IE6 Kernel32.dll error

I just recently started getting an error quite often in IE6. It says:

This program has performed an illegal operation and will be shut down.

Details:
Explorer caused an invalid page fault in module Kernel32.dll at 017f:bff8928f.

Registers:
EAX=00000000 CS=017f EIP=bff8928f EFLGS=00010202
EBX=00000000 SS=0187 ESP=043bcb00 EBP=043bcb24
ECX=bff8928c DS=0187 ESI=1000e4a0 FS=19df
EDX=bffc9490 ES=0187 EDI=043bd384 GS=0000
Bytes at CS:EIP:
8b 40 18 85 c0 74 06 50 e8 dc cf ff ff 8b 75 08
Stack dump:
043bd384 1000e4a0 00000000 043bcb00 043bc930 043bd1d8 bffc05b4 bff79200 ffffffff 043bd1e4 bff8ac26 00000000 043bd174 1000ad0e 1000e4a0 1000a849

I ran the repair feature a couple of times with no improvement. Any ideas? Thanks!

Edit: Oh, I use Win98. Sometimes this error message causes IE6 to shut down completely, sometimes only one page closes and I can continue to surf with no apparent problems.

 

I just got a different error message, and this one shut down the entire program just as the one I posted previously.

EXPLORER caused an invalid page fault in
module KERNEL32.DLL at 017f:bff7b9a6.

Registers:
EAX=00000000 CS=017f EIP=bff7b9a6 EFLGS=00000246
EBX=00000000 SS=0187 ESP=0351fce8 EBP=0351fd0c
ECX=0887e4d4 DS=0187 ESI=0887e590 FS=3a7f
EDX=816649ec ES=0187 EDI=0887e590 GS=239e
Bytes at CS:EIP:
ff 76 04 e8 13 89 ff ff 5e c2 04 00 56 8b 74 24
Stack dump:
0887e4d4 1a40b2cb 0887e590 00000000 0351fd70 0887e4d4 00000000 80004005 00000000 0351fd2c 1a40e84f 00000022 00000000 00000000 0887e4d4 00000000

 

Try 2 things:

1. A full virus scan with updated definitions.
2. Download and run AdAware to check for adware/spyware/foistware....

 

Lily--This may be out of date, but have a look
http://www.generation.net/~hleboeuf/errkrn32.htm

 

 
 
Lily,
This may be a page file problem, too.

It wouldn't hurt to delete your page file and build a new one.

This can be done from DOS (delete win386.swp) or with many tweakers that allow you to delete your page file on shutdown:
www.xteq.com

If you have made changes in your page file (swap file), try returning it to system-managed.

 

I ran an online virus scan using Panda, and I use AdAware and PestPatrol often, so I'm sure that's not the problem.

I made a couple of changes using the URL Jim posted, but it's still shutting down.

So, I'm contemplating Abraxas' advice, but the "build a new one" makes me nervous ---- does this mean my puter will build it automatically, or do I have to know how to do something? If I made changes in my page/swap file, it was weeks ago (yes, I do stuff and forget what) so I doubt that's it. I'll delete win386.swp just as soon as I'm reassured that I don't have to know how to rebuild the file.

Thanks everyone!

 

The puter will just make a new one. No intervention required on your part, Lily .

 

Thank you! I deleted the .swp file this am. So far no problems with error messages.

 

(Fingers crossed).

 

Whoops, just got another error. Any more ideas?

EXPLORER caused an invalid page fault in
module KERNEL32.DLL at 017f:bff8928f.
Registers:
EAX=00000000 CS=017f EIP=bff8928f EFLGS=00010202
EBX=00000000 SS=0187 ESP=01e0ddc0 EBP=01e0dde4
ECX=bff8928c DS=0187 ESI=1000e4a0 FS=3c6f
EDX=bffc9490 ES=0187 EDI=01e0e644 GS=0000
Bytes at CS:EIP:
8b 40 18 85 c0 74 06 50 e8 dc cf ff ff 8b 75 08
Stack dump:
01e0e644 1000e4a0 00000000 01e0ddc0 01e0dbf0 01e0e498 bffc05b4 bff79200 ffffffff 01e0e4a4 bff8ac26 00000000 01e0e434 1000ad0e 1000e4a0 1000a849

 

Could be one of your background apps.

Download and run Startup List and post back the contents of the file it creates

http://www.geocities.com/merijn_bellekom/new/files.html

 

A number of corrupted files can cause this. Among them:
shdocvw.dll, shlwapi.dll, comctl32.dll,
explorer.exe, shell32.dll, or mshtml.dll.

Norton's System Doctor is also a culprit, as is Norton's protected recycle bin when disk space becomes low due to Norton protection, even though all signs show plenty of disk space.

Some Diamond drivers can cause this by replacing comctl32.dll.

And so on.

I'd start with a repair of Internet Explorer or go directly to a system file check to replace any corrupted files.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q185836

 

Be very careful with SFC. It is very good at detecting files that are not actually corrupted. As well, you need to be very careful when you do any restores to ensure that you are not reloading old versions of files.
SFC is a good tool, when run regularly, to keep track of files and to do basic integrity checks. But on an ad hoc basis, it can be a dangerous tool.

 

WhitPhil - Here's the list from Startuplist:

StartupList report, 10/15/02, 12:13:23 PM
StartupList version: 1.34.0
Started from : C:\WINDOWS\TEMP\POWERZIP.TMP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\EUDORA\EUDORA.EXE
C:\PROGRAM FILES\POWERZIP 6.0\POWERZIP.EXE
C:\WINDOWS\TEMP\POWERZIP.TMP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = c:\windows\scanregw.exe /autorun
SystemTray = SysTray.Exe
TMOUSE = C:\Toshiba\Mouse\tmouse.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
MiniLog = C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[>PerUser_MSN_Clean] *
StubPath = c:\windows\msnmgsr1.exe

[PerUser_LinkBar_URLs] *
StubPath = c:\windows\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /uninstall

[{7790769C-0471-11d2-AF11-00C04FA35D02}]
StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /uninstall

[>IEPerUser] *
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exeadvpack.dll

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\JUNGLE.SCR
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 12/10/2002, 14:56:26)

[rename]
NUL=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401
C:\PROGRA~1\GRISOFT\AVG6\version.avg=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\version.avg
C:\PROGRA~1\GRISOFT\AVG6\avgk32.dll=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avgk32.dll
C:\PROGRA~1\GRISOFT\AVG6\avgvv.exe=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avgvv.exe
C:\PROGRA~1\GRISOFT\AVG6\avgw.exe=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avgw.exe
C:\PROGRA~1\GRISOFT\AVG6\avg.lng=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avg.lng
C:\PROGRA~1\GRISOFT\AVG6\avgcore.vxd=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avgcore.vxd
C:\PROGRA~1\GRISOFT\AVG6\setup.exe=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\setup.exe
C:\PROGRA~1\GRISOFT\AVG6\setup32.dll=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\setup32.dll
C:\PROGRA~1\GRISOFT\AVG6\setup.lng=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\setup.lng
C:\PROGRA~1\GRISOFT\AVG6\avgscan.exe=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avgscan.exe
C:\PROGRA~1\GRISOFT\AVG6\avg.ovl=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avg.ovl
C:\PROGRA~1\GRISOFT\AVG6\avg6.avi=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.401\avg6.avi

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

@C:\PROGRA~1\GRISOFT\AVG6\bootup.exe
@C:\PROGRA~1\NORTON~1\NAVDX.EXE /Startup
@echo off
Path=c:\dos;C:\PROGRA~1\GRISOFT\AVG6
SET PATH=C:\MOUSE;%PATH%
C:\MOUSE\MOUSE.COM
PROMPT $P$G
if not exist toscd001 copy c:\windows\config.sys c:
if exist toscd001 c:\dos\mscdex /D:TOSCD001 /M:10
PATH=%PATH%; "C:\Program Files\Mts "
rem TShoot: SET PATH=

--------------------------------------------------

C:\CONFIG.SYS listing:

device=c:\dos\toscdrom.sys
device=c:\dos\himem.sys
DEVICE=c:\windows\Panning.SYS
REM Panda Antivirus 6.0 Platinum

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

@echo off
REM Notes:
REM DOSSTART.BAT is run whenenver you choose "Restart the computer
REM in MS-DOS mode" from the Shutdown menu in Windows. It allows
REM you to load programs that you might not want loaded in Windows,
REM (because they have functional equivalents) but that you do
REM want loaded under MS-DOS. The two primary candidates for
REM this are MSCDEX and a real mode driver for the mouse you ship
REM with your system. Commands that you want present in both Windows
REM and MS-DOS should be placed in the Autoexec.bat in the
REM \Image directory of your reference server. Please note that for
REM MSCDEX you will need to load the corresponding real-mode CD
REM driver in Config.sys. This driver won't be used by Windows 98
REM but will be available prior to and after Windows 98 exits.
REM
REM This file is also helpful if you want to F8 boot into MS-DOS 7.0
REM before Windows loads and access the CD-ROM. All you have to do
REM is press F8 and then run DOSSTART to load MSCDEX and your real
REM mode mouse driver (no need to remember the command line parameters
REM for these two files.
REM
REM - You MUST explicitly specify the CD ROM Drive Letter for MSCDEX.
REM - The string following the /D: statement must explicitly match
REM the string in CONFIG.SYS following your CD-ROM device driver.
REM MSCDEX.EXE /D:OEMCD001 /l:d
REM REM MOUSE.EXE
C:\WINDOWS\SYSTEM\mouse.com
C:\PROGRA~1\LOGITECH\MOUSEW~1\MOUSE.EXE

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\WINDOWS\SYSTEM\IETie.dll - {9527D42F-D666-11D3-B8DD-00600838CD5F}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
Scan for Viruses.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Run LiveUpdate (for Norton AntiVirus).job
Create New Job.job
Memory.job
Hard Drive C.job
All Lotus Notes.job
All E-mail.job
Whole System.job

--------------------------------------------------

Enumerating Download Program Files:

[{5F03EAB4-1AD5-11D4-AE99-0050DAC24E8F}]
CODEBASE = http://www.iwon.com/ct/in_wn/iwonslot1,0,1,5.cab

[OTXMovie Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\OTXMEDIA.DLL
CODEBASE = http://otx.ifilm.com/OTXMedia/OTXMedia.dll

[AxPulse Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AXPULSE.DLL
CODEBASE = http://www.pulse3d.com/players/english/PulsePlayerAxWin.cab

[iWon Progressive Counter]
InProcServer32 = C:\PROGRAM FILES\IWON\IWONSLOT\4.BIN\IWONSLOT.DLL
CODEBASE = http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab

[sys Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PCPITSTOP.DLL
CODEBASE = http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

[InetDownload Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\WMDOWNLOAD.DLL
CODEBASE = http://activex.microsoft.com/activex/controls/WindowsMedia/downloadcontrol.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\SWFLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1044/V31Controls/x86/w98/en/actsetup.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2002082001/housecall.antivirus.com/housecall/xscan53.cab

[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\ASINST.DLL
CODEBASE = http://www.pandasoftware.es/activescan/as/asinst.cab

--------------------------------------------------
End of report, 10,028 bytes
Report generated in 1.974 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Abraxas - The system file check showed the following files corrupted:

mssign32.dll
mssip32.dll
user.exe
setupx.dll
mscat32.dll
cryptui.dll
softpub.dll
cryptnet.dll
cryptext.dll
msoss.dll

Problem is that I don't have a disk with these files on it. Can I find them somewhere online?

I've used the IE repair tool a couple times a day for the last few days - no apparent improvement.

 

Any of those files that come from the Win98 setup should be on that disk, in a cabinet file. Not having 98 available, i can't check that for you.

You could try DLL World. You may have to use a little judgement in choosing versions there sometimes. You want the newest you can get, usually.

http://dll.yaroslavl.ru/

 

As I indicated above, SFC many times detects files as corrupted, when they are not. This is one of the examples.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q264865

Ignore the errors. If you plan to run SFC again/often, select Update Verification Information.

As for StartupList, I don't see anything obvious.

A couple of comments:
1. I would recommend that you run Norton AV in Autoprotect mode
2. The PATH statement is a little weird. It doesn't include Windows or Windows\Command. I don't see why this should cause a problem, but, can you edit the Autoexec.bat file and add a statement at the end

Path=C:\Windows;c:\windows\command;%Path%

If any app is attempting to use the PATH instead of the IO.sys parameters, it may get/cause errors. A "real" longshot.

You could also be experiencing hardware problems.
Restart to DOS and do a Scandisk Thorough

As well, download and run this Memory Diagnostic program.

http://www.simmtester.com/PAGE/products/doc/docinfo.asp

 

Well, I tried everything suggested, except the Memory Diagnostic (my machine wouldn't read the diskette, tried several different ones) so I finally did a clean install of IE6. Cross my fingers, hope this statement doesn't jinx it, but it's been 2 days with no Explorer crashes. Thanks for your help, everyone. I learned alot!