don't really understand about the .scf extension. Should I attempt to change that?

 

Is the kernel32 error occuring every time you visit specific sites, or is "random"?

Can you give me the links to the sites where it is "repeatable"?

When you get it, do a ctrl-alt-del and see what you have in the "Close Programs" window besides Explorer, systray and the site link itself.

I hate to advise about browser choices. Your talking to someone who still uses IE4.01. I'm weighing the possibility of an upgrade to IE6 very carefully myself. I tend to live with minor problems rather than go through the rigamarole of making major changes. It just a matter of ones personal frustration tolerance -- and how well backed up you are if worse comes to worse.

The DOS exercise will remove contents that the Windows cleanup doesn't get to. DOS is safer and more stable than Windows. You just have to be sure you enter the commands as shown and the target directory is correct.

No don't worry any about the extension.