PDA

View Full Version : Kernel32.dll invalid page fault - IE 6 Win98


Juicey
June 8th 04, 04:53 PM
O/S = Win98

Adware search engine threat "iefeats" hijacking homepage.
Had to keep changing homepage after every computer restart
but otherwise was able to work with Internet Explorer as
normal.

Upgraded to IE Explorer 6 & Installed NISP2004. Result =no
longer able to open Internet Explorer- error message/
Program shut down.

NISP2004 unable to delete adware completely.
Deleteed manually offending *.dll files and corresponding
items in Register and Threat seems now to be gone. IE Pref
show Homepage OK.

Still getting error however which from what I've read in
articles posted here, seems to be connected to latest IE 6
browser.

Does not appear to be video driver problem as no
improvement after following steps per Section B of
F.Saunders posting 5/6/2004.

Control Panel shortcut on Start menu and Sometimes opening
Windows Explorer can also cause crash.

Sample Error details: -
EXPLORER caused an invalid page fault in
module KERNEL32.DLL at 017f:bff7b9f5.
Registers:
EAX=7fc39e61 CS=017f EIP=bff7b9f5 EFLGS=00010202
EBX=01e2ffbc SS=0187 ESP=01df0000 EBP=01df0024
ECX=01df1df8 DS=0187 ESI=00000001 FS=6f8f
EDX=00000001 ES=0187 EDI=816e5ee8 GS=0000

Fault address almost always same & also Registers first row
and second column.
(Not computer expert so hope not including irrelevant
info.)

I'm hoping that the extra detail provided above might
enable somebody to recognise exactly what is causing this
problem
and advise a solution as I have spent time trying to fix
this and seem to be getting bogged down.

Cheers.

(Also posted Win98 internet section)

Brian A.
June 8th 04, 08:56 PM
Variant of a CWS parasite: CWS.Aff.Winshow
http://www.spywareinfo.com/~merijn/cwschronicles.html#winshow

**It is pertinent to run the update for each program before running to be sure you
have the latest definitions.**
Download/run Cool Web Shredder from:
http://www.spywareinfo.com/~merijn/downloads.html

For Info on Cool Web Search Variants:
http://www.spywareinfo.com/~merijn/cwschronicles.html

Then download/install/run Ad-Aware to detect/rid of any other parasites/spyware that
may be installed. It can be obtained free from:
http://www.lavasoftusa.com/
After installing Ad-Aware, open it and click on the ref update to get the latest
up-to-date ref file, then run Ad-Aware and delete everything it finds.

And/or download/install/run:
Spybot - Search & Destroy:
http://security.kolla.de/index.php?lang=en&page=download
Run it at it's default settings until you learn an know more about it. Spybot S&D is
more of an advanced users tool and changing from the default settings can be
dangerous to the novice user. Items found in the default settings that are RED can
usually be safely removed. If you are unsure of a found item, do not remove it and
ask for help.

If you still have problems, download/run HijackThis from:
http://www.merijn.org/

Do not remove anything with it until you get advice on what to remove, HJThis will
list many apps that are needed along with the bad ones. Removing items listed
hap-hazardly without knowing what they are can/will create a royal mess. Read the
quick start here on how to create a log file that can be copied/pasted into a forum
that can provide assistance on removal of unwanted pests.
http://mjc1.com/mirror/hjt/#quick

Then post the logs to an appropriate NG here where they specialize in
spyware/hijacker removal:
http://forums.spywareinfo.com/

It's also a good idea to have a HOSTS file to block bad sites, scroll to HOSTS File
Manager here:
http://www.mvps.org/PracticallyNerded/Software.htm

Another good app is SpywareBlaster which stops the badboys before they even get a
chance to install:
http://www.javacoolsoftware.com/spywareblaster.html

--
Brian A.

Jack of all trades, Master of none.
One can never truly be a master as there is always more to learn.


"Juicey" > wrote in message
...
> O/S = Win98
>
> Adware search engine threat "iefeats" hijacking homepage.
> Had to keep changing homepage after every computer restart
> but otherwise was able to work with Internet Explorer as
> normal.
>
> Upgraded to IE Explorer 6 & Installed NISP2004. Result =no
> longer able to open Internet Explorer- error message/
> Program shut down.
>
> NISP2004 unable to delete adware completely.
> Deleteed manually offending *.dll files and corresponding
> items in Register and Threat seems now to be gone. IE Pref
> show Homepage OK.
>
> Still getting error however which from what I've read in
> articles posted here, seems to be connected to latest IE 6
> browser.
>
> Does not appear to be video driver problem as no
> improvement after following steps per Section B of
> F.Saunders posting 5/6/2004.
>
> Control Panel shortcut on Start menu and Sometimes opening
> Windows Explorer can also cause crash.
>
> Sample Error details: -
> EXPLORER caused an invalid page fault in
> module KERNEL32.DLL at 017f:bff7b9f5.
> Registers:
> EAX=7fc39e61 CS=017f EIP=bff7b9f5 EFLGS=00010202
> EBX=01e2ffbc SS=0187 ESP=01df0000 EBP=01df0024
> ECX=01df1df8 DS=0187 ESI=00000001 FS=6f8f
> EDX=00000001 ES=0187 EDI=816e5ee8 GS=0000
>
> Fault address almost always same & also Registers first row
> and second column.
> (Not computer expert so hope not including irrelevant
> info.)
>
> I'm hoping that the extra detail provided above might
> enable somebody to recognise exactly what is causing this
> problem
> and advise a solution as I have spent time trying to fix
> this and seem to be getting bogged down.
>
> Cheers.
>
> (Also posted Win98 internet section)