Illegal Operation Problem

[AliciaJ]

HI :wave: ,
I am new to this forum. Can anyone please help me with the error message I keep receiving:?

KERNEL32 caused a stack fault in module KERNEL32.DLL at 0137:bff725c5.
Registers:
EAX=002a0037 CS=0137 EIP=bff725c5 EFLGS=00000206
EBX=00000000 SS=013f ESP=0096fef0 EBP=0096ff04
ECX=00000002 DS=013f ESI=0096ff14 FS=12ff
EDX=816d88b4 ES=013f EDI=816d88b4 GS=0000
Bytes at CS:EIP:
6a ff e8 d0 85 01 00 eb e7 55 8b ec 56 57 53 8b
Stack dump:
00000000 816d88c4 0096ff14 00000000 00000000 0096ff5c bff7294f 816d88b4 0096ff14 01178076 016f0028 00000000 00000000 00000000 00000000 00000000

Thanks!:blush:

[AnnMarie]

Welcome to CTH AliciaJ. Does Windows 95 load to a Desktop? If so, lets see what is running on your PC. Go here (http://www.cybertechhelp.com/download/section/adware-spyware-removal) and download the latest version of Hijack This. Unzip it and click on scan. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

If you get an error message that Msvbvm60.dll is missing

Download and install VBRun60sp6.exe from here (http://www.microsoft.com/downloads/details.aspx?familyid=7b9ba261-7a9c-43e7-9117-f673077ffb3c&displaylang=en). Reboot and run Hijack This again.

[AliciaJ]

Hello AnnMarie,
I followed your instructions and here are the results:

Logfile of HijackThis v1.99.1
Scan saved at 12:00:34 PM, on 9/22/05
Platform: Windows 95 a (Win9x 4.00.1111)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\OPLIMIT\OCRAWARE.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\OPLIMIT\OCRAWR32.EXE
C:\PROGRAM FILES\CYBERMEDIA UNINSTALLER\IMONITOR.EXE
C:\WINDOWS\SYSTEM\LOADWC.EXE
C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\HPZTSB04.EXE
C:\WINDOWS\RunDLL.EXE
C:\COREL\OFFICE7\DAD7\QUICK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\hpmdlbia.exe
C:\COREL\OFFICE7\SHARED\PFIT7\PFPPOP70.EXE
C:\WINDOWS\HPONLREG\REMIND32.EXE
C:\SRS\TASKTRAY.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\tapiexe.exe
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NETZERO\EXEC.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.worldnet.att.net/ie4/search/index.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.att.net (http://www.att.net/)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T WorldNet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = ;enroll.prodigy.net:80,www.prodigy.net:80;<local>
F1 - win.ini: load=C:\OPLIMIT\OCRAWARE.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] C:\COREL\OFFICE7\SHARED\QFINDER7\QFSCHED.EXE
O4 - HKLM\..\Run: [InstallationMonitor] "C:\Program Files\CyberMedia UnInstaller\imonitor.exe" /MM
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
O4 - HKLM\..\Run: [MHInit] C:\Program Files\CyberMedia UnInstaller\mhinit.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb04.exe
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [NetZero_uoltray] C:\PROGRAM FILES\NETZERO\EXEC.EXE regrun
O4 - Startup: Corel Desktop Application Director.LNK = C:\Corel\Office7\Dad7\QUICK.EXE
O4 - Startup: HP 1170 FPB.lnk = C:\WINDOWS\SYSTEM\hpmdlbia.exe
O4 - Startup: PerfectPrint.LNK = C:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - Startup: Reminder-hpc41201.lnk = C:\WINDOWS\HPOnLReg\Remind32.exe
O4 - Startup: SRS Tasktray.lnk = C:\SRS\TASKTRAY.EXE
O4 - Startup: Syncro Connect - Home.lnk = C:\Program Files\Syncro Connect - Home\mccon.exe
O4 - Startup: Web Reminder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Pro 1170C Series\reminder.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - User Startup: Corel Desktop Application Director.LNK = C:\Corel\Office7\Dad7\QUICK.EXE
O4 - User Startup: HP 1170 FPB.lnk = C:\WINDOWS\SYSTEM\hpmdlbia.exe
O4 - User Startup: PerfectPrint.LNK = C:\Corel\Office7\Shared\PFit7\PFPPOP70.EXE
O4 - User Startup: Reminder-hpc41201.lnk = C:\WINDOWS\HPOnLReg\Remind32.exe
O4 - User Startup: SRS Tasktray.lnk = C:\SRS\TASKTRAY.EXE
O4 - User Startup: Syncro Connect - Home.lnk = C:\Program Files\Syncro Connect - Home\mccon.exe
O4 - User Startup: Web Reminder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Pro 1170C Series\reminder.exe
O4 - User Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O13 - WWW. Prefix: http://
O14 - IERESET.INF: START_PAGE_URL=http://www.att.net
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

Thanks for your time :blush: !

[AnnMarie]

Hi Alicia, I cannot see any obvious problems in your log. Did the error message coincide with the installation of any new software or hardware? I see that you have AVG7 installed. I know that it is supposed to be compatible with Win95/98 however I have seen it cause problems on some Win98 installations.

[jtdoom]

Hi

getting rid of this won't hurt

C:\WINDOWS\HPONLREG\REMIND32.EXE

O4 - Startup: Web Reminder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Pro 1170C Series\reminder.exe

O4 - Startup: Web Reminder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Pro 1170C Series\reminder.exe

O4 - User Startup: Reminder-hpc41201.lnk = C:\WINDOWS\HPOnLReg\Remind32.exe

O4 - User Startup: Web Reminder.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet Pro 1170C Series\reminder.exe

[AliciaJ]

Well I believe it started when I downloaded a program to clean my registry. I removed it, but I am still receiving the error messages. It seems to start whenever I get on the internet. I will try the advice from jtdoom as well. Thanks for your assistance from both, it is greatly appreciated!

[AnnMarie]

Hi Alicia, a couple of things to try. Firstly, close Internet Explorer and any open windows and run Hijack This again. Check the below entries and click on Fix Checked and reboot afterwards.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.worldnet.att.net/ie4/search/index.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O13 - WWW. Prefix: http://

Next, go here (http://home.ptd.net/~don5408/toolbox/startupcpl/) and download and install Mike Lin's StartUp Control Panel. You can use it to disable startup's to see if perhaps you might have a software conflict. Initially, disable all startups except Explorer (although I dont think you will see Explorer) and Systray and reboot. If the problem does not occur, add back one startup and reboot again until you find which is causing the problem.

You will find information here (http://computercops.biz/StartupList.html) regarding which startups are required and which can be safely disabled permanently (Status N = not required, Y = required, X = malware).