msgsrv32 error when booting up

Hi,
My sister-in-law has been having a problem booting up her Win98 system ever since her brother was on-line and "did something ". He's not sure what he did, but ever since then we can't get into Windows. No new hardware or software installed. Here are the details:

When booting up, I'm always getting: MSGSRV32 caused an invalid page fault in module KERNEL32.DLL at 0177:bff9dfff.

Sometimes I can hit the close button and some other ones will come up:
-- MSTASK caused a gpf in module KRNL386.exe at 0001:00000681
-- SRV32 caused a gpf in module KRNL386.exe at 0001:00005ebd

There are some times I'll get the blue screen with: A fatal exception 0D has occurred at 0157:00005ED2. The current application will be terminated
Also a similar error with 0157:00005ebd will come up sometimes too.

Here's what I've tried so far:
-- going into safe mode (no luck, just black screen after DOS initial startup screens.
-- copied kernel32.dll from my Win98 CD into /windows/system. (incidentally, the one on the CD has a newer date than the one that was on the drive, but same file size).
-- I was thinking about installing Win98 again, but I have the Full Version disk, and not the Upgrade disk, so it won't install.
-- Tried searching Microsoft's help site with no luck.
-- Also went to: http://www.techadvice.com/issues/how-to.asp?word1=msgsrv&word2=32. They have a link for a similar error (TA00144 - Error Message "msgsrv32 invalid page fault at kernel32.dll at 0167:bff9dfff" when windows opens the desktop and/or when installing and uninstalling programs or using FrontPage (errors in CMDUI.PRF or corrupt *.web files) with the only difference from mine being my module is 0177 and theirs is 0167. Only thing is the link for the answer won't work.

Can anybody give me a hand with this? My brother-in-law is can't really say what he was doing when this happened. Just that he was on the web.

Some final specs on the system:
Win98
256 RAM
Norton AV 2002
AOHell 9.0
MS Office 2000

Any help would be truly wonderful and very appreciative. I'm usually pretty good with computers, but this one's got me.

Thanks,
Cintoman

 

Me again,
Just tried booting up again in safe mode, and after a blue screen fatal exception error with VXD, it actually came up !!! Checked Device Manager and there are no "!" conflicts. I was thinking about running Spybot, Adaware, System Mechanic, but the only thing is that I don't have them on the HD, but rather on CD. And, of course, in safe mode, there's no CD-Roms.

Any ideas on what I should try?

Thanks again,
Cintoman

 

In Safe Mode, go to Start/Run, type in Msconfig and press Enter. Click on Start tab, disable everything, except for Systray, both PowerProf entries, Scanregw. No doubt you will see Regsvr32 in here, post the DLL file it is trying to register. This may clue us in as to what is happening, Click on Win.Ini tab. expand the Windows folder visible there, and make sure these entries are as below.
load=
run=
Have you tried using Norton and doing a scan in Safe Mode? If up to date, this may help.

You could try this command at the prompt;
scanreg /restore
pick a registy dated before this happened.

 

Hi markp62,
Thanks for you quick reply. Well, I tried what you mentioned and unchecked everything out of msconfig, except the files you advised not to uncheck. Surprisingly, Regsvr32 was not listed. Maybe it's because it doesn't startup in safe mode, and hence it allows me to get in. Not sure.

Also checked the win.ini tab. Load= was there, but no run=. So I added it.

My apologies....I thought Norton AV was on the system, but it wasn't.

Rebooted the system, and it looked liked things were coming up fine, but I still got the small window with the regsvr32 error. Desktop icons came up, but many of them were the generic windows icon. Of course, I tried closing out the regsvr32 error window, and some other ones came up again, including a few blue screens. If I remember correctly, they were the same ones I mentioned in my original post (MSTASK being one of them).

What killed it completely though was when Explorer has caused and invalid page fault in USER.exe at module 001b:0000001d. The system froze totally now.

Rebooted normally, and this time it didn't get as far as showing the icons. Tried safe mode again, and all my unchecked entries in msconfig's Start tab were checked again. Repeated the process, rebooted into normal mode, but still no luck.

Any more ideas?

I'm going to try seeing if I can get into normal mode again, and this time not click the regsvr32 window closed. Maybe I can get into msconfig and see what dll regsvr32 is trying to register. If I can, I'll post it here.

P.S.: As far as the scanreg /restore tip you mentioned....I'm assuming this can be done if I choose "command mode only" when booting up holding the ctrl key down? If that's the case, would I run this from the c:\windows directory?

Thank you again for all your time. It is very much appreciated.
Cintoman

 

Yes. pick one dated before this happened, maybe two days?
However, with no Norton, or if any other AV programs do not exist, this Regsvr32 may not be the legitmate file, it could be a virus, restoring a previous registry may prevent it from starting.

If you do get it going, and able to get online, go to this link, and the Online Trojan scan below in my signature.
RAV Online Scan.
You may be interested in AVG, from the link below.

 

This message can occur when your password list (PWL) file is damaged.

Go to the following site and download mspwlupd.exe:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;187965

 

Hi again,
Well, earlier today, I was able to restore my registry using "scanreg /restore ". The next recent date was 6/11/04, which was fine for me, since my sister-in-law doesn't use it for much more than e-mail/websurfing/MS-Word.

The restore worked and things are running perfectly fine !!!!

I will take you up on your suggestions to check out some of the online scanning resources in your sig. Many thanks to you, as well as Plansdowne for your quick and very helpful responses. You guys are great !!!

Cintoman

 

Glad to hear you are up and running, and thank you for posting back the results.