Illegal Program

Hi

I'm using win98 se.

the problem is, in the middle of using application (Eg: Excel), there is always this error msg :" Illegal Program..." and u only hav one options tat is click Close.

Once tis msg begins pop out, whenever I open any other application ( EG: MSword), I will oso get d same msg.

Even, I restart the machine oso no use....

Very headache...

is it bcoz of virus ?

pls help....


TAC

 

have scan using some of tis program but still no use....

any ideas ?

TAC

 

Are you sure the message isn't "this program has committed an illegal operation and will be shut down'? In this message box there usually is a button to click on named Details.
BTW, an illegal operation is one program trying to put data into memory where another program already has use of that memory.
It is most likely one of your programs starting up, and could be something you are unaware about.
Do you have TweakUI installed? If you do. open it. Then click on the Paranoia tab, there is a section titled Illegal Operations, with a checkbox for 'Log application errors to Faultlog.Txt', enable this.
This file will be created at the next illegal operation in the windows folder, and it will have the offending application named in it.
BTW, did Ad-Aware or Spybot remove anything besides a DSO exploit or Alexa Related?
If either of them did, why not post a HijackThis log? You can find the link for this at Quicklinks. Be sure to unzip to it's own folder before doing the scan.

 

Are you sure the message isn't "this program has committed an illegal operation and will be shut down'? In this message box there usually is a button to click on named Details.

yes, you r rite....
i got the msg above...


BTW, an illegal operation is one program trying to put data into memory where another program already has use of that memory.
It is most likely one of your programs starting up, and could be something you are unaware about.

Do you have TweakUI installed? If you do. open it.
I don't have TweakUI installed. Where to download this....


BTW, did Ad-Aware or Spybot remove anything besides a DSO exploit or Alexa Related?
What is DSO exploit, Alexa Related ?


If either of them did, why not post a HijackThis log?
What do you mean by post a Hijack This Log?

 

The below link has Tweakui, and instructions on how to install it, real simple. Be sure to get the one for 98, the first one is for XP.
http://www.annoyances.org/exec/show/tweakui

HijackThis is a program that can be used to find things that shouldn't be there. It is best used after an up to date virus scan, and after scans by updated installations of Spybot and Ad-Aware. You would use to to scan and create a log, then paste the entire thing on here.
You can get it here. Unzip it into it's own folder before you do a scan.
http://www.spywareinfo.com/~merijn/downloads.html

The DSO and Alexa are common things found by Spybot on any system, anything else it finds are uncommon and are usually not wanted.

 

OIC...
Thanks for the info...

But i'm not sure which is d spyware and which is not ?

Seems everything is usable...so do not know which one to delete....

Just want to ask you, if the Illegal Operation still popping out after scan and clear,
is the problem cause by the RAM is not enough ?

Pls help on tis..
still headache wif d problem...

OH...

TAC

 

An illegal operation will not be fixed by adding RAM. It would be fixed by finding out which program one it is.
How to find out:

If you have installed TweakUI, and followed the above instructions, and an illegal operation has occured since then, there is a file located in the windows folder, named Faultlog.Txt. Copy and paste the entire thing onto here.

When using HijackThis, and select the Scan and Save Log button, it will do a scan, and create the log in Notepad. Copy and Paste the entire HJT log on here. Advice will be given as to what should not be there.

 

You have yet to supply the information I have asked for to help solve this problem. Without it, I can only make a guess, and I am not going to do that on this problem.
Until I see the Faultlog.Txt file or a HijackThis log, there is nothing I can do for you.
Or you can see if these links can help you.
http://support.microsoft.com/?scid=kb;EN-US;Q200149
http://support.microsoft.com/default.aspx?scid=kb;en-us;276393&sd=tech
http://support.microsoft.com/?kbid=189952

 

Here's the Frunlog.txt contents :-

FirstRunScreens:Start
ProcessInfInstall:File:C:\WINDOWS\OPTIONS\OEMAUDIT.INF: Section=:OneTime:
ProcessInfInstall:Failed to open:C:\WINDOWS\OPTIONS\OEMAUDIT.INF: reRet=105
VcpClose:About to close
VcpClose:About to End
VcpClose:About to Terminate
SpezialGeninstalls:Start
SpezialGeninstalls:Looking for :C:\WINDOWS\OPTIONS\PREDUP.TAG:
Intl:INTL:0:
GetUserInfo:INIT
DoPreInstallWork:Auditmode :0:
PrepareRunonce:Failed to open :C:\WINDOWS\OPTIONS\OEMAUDIT.INF:
ProcessInfInstall:File:C:\WINDOWS\OPTIONS\EndUser.INF: Section=:Options:
ProcessInfInstall:Failed to open:C:\WINDOWS\OPTIONS\EndUser.INF: reRet=105
VcpClose:About to close
VcpClose:About to End
VcpClose:About to Terminate
IsKeyEmpty:Start
Timer:Start OPKRemoveInstalledNetDevice :149888:
Timer:End OPKRemoveInstalledNetDevice :149888:
CheckRunonceSetup:Start
IsKeyEmpty:Start
IsKeyEmpty:1) Have :Time zone: :RUNDLL32.EXE SHELL32.DLL,Control_RunDLL TIMEDATE.CPL,,/f:
CheckRunonceSetup:Check for wrapper =
FirstRunScreens:Exit:0


The Hijackthis.log.txt is as below :-

Logfile of HijackThis v1.99.1
Scan saved at 10:15:06 AM, on 2/23/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\WINDOWS\DESKTOP\POP\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intra.tangs.com.my/
O1 - Hosts: 128.128.1.5 intra.tangs.com.my
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://intra.tangs.com.my/iNotes6.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 202.188.0.133



Pls advice...


TAC

 

Your HJT log is fine.
This Frunlog.txt isn't the one I needed to see, it was named Faultlog.Txt.
If you cannot find this file, and you have had an illegal operation in the last day or so, then you need to enable the setting using Tweakui I described in my previous post.
The below link has Tweakui, and instructions on how to install it, real simple. Be sure to get the one for 98, the first one is for XP.
http://www.annoyances.org/exec/show/tweakui
Just download Tweakui, and unzip it. Note, you now have several files, all beginning with the name Tweak, with different 3 letter extensions.
Go to where you put the files, and right click on Tweak.INF, and select Install. If Install does not appear, you have the wrong Tweak file selected.
After it is installed go into the Control Panel and open TweakUi. Then click on the Paranoia tab. Look below, there is a section titled Illegal Operations, with a checkbox for 'Log application errors to Faultlog.Txt', enable this.
The next time the illegal operation occurs, the file will be made.
It will look like this when opened.

**********************************************************************
Date 09/21/2004 Time 23:04
EXPLORER caused an invalid page fault in
module SDHELPER.DLL at 016f:01bd9b8d.
Registers:
EAX=008a0f10 CS=016f EIP=01bd9b8d EFLGS=00010207
EBX=00000001 SS=0177 ESP=0089fed4 EBP=008a0ed0
ECX=008a0f60 DS=0177 ESI=01cda664 FS=4e57
EDX=01cda664 ES=0177 EDI=01cda6ac GS=0000
Bytes at CS:EIP:
50 83 c4 f8 53 56 89 4d f8 89 55 fc 8b f0 bb 00
Stack dump:

But before you do that, go to Start, and then Run. Type in SFC and press Enter. You now have the System File Checker going. Just click on the Start button in that little windows. The default settings will be fine for now. It will look for corrupt files, and may prompt you for windows CD for a replacement, or you can use the option to browse to wherever you have the windows setup files located. This may be C:\Windows\Options\Cabs.

 

Here's the content of Faultlog.txt:-


**********************************************************************
Date 02/23/2005 Time 10:08
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=0124d5f4 EBP=0124d660
ECX=00000000 DS=0177 ESI=00000000 FS=3577
EDX=0124d501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
004730c4 636b1a0e 004730c4 00472d70 00000000 635f87f2 01af5c50 00472d70 00000000 635fa270 01af4a00 636785ab 00000001 636866d7 0044df94 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:11
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=0124d5f4 EBP=0124d660
ECX=00000000 DS=0177 ESI=00000000 FS=12ef
EDX=0124d501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
004791b4 636b1a0e 004791b4 00478e60 00000000 635f87f2 01af5f50 00478e60 00000000 635fa270 01b013b0 636785ab 00000001 636866d7 0047e968 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:11
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=017bd5f4 EBP=017bd660
ECX=00000000 DS=0177 ESI=00000000 FS=1797
EDX=017bd501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
0043779c 636b1a0e 0043779c 00437448 00000000 635f87f2 01ae12d0 00437448 00000000 635fa270 01aee530 636785ab 00000001 636866d7 0044552c 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:15
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=017bfbd4 EBP=017bfc40
ECX=00000000 DS=0177 ESI=00000000 FS=4417
EDX=017bfb01 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
00478b20 636b1a0e 00478b20 004787cc 00000000 635f87f2 01ae12d0 004787cc 00000000 635fa270 01b02e60 636785ab 00000001 636866d7 0048d9a0 6687b0f5

Here's another Faultlog.txt just updated :=


**********************************************************************
Date 02/23/2005 Time 10:08
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=0124d5f4 EBP=0124d660
ECX=00000000 DS=0177 ESI=00000000 FS=3577
EDX=0124d501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
004730c4 636b1a0e 004730c4 00472d70 00000000 635f87f2 01af5c50 00472d70 00000000 635fa270 01af4a00 636785ab 00000001 636866d7 0044df94 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:11
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=0124d5f4 EBP=0124d660
ECX=00000000 DS=0177 ESI=00000000 FS=12ef
EDX=0124d501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
004791b4 636b1a0e 004791b4 00478e60 00000000 635f87f2 01af5f50 00478e60 00000000 635fa270 01b013b0 636785ab 00000001 636866d7 0047e968 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:11
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=017bd5f4 EBP=017bd660
ECX=00000000 DS=0177 ESI=00000000 FS=1797
EDX=017bd501 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
0043779c 636b1a0e 0043779c 00437448 00000000 635f87f2 01ae12d0 00437448 00000000 635fa270 01aee530 636785ab 00000001 636866d7 0044552c 6687b0f5
**********************************************************************
Date 02/23/2005 Time 10:15
EXPLORER caused an invalid page fault in
module MSHTML.DLL at 016f:636a86a0.
Registers:
EAX=00000000 CS=016f EIP=636a86a0 EFLGS=00010206
EBX=00000000 SS=0177 ESP=017bfbd4 EBP=017bfc40
ECX=00000000 DS=0177 ESI=00000000 FS=4417
EDX=017bfb01 ES=0177 EDI=00000000 GS=0000
Bytes at CS:EIP:
8b 06 85 c0 74 09 83 c0 fc 50 e8 ee ea ff ff 83
Stack dump:
00478b20 636b1a0e 00478b20 004787cc 00000000 635f87f2 01ae12d0 004787cc 00000000 635fa270 01b02e60 636785ab 00000001 636866d7 0048d9a0 6687b0f5
**********************************************************************
Date 02/25/2005 Time 10:14
IFRUN60 caused a general protection fault
in module SD4.DLL at 0001:00006345.
Registers:
EAX=0000afb6 CS=1277 EIP=00006345 EFLGS=00000202
EBX=00001620 SS=30a7 ESP=0000af1e EBP=0000b0bc
ECX=00000000 DS=1347 ESI=00000000 FS=0000
EDX=00000000 ES=038f EDI=00000fc2 GS=0167
Bytes at CS:EIP:
ff 1e c6 0d 0b c0 74 19 83 be 14 ff 40 77 12 f6
Stack dump:
00000000 00000000 00000000 afb60001 0fc230a7 2c2f0000 00000001 0000134e 4c4f4f54 504c4548 5c3a4300 444e4957 5c53574f 54535953 535c4d45 442e3444
**********************************************************************
Date 02/25/2005 Time 10:17
IFRUN60 caused a general protection fault
in module SD4.DLL at 0001:00006345.
Registers:
EAX=0000afb6 CS=1277 EIP=00006345 EFLGS=00000202
EBX=000000d6 SS=37f7 ESP=0000af1e EBP=0000b0bc
ECX=0000ffff DS=1347 ESI=00000000 FS=0000
EDX=0000136f ES=0000 EDI=00000f86 GS=0000
Bytes at CS:EIP:
ff 1e c6 0d 0b c0 74 19 83 be 14 ff 40 77 12 f6
Stack dump:
00000000 00000000 00000000 afb60001 0f8637f7 2c2f0000 00000001 00002c6e 2e344453 004c4c44 427c0002 94900002 ffffbffc 43bdffff 0000bff9 df600000
**********************************************************************
Date 02/25/2005 Time 10:26
RUNDLL32 caused a general protection fault
in module SD4.DLL at 0001:00006345.
Registers:
EAX=000082ce CS=1277 EIP=00006345 EFLGS=00000202
EBX=000000d6 SS=2f77 ESP=00008236 EBP=000083d4
ECX=0000ffff DS=1347 ESI=00000000 FS=0000
EDX=00004067 ES=0000 EDI=00001502 GS=0000
Bytes at CS:EIP:
ff 1e c6 0d 0b c0 74 19 83 be 14 ff 40 77 12 f6
Stack dump:
00000000 00000000 00000000 82ce0001 15022f77 2c2f0000 00000001 00002f5e 2e344453 004c4c44 427c0002 7ce40002 ffff0001 43bdffff 0000bff9 f2780000
**********************************************************************
Date 02/25/2005 Time 10:26
RUNDLL32 caused a general protection fault
in module SD4.DLL at 0001:00006345.
Registers:
EAX=000082ce CS=1277 EIP=00006345 EFLGS=00000202
EBX=000000d6 SS=2eb7 ESP=00008236 EBP=000083d4
ECX=0000ffff DS=1347 ESI=00000000 FS=0000
EDX=00002c7f ES=0000 EDI=000012f6 GS=0000
Bytes at CS:EIP:
ff 1e c6 0d 0b c0 74 19 83 be 14 ff 40 77 12 f6
Stack dump:
00000000 00000000 00000000 82ce0001 12f62eb7 2c2f0000 00000001 00002146 2e344453 004c4c44 427c0002 7ce40002 ffff0001 43bdffff 0000bff9 f2780000
**********************************************************************
Date 02/25/2005 Time 10:27
RUNDLL32 caused a general protection fault
in module SD4.DLL at 0001:00006345.
Registers:
EAX=000082ce CS=1277 EIP=00006345 EFLGS=00000202
EBX=000000d6 SS=29c7 ESP=00008236 EBP=000083d4
ECX=0000ffff DS=1347 ESI=00000000 FS=0000
EDX=00001a0f ES=0000 EDI=000018ee GS=0000
Bytes at CS:EIP:
ff 1e c6 0d 0b c0 74 19 83 be 14 ff 40 77 12 f6
Stack dump:
00000000 00000000 00000000 82ce0001 18ee29c7 2c2f0000 00000001 00002b26 2e344453 004c4c44 427c0002 7ce40002 ffff0001 43bdffff 0000bff9 f2780000

I had run SFC, and C:\Windows\System is corrupted and I click Start, says that successful.

How is the problem be solved ?


TAC

 

You seem to have problems with one of Internet Explorer files, and one of your printer drivers.
While you may have IE closed, it is embedded deeply in the Windows. When you try to open My Computer, this window by default is displayed 'View as Web Page', calling up the use of some of IE's files.
This is why I suggest running the Internet Explorer Repair Tool, or update your IE.
To run the tool, go to Control Panel\Add/Remove Programs, doubleclick the IE entry. In the new window that appears, select to Repair, reboot when prompted.
If you still have the problem, please post back your version of IE. Also, look in your C:\Windows\System folder for the file MSHTML.DLL, remember it is a system file and may be Hidden. Right click on it, and select Properties, click on Version tab, and post the version number.

I take that to mean that a file found to be corrupted, and was replaced? Do you remember being prompted about creating or saving a file to the C:\Windows\Helpdesk\Sfc folder?

 

yes, i had save the file in Sfc folder.

the same error as soon as i login and couldn't double-click on any icon on the desktop....

so, i had try on repair the IE and restarted. for the moment, nothing seems to happen yet...

but I will still post the version later....

thanks for ur help
really appreciate tis....


TAc

 

STILL....HAVE THE SAME PROBLEM!!!!!

The version is 6.00.2800.1491

Pls help!

TAC

 

Pls help me on tis...

should i reformat the whole disk OR just reinstall the Win98 will do ?

any ideas from u guys out there ?


rgds,

TAC

 

Sorry about not getting back to you, have been busy here.
Reinstalling windows will not help, but a repair of IE would. Go to Control Panel\Add/Remove Programs, double click the IE6 entry, then in the new window select to Repair, reboot when prompted.

 

Hi,

I had tried repair but the same problem remains...

HOW to solve tis ?


TAC

 

Illegal operations are tough to pin down, there are a few M$ pages on this to try. Check this google search and you will see what I mean.
All I have for you is these possible workarounds for now.
http://support.microsoft.com/default.aspx?scid=kb;en-us;259096

Disable Active Desktop, if on. It usually does cause problems. If you activated to show a JPG file, convert it to a BMP file using Irfranview.


Do this, Restart in Dos Mode and do these commands, this is to make sure no temp files are causing the problems, and Office does create bunches of them. You cannot clear these folders like these commands will.
The first and next to last commands will appear to do nothing when done correctly.
smartdrv
deltree c:\windows\history
deltree c:\windows\cookies
deltree c:\windows\temp
deltree c:\windows\tempor~1
scanreg /opt
scanreg /fix
Type a Y that you want to delete, check for typos at this time.
When you get the message that windows has repaired the registry, reboot.

 

Hi,

Hav dun all the command.

Seems to be OK for now...

Hopefully...


TAC