Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

EXPLORER caused an invalid page fault


  • This topic is locked This topic is locked

#1
anthonyHSV

anthonyHSV

    Member

  • Member
  • PipPip
  • 30 posts
Ask to look at a users home PC. Its Win98 upon startup after the desktop icons and startbar appears a error message pops up stating Explorer will crash. Click close and explorer will crash and then load then loop round to the error message again.

The details of the error is EXPLORER caused and invalid page fault in module OLE32.DLL at 0167:7ff2Ia32.

Same occurs in safe mode.

Plugged the PC's HDD into another PC as a slave and removed about 25 different types of Trojan's using E-trust antivirus from the drive yet still no luck.

Can someone please help me out here
  • 0

Advertisements


#2
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
Boot the PC to command prompt only, type scanreg.exe /fix then press enter, if it runs and says repaired see if you can get to system tools, system information, tools, system file checker to scan and replace missing files from Windows CD

Malware will get in the way of any fixes so try to get Hijack This on there
  • 0

#3
anthonyHSV

anthonyHSV

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Hi Keith,

The scanreg hangs on checking the system.dat file. I loaded Hijack this onto the desktop via Dos to attempt to click and run it before I get the error message. However I'm not getting anywhere
  • 0

#4
Samm

Samm

    Trusted Tech

  • Member
  • PipPipPipPipPipPip
  • 3,476 posts
Try this :
boot from win98 startup floppy disk (it must load cd rom drivers & have extract.exe on it)
Insert the win98 CD
at the dos prompt, change to the win98 folder on the CD (eg D:\win98)
type :
extract /a /y /e /l c:\windows\system win98_36.cab ole32.dll <enter>
extract /a /y /e /l c:\windows base4.cab explorer.exe <enter>

Reboot the system in safe mode & see if you can now run hijack this
  • 0

#5
anthonyHSV

anthonyHSV

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
Hi guys did as you say and no luck..

How close am I to Format C:\ :tazz: ???

Edited by anthonyHSV, 27 July 2005 - 07:08 PM.

  • 0

#6
Samm

Samm

    Trusted Tech

  • Member
  • PipPipPipPipPipPip
  • 3,476 posts

Hi guys did as you say and no luck..

How close am I to Format C:\  :tazz: ???

View Post


Not far off!
Theres a few more avenues to explorer first though :
Try booting to command prompt again
Change to c:\windows\command
then type scanreg /restore

This will let you select a registry backup to restore. Obviously you want to choose the restore dated just before the problem occured
  • 0

#7
anthonyHSV

anthonyHSV

    Member

  • Topic Starter
  • Member
  • PipPip
  • 30 posts
scanreg /restore failed

However since then I'm now back into the PC I have A hijackthis log..

Logfile of HijackThis v1.99.0
Scan saved at 11:03:18 AM, on 7/29/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\WINDOWS\ALL USERS\DESKTOP\HIJACK~1.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE
C:\PROGRAM FILES\SECOND COPY 97\SC97.EXE
C:\PROGRAM FILES\PLAXO\2.3.6.2\INSTALLSTUB.EXE
C:\WINDOWS\ALL USERS\START MENU\PROGRAMS\STARTUP\HIJACK~1.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.telpacific.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://4-counter.com/?a=2&b=cris
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://4-counter.com/?a=2&b=cris
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by TEL.PACIFIC Pty Ltd
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\PROGRAM FILES\MYWAY\SRCHASTT\1.BIN\MYSRCHAS.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: (no name) - {0E1230F8-EA50-42A9-983C-D22ABC2EEB4C} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
  • 0

#8
Samm

Samm

    Trusted Tech

  • Member
  • PipPipPipPipPipPip
  • 3,476 posts
OH DEAR! :tazz:

Get yourself along to the malware forum & post the HJT log in there
  • 0

#9
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Hello. It is obvious you are using this site to fix computers you are getting PAID to fix. That is a giant no no here. :tazz: The people who are Staff members here donate their time and expertise to help people fix their pc's. We do not appreciate helping you for FREE so you can get paid. :)
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP