# [Resolved] Windows Registry and Explorer errors



## maynard732 (Jun 6, 2002)

Hello,

I have Windows 98se. About 1 week ago, I downloaded and installed WinDVD from Kazaa and installed. After the installation, I decided I did not want this, so I uninstalled. My next virus scan found a virus, some king of "Hammer", I think. Also I think the installation may have changed some of my settings, maybe a change to DMA settings, I'm not sure.

Now when I restart or reboot my computer I will get "Window's Registry Checker: Windows found a problem with registry, it will now repair and restart registry", I may not have the wording exact. I will hit OK, my computer will restart, and I will get "Explorer: This program has performed and illegal operation and will be shut down." The details with this:

EXPLORER caused an invalid page fault in
module <unknown> at 0000:9faa25f0.
Registers:
EAX=710b40f0 CS=017f EIP=9faa25f0 EFLGS=00010246
EBX=00000002 SS=0187 ESP=0093f8ac EBP=0093f8f8
ECX=00000000 DS=0187 ESI=0093f984 FS=264f
EDX=8298344c ES=0187 EDI=0093f974 GS=0000
Bytes at CS:EIP:

Stack dump:
71013faf 0093f8c4 0093f974 00000000 00000000 00439e28 bff7a3a0 00430000 0043ac34 0000002c 00000000 0043000c 0093001f 00000018 0043ac00 00000004

I will have to restart my computer at this point. Sometimes Windows will not load and shut down. I will then power down completely and power back up, sometimes twice, but then everything will seem to be fine. It seems there is some more time when opening applications or going into different screens, but I will get no other errors.

I have done virus scans every day since, and have not detected any more.

Is there some kind of diagnostic, or something I can run to see if all my Windows files are OK? Any idead on what may be going on?

I have ran Spy Bot search and Destroy and Ad Aware since, but am still experiencing the problems. I have the free version of Zone Alarm firewall and have AVG for my anti-virus, just and FYI.

Any suggestions?

Thanks
Maynard


----------



## Rollin' Rog (Dec 9, 2000)

First try running scanreg /fix and scanreg /opt as instructed here:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q201655&ID=KB;EN-US;Q201655

If that fails to resolve the problem, it may be recurring due to faulty ram. You can try a software checker and if it finds faults that would be a confirmation, but a pass is not always reliable.

http://www.simmtester.com/page/products/doc/download.asp


----------



## IMM (Feb 1, 2002)

Which anti-virus program do you use? Look through the AV log files to get the exact name of the virus. Some (with hammer in the name) corrupt CMOS settings.


----------



## maynard732 (Jun 6, 2002)

I checked my AV log and the name of the virus was "Win 32/Hantaner".

I ran the RAM diagnostic and it passed.

I ran scanreg/fix, /opt.

I have not observed any more of the Registry errors, but I am still observing the slowness and a lot of Explorer I llegal Operation errors and sometimes Windows is not starting up.

I forgot to mention this before, but Windows is slower when it does boot up, but right before the Win 98 screen I can see a black screen pop up real quick with a couple of lines of something, i cannot read because it is too quick. 

When I selected Command Prompt Only, before running scanreg, the first two lines before the C:\ were:

C:\>SET BLASTER=A220 17 D1 H7 P320 T6

C:\>SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV


Maynard


----------



## Rollin' Rog (Dec 9, 2000)

You probably have a lot of junkware that came bundled with Kazaa or some of the file shares. Kazaa lite, an alternative, does not include the "spyware" components and you should probably uninstall kazaa and switch to that. Even though you ran Spybot, if you continue to use Kazaa you may have remaining problems.

However to see what you currently have got running we need to see a post of the Startuplist (not the scanlog at this time) using the HijackThis application. The startuplist will also show us what is in your autoexec.bat file.

http://www.tomcoyote.org/hjt/

Also when you get those Explorer errors, continue to click on the "details" tab and let us know what it says for the modules and addresses shown in the first two lines.


----------



## maynard732 (Jun 6, 2002)

I ran Hijackthis. This is my Startuplist log, I also have the scanlog, in case we need that too,:

StartupList report, 4/12/03, 7:52:57 AM
StartupList version: 1.52
Started from : C:\MY DOCUMENTS\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\WINDOWS\SYSTEM\LXSUPMON.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MEDIA MANAGER\AIRSVCU.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Media Manager Indexer.lnk = C:\Program Files\Common Files\Microsoft Shared\Media Manager\AIRSVCU.EXE
Introducing Media Manager.lnk = C:\Program Files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
AVG_CC = C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
Pop-Up Stopper = "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
Optimum Online = C:\Program Files\Optimum Online\Netsurf.exe -tray
LexStart = Lexstart.exe
LXSUPMON = C:\WINDOWS\SYSTEM\LXSUPMON.EXE RUN

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
Avgserv9.exe = C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 10/4/2003, 7:39:16)

[rename]
NUL=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.BKP
NUL=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.471
C:\PROGRA~1\GRISOFT\AVG6\version.avg=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.471\version.avg
C:\PROGRA~1\GRISOFT\AVG6\avgcore.vxd=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.471\avgcore.vxd
C:\PROGRA~1\GRISOFT\AVG6\avg.ovl=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.471\avg.ovl
C:\PROGRA~1\GRISOFT\AVG6\avg6.avi=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.471\avg6.avi

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

C:\PROGRA~1\GRISOFT\AVG6\bootup.exe
SET BLASTER=A220 I7 D1 H7 P320 T6
SET SBPCI=C:\PROGRA~1\CREATIVE\AUDIO\DOSDRV

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Scan For Viruses.job
Run LiveUpdate (for Norton AntiVirus).job

--------------------------------------------------

Enumerating Download Program Files:

[iPIX ActiveX Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\IPIXX.OCX
CODEBASE = http://www.ipix.com/viewers/ipixx.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 4,891 bytes
Report generated in 0.222 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

After downloading Hijackthis, I went to extract the file and observed a Winzip32 Illegal Operation error with the Details:

WINZIP32 caused an invalid page fault in
module <unknown> at 0000:00000404.
Registers:
EAX=50010007 CS=017f EIP=00000404 EFLGS=00010246
EBX=0000000a SS=0187 ESP=00844440 EBP=0083e970
ECX=00000001 DS=0187 ESI=006121b4 FS=1ac7
EDX=0002cc94 ES=0187 EDI=00000404 GS=0000
Bytes at CS:EIP:
00 00 00 00 78 03 00 00 00 00 0b 02 27 c2 fe 80 
Stack dump:

I then restarted my computer and observed an Illegal Operation error when my ZoneAlarm Firewall was starting up, Details:

ZONEALARM caused an invalid page fault in
module FRAMEWRK.DLL at 017f:01734d5a.
Registers:
EAX=01ace800 CS=017f EIP=01734d5a EFLGS=00010246
EBX=00000000 SS=0187 ESP=0069dd98 EBP=0069ddc8
ECX=007c55c0 DS=0187 ESI=007c55c0 FS=30b7
EDX=00011f36 ES=0187 EDI=000003f4 GS=0000
Bytes at CS:EIP:
ff 74 ca fc e8 a6 c0 96 ff 69 00 6a 00 00 59 f7 
Stack dump:
01733e3f 0000077a 00000152 007c5670 00000000 000003f4 0000077a 00000000 00000000 0069debc 0173c598 00000000 bff54efc 01ac6b36 54a10401 00000002


----------



## Rollin' Rog (Dec 9, 2000)

Well you are certainly getting an oddball collection of errors with no obvious common denominator unless it is possibly a bad install of ZoneAlarm

The only real 'wild card' there is:

Optimum Online = C:\Program Files\Optimum Online\Netsurf.exe -tray

I don't know exactly what it does, there's not much info on it and noone has classified it as "spyware".

I think what I'd be doing now is to run *msconfig* and "clean-boot" the system by disabling startup items to see if you ca isolate anything as being the culprit.

Don't worry about making wrong choices, everything is reversable.

You can ignore scanregistry, loadpowerprofiles and system tray, everything else is fair game.

And although I still wouldn't rule out faulty ram, I'd through overheating in the mix as a possible cause. You might want to remove the case cover and check the fan and clean things out.


----------



## maynard732 (Jun 6, 2002)

I'll give this a try tonight. All the illegal operation errors do not repeat after a restart. A different one may appear, but not the same, restarting will take care of it, like the Zonealrm firewall. I restarted and it was fine, same with the Winzip. 

I'll check out the fan and clean boot and post back.

Thanks


----------



## walkeriam (Feb 19, 2002)

OOL is Optimum Online, a cable modem service provider in the NY Metro area.

*Also:*
Lexpps.exe

(Lexmark) Lexmark Printer Port Scanner. Background task which auto-loads with the rest of the printer drivers and which allows your Lexmark X or Z Series to be shared over a Windows peer-to-peer network using the conventional method of setting up a shared networked printer (without it, you will not be able to share the printer using the conventional Windows method).

Recommendation : 
This task is a comprehensive nightmare. From preventing your PC from booting up, to interfering with your network card, to asking your Internet firewall for permission to install itself as a server application, to general PC instability, this task has everything to make you instantly return your Lexmark X or Z Series printer and go for something else, and some users have done so !! In order to regain your sanity the first thing to do is to rename LEXPPS.EXE to LEXPPS.EXE.OLD (do it in Safe Mode if you cannot boot your PC normally)  this will ensure that this task never loads and will cure all the problems that it causes. If you need to network the printer over a peer to peer network, do not use the standard manner, instead install the printer as a local printer on the remote PC, and then go and change the port from a local port to the network share that the printer is known as. 
*Author: http://www.answersthatwork.com/Tasklist_pages/tasklist_l.htm*


----------



## maynard732 (Jun 6, 2002)

I will rename that file. I do not ever use my printer for anything but printing from this computer.

When starting up my computer just now, I got some display settings are not correct errors and another Windows registry error, and after a couple of restarts I got:

Error Loading Explorer.exe
You must reinstall Windows

I hit OK and got:

Error
The MSVCRT.DLL file is to missing export KERNEL32.DLL:LockFile

I was locked up then. Powered down and back up and everything is working OK, I got no errors just now.

At this point I am even willing to reinstall Windows, I have nothing I cannot easily put back on, including my drivers.

What should my next step be, I will wait until I hear before I change or do anything else.


----------



## Rollin' Rog (Dec 9, 2000)

I would say the chances are greatest that you are suffering from a hardware problem causing general instability. Most likely cause would be heat in my opinion.

AMD's are always particularly suspect, especially the AMD k6/2's

Sometimes software coolers such as Rain2 can help.

http://www.notebookreview.com/coolcpu.html

But I think you should check the fan and clean out the case first and foremost.


----------



## walkeriam (Feb 19, 2002)

If all else fails, I would Format and Re-install Windows98se. Just make sure you get any info you need off first. 

In your very first post on this problem you say you had a Virus and you installed Kazza. Kazza alone will cause your computer to act up, then on top of that you had a virus. Thats why I would do a clean install.

Sorry I can't be of more assistance with this problem, but it seems when you fix one thing it creates another. 

Let me know how you fix it.

Thanks!


----------



## maynard732 (Jun 6, 2002)

Hello,

In the first post I meant to say I downloaded the program WinDVD from Kazaa, I have had Kazaa installed for sometime. I think the Virus came from the program I installed.

I am planning on giving the inside of my computer a cleaning this weekend, I just purchased some canned air. I did take a peek the other night and observed the fan to be very dusty, I wouldn't think so much crap could get inside. I will clean, and try a clean boot if needed and post back.

Thanks
Maynard


----------



## maynard732 (Jun 6, 2002)

I cleaned out the inside, the boards and the fan. I renamed Lexpps, and I clean booted. Even with the clean boot I am still getting the registry, explorer, and other illegal operation errors.

Walkeriam, 
Is there a way I can clean my hard drive, reinstall Windows and start from scratch? Is that what you were referring to in you post when you said Format and reinstall Windows 98se?

Can you please post a link that will have detailed instructions on how to do this? I don't know how to do this and want to make sure it gets done correctly. I have located all my install CD's with the drivers.

I think at this point I am ready to just start from scratch. I have learned my lesson for the last time with Kazaa. I am going to purchase good anti-virus, firewall, and spyware protection software.


----------



## Rollin' Rog (Dec 9, 2000)

Reinstallation procedures depend on the type of reinstallation media that you have. The link below, a very good one, assumes you have a Microsoft CD with the ProductKey. If you don't know your ProductKey, you can run *regedit* and enter it in the Edit>Find (one word). If there is an OEM product ID there, you should copy it as well.

http://www.hexff.com/win98_install.html

You probably don't need to fdisk (repartition) the drive. And if you have all the proper drivers, it will certainly lighten your task.

But if there is an underlying hardware problem, it is probably going to remain, and may even prevent a successful reinstall.

What errors did you receive when "clean booting"? Did you uncheck all startups in msconfig > Startups (scanregistry, and system tray can be left)

One test in particular that might be worthwhile using msconfig, is to click on the Advanced tab and load a standard VGA (safemode type video driver). If the errors don't persist, then you have a problem with the card or its drivers.


----------



## maynard732 (Jun 6, 2002)

With the clean booting, I am still getting the same errors. Most of the time it is Iexplore errors. I did see a Windows registry a couple of times, and one Rundll error. The errors are different every startup. I still have everything unchecked in my start up (except systray, scanregistry, and loadpowerprofiles.) I have 2 loadpowerprofiles, and I left both of them checked.

I went into msconfig and went to the standard VGA, still observed the Explore error on start up:

I will post the details if you want to see them, but I just tried to open Word and got an Illegal operation error.

Any other suggestions, diagnostics? 

I have all my registration numbers for win 98, so that shouldn't be any problem.


----------



## Rollin' Rog (Dec 9, 2000)

In spite of all you've done, I'm still thinking ram or heat. Is there more than one module of ram installed? If so, I'd try swapping out one at a time. It's a good idea to clean the contacts with an eraser head and wipe with an alcohol dampened cloth as well. Anti static precautions should be taken before handling, such as grounding hands against the case.

And although I doubt IE itself is the problem, have you tried running the Repair Tool accessible through Add/Remove programs > Internet Explorer > Remove > Repair ? It might turn up something.

If the system is shutdown and left to cool for a period of time, do the errors resume immediately on rebooting? If not, you might want to try that link for Rain2 and see if it helps.


----------



## maynard732 (Jun 6, 2002)

I've let it sit for a couple of days powered down and still get the errors. It doesn't seem to matter if its been minutes or days, i still get the errors.

i am still clean booting. Just now starting up was the worst it has been. I got a lot of the Windows Registry schecker errors, 1 scanreg illegal operation, and a couple of systray illegal operation, all immediately after windows initializes.

I ran the repair on internet explorer, observed the following:

"Cannot repair Internet Explorer 6, please run setup again and reinstall."

How do I run setup again and reinstall?

Do you think this has to do with my problem or is a result of what is going on?


----------



## Rollin' Rog (Dec 9, 2000)

Well, that would certainly tend to discount heat as an issue. I still wouldn't exclude ram.

The message concerning IE certainly tells us there is some serious damage, possibly involving core shell files that affect the rest of the system.

To rerun "setup" look in the Program Files folder for IE and you should find a setup.exe file there. That is what they are suggesting be run again. Another alternative is to uninstall IE, which returns it to the previous installed version. It can then be upgraded again from there.


----------



## maynard732 (Jun 6, 2002)

I have reinstalled Windows and everything has been working fine since.

Thank to everybody for your help!

Maynard


----------

