Kernel32 / Dr Watson / Explorer et al

[justjack]

Hi everyone!

I know the Kernel32.dll errors have been covered and recovered and then again, but since each case is different, I thought I'd share mine with the gang to gain some extra insight.

I have been getting Kernel32.dll errors caused by Explorer.exe in a constant and predictable way but cannot put my finger on what the problem could be.

When does it happen?? when certain specific CDs are in my CD-burner, and those CDs used to work fine (and they do work fine on my friend's computer!)

As soon as one of these CDs is in the drive, even if I don't try to directly access it, any operation that involves Explorer.exe causes it to crash (even pulling up the taskbar or clicking on the start button, or even right clicking an icon on the desktop)

As soon as I take the CD out of the drive, the errors immediatly stop occuring.

I thought it might have something to do with the autorun feature on the CDs but other CDs that are autorun work fine and it happends even with insert notification turned off.

I also thought DirectCD might be the problem since it constantly manages CDs in the background, so I turned it off in the System Config. Utility, rebooted and the problem is still there...

Here's the report generated by DrWatson:

Win32 Kernel core component encountered a debugging single-step exception.

Module Name: KERNEL32.DLL
Description: Win32 Kernel core component
Version: 4.90.3000
Product: Microsoft(R) Windows(R) Millennium Operating System
Manufacturer: Microsoft Corporation

Application Name: Explorer.exe
Description: Windows Explorer
Version: 5.50.4134.100
Product: Microsoft(R) Windows (R) 2000 Operating System
Manufacturer: Microsoft Corporation


Specs: 850Mhz AMD T-Bird / 384MB RAM running windows ME with all the updates.

Thanks

JustJack

[kaz101]

Morning JustJack :)

you mentioned
When does it happen?? when certain specific CDs are in my CD-burner, and those CDs used to work fine (and they do work fine on my friend's computer!)

what CD'S are they? can you recall why/how/when they stopped working?

[justjack]

Hi Kaz! how are you? :)

Well, the CDs that have stopped working, so far, are Microsoft Office and Adobe Photoshop.

As to what/when/why/how they stopped working??? Well, let me just tell you that by the time I figured out that the mere presence of either one of these CDs in the drive was causing my computer to go nuts, I had already crossed the line myself and ripped out what little hair is left off of my head!!

I checked the Faultlog on my computer and it is pages after pages after pages of Explorer causing a Kernel32.dll Error.

The one thing I remember doing right before this started happening is installing Clipart from an earlier version of Office than the one installed on my computer (BIG MISTAKE, I know!!! Microsoft isn't very keen on backtracking!) But I have since then done a complete uninstall of Office and reinstalled the current version minus the earlier clipart. But I had to install Office over my home network with the CD in another computer's CD Drive because it kept causing my computer to crash.

Thanks for the reply,

JustJack

[kaz101]

Hi, I'm fine thanks, sorry about the problems you're having but nice to see you on the board :)

did you put Office 97 over the top?

[justjack]

Hi!

Actually Kaz, Office97 is now a fancy looking coaster on my living room table!!! :)

No really, kidding aside, I have Office XP installed and the troubles started right after I tried installing only clipart from Office 2000.

I think that might have triggered the problem but I don't think the cause is Office itself because it's been completely uninstalled, then I ran Norton Utilities WinDoctor to clean up all references to it in the registry and then did a fresh install of Office XP.

Additionaly, many webpages that use Javascript do not display properly in IE 5.5 and sometimes JavaScript Popups don't work at all, but that's probably unrelated since my friend is having the very same problem on his 'puter.

Any additional info you think may be relevant, just tell me!

JustJack

[kaz101]

I have a few really fancy coasters too :D

I believe your on the right track... I'm hopping between Office and DirectCD as playing a part in this.

Here's my thoughts.... as you probably know autorun/play polls for newly inserted CD's every few seconds, when it detects one explorer.exe starts to look for the autorun.inf file and once found will start to launch the program... if it encounters a problem it'll crash. A few more seconds will roll by and it'll poll again... if it finds a problem it'll crash again... a never ending cycle until you remove the CD... from then on it'll poll away quite happily in the background till it detects another CD.... and one that it likes ;)

You mentioned that you disabled DirectCD by mscongfig... using TaskManger, removing from the startup folder or unchecking from msconfig doesn't 'disable' DirectCD, all this disables is the user interface... the DCD drivers are still running and as such so is DCD. To completely disable it needs to be uninstalled or removed from your registry. So what I suspect is that when disabled and autorun (using TweakUI?) and disabled notification (using Device Manager?) and still encountered the same problem it was because DCD was still running... hence the same autorun errors were occuring.

Now disabling/uninstalling DCD isn't going to fix the main problem (unless you feel it's caused it) as all it'll do is prevent Autorun from kicking in and generating the error.... food for thought :rolleyes:

If you can throw Office2000 in the drive and it'll poll happily then I suspect it's overwritten/corrupted a windows file... (could be a shared file?) installing Clipart could have replaced/overwritten a file that subsequently wasn't updated when you reinstalled XP... anyway have a look and see if the drive will accept older versions of Microsoft products.

I assume you've given your temp folders a really good clean out and run scandisc/defrag etc, autoupdate, repair on IE?


Office and IE problems do go hand in hand so we might not be able to throw office in the 'not this one' basket just yet. I know little about XP so will have to take your lead on this one :)

[justjack]

Food for thought..... thanks for all the insight Kaz! Will work some more on the situation and keep you updated shortly!!

JustJack

[justjack]

Hi Kaz!

Here's the news...

Thanks for that bit of info about DirectCD, I didn't know about that, but it has been unistalled right now for diagnosis purposes..

I did give my System a good cleanup/ScanDisk/Defrag, all the latest updates (relevant of course, I have not installed support for chinese traditional or Korean!!) but I'm a little fussy about what exactly you mean about IE repair.... what I did was go to windows update and redownload/reinstall IE 5.5 SR1 and tools and checked all the boxes, even those that WinUpdate said didn't need updating, just to make sure.

Now DirectCD is uninstalled, autoinsert notification off (device manager) and autorun disabled (tweakui) and I can put the CD in the drive and nothing happens.... of course!!!

What I expected from all that was that something in the autorun feature had gone haywire and didnt like certain autorun CDs... why some more that others?? who knows, but if I try to open or explore the office XP CD, I get the same explorer VS Kernel32.dll error, so autorun and direct CD seem to be off the hook, and yes, the computer does tolerate earlier versions of Office(2000) in the drive very well, I can even explore it.... I am starting to lean towards reinstalling WinME, which is not something I want to do, because of all the work and hassle of backing up my data and reinstalling all the software and recustomizing the whole system to my liking (very picky on that point!!)

If you have any other ideas, I'm very open to hearing about them since I'm running out of options!!!

JustJack

[justjack]

By the way, is there any way, in windows ME of checking the integrity of system files?????

Justjack

[kaz101]

Morning :)

I'm having one of 'those' days so I'll do this in bits...

re IE Repair Option...

Sorry I should have explained that better :(
what I meant was use the repair feature in
Control Panel
Add/Remove Programs
Select Microsoft Internet Explorer
Hit Add/Remove
Select the radio button beside Repair
Hit Ok


I'll be back soon :rolleyes:

[justjack]

Hi Kaz!

Hope your day is not quite as bad as it sounds!

Very interesting bit of info about IE repair, I didn't know it offered that possibility. Now if only WinME had the same feature... or does it? Are you gonna pull another rabbit out of your hat?? :) Anyway, I did the repair but it did not solve my CD problem, as far as javascript and java popup windows, I'll have to see in the future because that was an intermittent problem.

I am now close to reinstalling ME if I can't figure this out. But as I will be moving on monday, I want to wait until after the move before I do anything drastic!

JustJack

[ 27 April 2001: Message edited by: justjack ]

[kaz101]

Oh no don't do that just yet...I'm really sorry about the delays with getting back to you it's just that things are quite hectic at the moment...

as I said, I've got very little technical knowledge about 2000 and with XP I can find very little literature about it's system files etc etc but here's the jumbled thoughts that I'm tossing around in my head...


thought... by uninstalling DirectCD and turning off autorun you've managed to isolate the problem down and have identified that when autorun.inf is called on manually it causes a problem.. this elimates it being 'soley' an autorun file error or DirectCD problem.


thought... uninstalling office 2000 wouldn't have removed shared files or system files that it calls on... they would remain as last used

thought... I asked if the office2000 disc still reads happily because I suspected that the files it calls on to run are still configured for that version... not the xp version. if I remember correctly :rolleyes: you mentioned you installed it (xp) over the network... by doing this the installation files required (updates or new) wouldn't have been installed/updated on the comp your having trouble with...

jumbled thoughts....
mscdex.exe (MicroSoft Compact Disc EXtension is used by dos to give access to files not stored on h/drive) is it corrupt? overwritten? with/by previous verion compatible with office2000, installing CD's with autorun can overwrite new versions on comp with old versions required by the CD in drive. does DirectCD update/change mscdex.exe? does XP have/or modify the mscdex file?

perhaps there's an incorrect entry pointing to 'old' mscdex.exe version or perhaps multiple entries to mscdex.exe in autoexec.bat file

thought... compare versions of mscdex on 2000 and xp discs? check version of mscdex on windows starup disc (there is a copy of it put on your startup disc when you create it... this is winging it till I can look it up but I 'think' it's a got a july 2000 date or similar???) check the entries to mscdex in your autoexec.bat file?

I've got to go again but I'll try and get asap... see if you can make sense of what's above ... again, I am sorry for the delay

[justjack]

Kaz, you are truly a Godsend!!!!!

Your help and thoughts are very greatly appreciated!!!!!!

But please don't feel rushed and don't apologise for the time it takes to reply! I don't expect you to be at my service!

However, by Quebec, Canada standards, it is currently friday night, 23h00 and I am now quitting trying to figure this out and enjoying a few cold beers with my mate and catch up on packing for the move (for which I am absolutely horribly behind on!) Moving back into the big city of Montreal on Tuesday and really excited about it!!

I'll probably be checking in a few times over the weekend just because that's how I am (computer will be the last thing to get packed!!)

Have a great weekend and get some rest!!

JustJack

[kaz101]

thanks :)

it's Saturday here just before 4pm and the idea of a beer sounds rather appealing... ok that's a lie I'll swap that for a bourbon ;)

I'll just throw this up before it escapes me... system restore? did you try and use it to correct the problem when it happened? it should have rolled your system back to the state it was in before the installation of the clipart... and by doing so restored all the files that were altered/moved/referenced.

take care, have a safe trip and happy moving :D

[justjack]

Hi Kaz, just a quick note of what I've had time to try..

MSCDEX: the version on my computer is dated june 2000, sounds okay to me... didnt't find a copy on the XP CD...

System Restore: Tried last night to restore to the day before I did the unmentionable and it didnt work, system restore starts a progress bar and then freezes completely, I had to CAD (CtrlAltDel) it to restart it and I got a dialog saying that System Restore was unsuccessful :(

JustJack

P.S.: Hope the Bourbon hit the spot, the beer certainly did (although I am paying the price this morning!!!!)

[kaz101]

Morning :)

hope your move is going well

System Restore works at it's best asap after a problem first shows.. maybe next time ;)
I'll wait to hear back from you re the autoexecbat file but heres a thought... pull your sfplog.txt file and have a look at what happened on the date/s in question, it should list any system files that were replaced

the bourbon did the trick :D

[ 30 April 2001: Message edited by: kaz101 ]

[justjack]

Hello Kaz!!

Move went pretty much smoothly, lots of work of course but we're finally starting to get settled...

I had a look in the sfplog.txt, a file I had no idea existed on my computer!!!! and there is quite a bit of info in that file, namely a lot of system files replaced and restored and quite a few files are mentionned as having the correct version number but an incorrect "hash"... does that ring a bell? what is a file's "hash"??

Have a good day

JustJack

[kaz101]

so glad your move went well :) right on with the show... (sorry about the delay :( ) for me it's a matter of "aggghhh stop the world I want to get off!" but it's friday so in a couple more hours I can kick back with a medicinal bourbon :D

right... the sfplog is a little gem isn't it
:cool: now lets see if I can explain the 'hash' and what happens without confusing the heck out of you...


basically a 'hash' is microsofts stamp of approval on a file's butt..which in all honesty it really is, as it's tied in with a digital sig file.. it's just that at this particular moment I can't think of the correct wording ;)

Basically here's what happens and these are the files/prog involved
SFP System File Protection. A feature of ME that has 'done away with' SFC in W98
Sfpdb.sfp the database of all the system files that are protected.. theres around 8-900! For interests sake you can actually pull the file to have a look at it or you can pull filelist.xml which is identical... you'll me amazed :eek:
system.cat is the catalog that contains all the... lets say 'personal' information about the system files.. versions, dates and of course the correct 'hash' value (stamp of approval) for that particular file.
sfplog.txt this is the record of all the action going on

here's how it works.... you install a program that replaces a protected system file
sfp is automatically poked in the ribs because the file you've just replaced is listed in Sfpdb.sfp so it comes screaming along and takes a good hard look at the 'new' file, it then jots down all the relevant info (date, version, manufacturer and of course 'hash') then it screams along to the system.cat where it compares all the new file information against the information it has in the catalog. If this shows that the version is older or the hash doesn't match sfp screams fraud! and shoots back to replace the file.. in doing so it stores the fraud in C:\WINDOWS\SYSTEM\sfp\archive and then writes to the sfplog.txt telling you why... usually because it was either an old or incorrect version but occassionally you'll notice see the invalid hash value ones meaning that the version got the ok but because the hash/stamp didn't match what's in the cat file it wasn't permitted.

sfp automatically swaps these files round as it sees fit and without prompting but you can of course see what it's been up to by pulling the log file. The ones you have to watch out for are when it says it was 'unable to restore' as this means that somethings gone wrong and you may have to think about manually replacing the file.. which can be a bit of a drama as you have to sneak behind sfp to do it so that it doesn't automatically kick back in and replace it once your back is turned.


edited again... and again... and again.. arrgghhh!!! Mishy sack me quick b4 I use up all your bandwidth!

[ 03 May 2001: Message edited by: kaz101 ]

[justjack]

Hi Kaz!!

First of all, far from confusing me, I think you are a goldmine of information and patience and I wish a had 1-800-KAZ-HELP hotline whenever I need some info!!!!! :)

The move itself was okay, but I've had to switch ISPs twice and return to my old one finally, so all the e-mail address changes I'd made have to be undone!! ARGH!!!

Ok, I've carefully been through the SFPLOG and figured out the "errors" and "restore" messages and isolated the "CRITICAL" headings, the ones with "cannot restore" in them and they only affected one file and one font (which is odd, because I didnt know ME was so adamant about protecting Arial font!!)

The one real system file that was involved was INSENG.DLL, which I gather from the file's properties in an installation engine (attributed to windows 2000 in properties!?!)

A newer version had been copied to the system but SFP didnt like the version and tried to restore the old version but failed.... no detailed reason why it didnt like the newer version or why it failed restoring.

Another entry pertaining to the same file with the same newer version trying to be installed reported that SFP couldn't restore because the ORIGINAL file had an invalid hash!!

NOW!! Last night, after figuring this whole deal out, I went on another computer on my home network which is working well, and copied the older INSENG.DLL file from that computer which had the older version number that SFP seemed to love so much, I knew SFP would get a "poke in the ribs" and kick in but I wanted to know how it would react to that, well guess what, it refused the older version and restored the newer version saying THAT was the correct one...... NOW I'm confused and it's not your fault!!! :rolleyes:

I am now extrapolating into the unknown but correct me if I'm wrong, if INSENG.DLL, an installation engine, kicks in or is called upon when an installation is taking place (generally or only with particular software) and that there is a problem with it, the repercussions (all/some installations) are far more widespread than just one corrupt system file??

JustJack is getting closer and closer to reinstalling win ME... although I didnt want to do this at first, it seems it would be a lot less time consuming to reinstall ME and all my programs than to try to find where the misalignment is in my system,

Also, another thing I have found out recently which mught be at the root of the problem, I have tested my whole system with Norton Utilities 2001 and a brand new stick of memory I have installed before all these problems started arising seems to be defective, Norton finds a constant memory error in it, I will go and replace it and do the uninstall again, if me memory is unreliable, how can I expect the system be??

Your thoughts on that?? I will go and exchange the memory today and think some more about my course of action while waiting for your expert advice!!

Out of curiosity, DO you have a direct toll-free number to reach you?? it would make my life a lot easier!! :) just joking!!

JustJack

[ 04 May 2001: Message edited by: justjack ]

[kaz101]

Evening

glad the move was aok and I hope your now happily settled.. in your new abode and with ISP ;)

FYI...Arial is one of the 'core' fonts (and as such 'protected') which is why ME gets a bit twitchy when you try and replace it ;)

right... onto INSENG.DLL you may already know this but I'll burble in case you don't... inseng.dll is the Active Setup Install Engine, it lets allows cab files be opened and executed... you could say it 'controls' the installations. It's shipped with a few products like Windows and IE (including IE 5.5 service pack a long shot but it could be why you had trouble with IE)anyway... here's the versions, programs it shipped with and the dates that I could find that seem relevant to your situation and what you've mentioned...

5.50.4522.1800 IE 5.5 SP1 10/00
5.50.4134.100 Windows ME 6/00
5.0.3103.1000 Windows 2000 SP1 7/00
5.0.2920.0 Windows 2000 BETA 11/99
5.0.2919.3800 Windows 2000 BETA RC2 9/99


here's my thoughts... your comp is toying between the old and new so to speak, from what you've said it likes the 'old' Office CD but doesn't like the 'new'... I suspect that the ones it does like are referenced/compatible with, the current inseng.dll file you have... the ones it doesn't like may need/use/reference another version... not to be ruled out is that the system.cat file could be corrupt.. a symptom of this is also 'invalid hash' entries. For interests sake if you want to have a look at your system.cat file you can... it may bore you nutless but it might be worth it for interests sake.... it lists all (and I mean ALL so you'll be there for days)the files, versions etc for each file... don't go killing yourself over it cause you'd be hard pushed to "find" the problem but it'll give you some idea of what system.cat is and the information it compares. It has a userfriendly interface which is always nice and you'll find it C:\windows\system\catroot\{f....} near the top will be the hashmast.cbd which is what we were talking about the other day... say hello to it ;) and keep scrolling down to SYSTEM.CAT, double click it, hit the Security Catalog tab, highlight one of the Tags and have a look at the entry details.. it'll give you some idea of what it records about the files etc.

my humble opinion... it doesn't appear you have multiple errors but the ones you do have are causing some grief which is annoying and rightly so.... a few microsoft products do cause problems when you try and roll back or partly use functions from a previous version and that might just be what has happened here. You only have to look at the problems Office 97 users had when they tried to do similar things after upgrading :(

here's the and/or options as I see it...
replace your mem stick if it's causing problems.. better safe than sorry
replace inseng.dll from win_11.cab (remember it's a protected file so you'll have to go in the back door to do this)
replace your system.cat file with Catalog.cab from windows/options/install
install windows over the top of itself (you stand a 50/50 chance of it working)
or lastly and least pleasant is going back to scratch and starting again with a complete uninstall/reinstall.

re 1-800-KAZ-HELP :D I have 2 phonelines + 2 mobile phones and 3 pagers... perhaps I should trade them all in for the the 1-800 number ... might make life simpler :rolleyes:

[ 05 May 2001: Message edited by: kaz101 ]

[justjack]

Hi Kaz!!!

Okay, here's what I did:

1- Uninstalled IE 5.5SP1+Internet tools to revert to IE 5.5, that seemed to cure the javascript errors on my friend's computer.

Result: none whatsoever

2- Reinstalled Windows ME over itself, caused a few weird errors in the process (could not install from my Burner, had to install from my DVD ROM or else it couldn't find the CD and I had to keep a disk in drive A until the first restart (even after the install told me to take out the startup disk!!) or else I would get system errors, can not read from drive :)

Results: the CD problem is finally CURED!!!!!!!!!!!!!!!!!!!!! I can pop in the CDs that used to crash my system and it reads them no problem!!!! Whoo-hoo!!!!!!!!! But, still no JavaScript popups and most of the time, script errors galore while viewing web pages, for example, the instant Graemlins and instant UBB code boxes would always be blank or I'd only have one or two random Graemlins available...

Now, that was this morning, then I left for a few hours to drive my daughter back to her grandmother's. I came back, sat I my computer and BAM!!!! Javascript errors are cured!!!???????? everything seems normal and IE seems to have installed an update by itself because the update did not show up this morning in the "about IE" dialog box and it did tonight, the weird thing in all that is that I have WindowsUpdate setup to warn be before installing updates...?

I don't understand why all my problems cured themselves at once, but I'm counting my blessings and not asking too many questions...

I want to thank you again for all the help and patience you provided throughout this thing, but be warned, I will probably be calling on you again soon when something happens I can't figure out!!!

Have a great night,

JustJack

[kaz101]

Hi :)

really glad it worked out in the end... may you have many more happy computing days ahead of you :D

use Office2000 as a coaster ;)