Forum - DLL-files.com

legg wrote:
> On Sun, 12 Jul 2009 19:36:43 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>
>>legg wrote:
> <snip>
>>> The kernel32.dll change, completed first, was immediately
>>> demonstrated to have no effect - a non-fatal error repeated almost
>>> immediately on first reboot. I'm still waiting for a re-occurance
>>> of the non-fatal error after reverting to old shell32.dll. (6hrs ~
>>> fairly impressed, but not yet considered conclusive).
>>
>>This is good news.
>>
>>> I think I saw a file search window
>>> closed unexpectedly, since, but there was no error log and it could
>>> have been simple user input sloppiness on my part.
>>
>>Could be you inadvertently hit a keybord shortcut to close it.
>>
> <snip>
> I've examined the search window behaviour more closely, both in normal
> and safe mode.
>
> It looks like there is still irregular behavior. In normal mode it now
> just does not produce an error log.

I've followed the procedure that follows in Normal Mode & did not get a
crash.

> from my notes:
> ......................
> In safe mode
> from start menu
> find files and folders
> file name kernel32.dll
> found in C:\Windows\System

That's where it should be.

> copied to C:\Windows\System\backup.

Normally, I'd say not to fool with C:\Windows\System to create your own
folder there. System is a special folder best left to Windows alone I
think. However, I created the Backup folder there, & left Explorer open
to it. From a Find box, & copied kernel32.dll into it (R-Clk, Copy,
R-Clk, Paste). No crash occurred after closing the destination & Find
windows. I repeated it, this time with a Drag/Drop into a little
"Backup" window opened from a Find box (File menu, Open Containing
Folder). Still no crash occurred after closing the windows in the order
you did.

> close destination directory window
> close 'find files'
> explorer crashes.
> drwatson report:
>
> Win32 Kernel core component attempted to access memory that does not
> exist.
>
> Module Name: kernel32.dll
> Description: Win32 Kernel core component
> Version: 4.10.2222
> Product: Microsoft(R) Windows(R) Operating System
> Manufacturer: Microsoft Corporation
>
> Application Name: Explorer.exe
> Description: Windows Explorer
> Version: 4.72.3110.1
> Product: Microsoft(R) Windows NT(R) Operating System
> Manufacturer: Microsoft Corporation

You were running my versions of both those files now. What version of
Shell32.exe did you revert to? Mine is 4.72.3812.600. However, I guess
that's in the clear since DrWatson hasn't mentioned it.

And surely msfn.org's Kernel32.exe & Shell32.exe files are both in the
clear for this particular crash. I guess -- as well -- any Registry
changes or other files from that site were also undone when you used
their uninstall routines. I'm thinking something else must be to blame.

> the explorer error window will not close.
>
> cntrl-alt-del shows programs running:
> Notepad
> Taskinfo

I suppose you mean MSInfo32.

> diagnose (open folder)

I suppose that one is DrWatson's Diagnosis tab. But it shows up for me
as "(untitled) - Dr. Watson)".

> Explorer.exe

What is that? It shows up for me in Msinfo32 like that, but not in the
Ctrl-Alt-Del "Close Program" window. But in MSInfo32 the following will
not show.

> Explorer

Only that shows up in my Close Program window. An open Explorer window
would show up: "Exploring -- folder name".

> Taskinfo shows:

I suppose you mean MSInfo32, Software Information, Running Tasks.

> DrWatson.exe
> Explorer.exe
> Taskinfo.exe
> msgsrv32.exe
> notepad.exe (this program)
> kernel32.dll
> mprexe.exe
> vxd ntkern

All of those seem normal, except you are writing Taskinfo for MSInfo32.
I'm not seeing vxd or ntkern-- but I guess they show up in Safe Mode
only. (I do see ntkern & vxdldr in DrWatson's Kernel Drivers tab,
though.)

> When this is done in normal mode
> closing the destination directory window causes
> explorer.exe to restart - closes 'find files' window
> and any other folder windows that may be open, without
> generating a drwatson log

Yep. That describes what a crash of Explorer might look like in Normal
Mode. It is the same as what happens when one closes Explorer using the
Ctrl-Alt-Del "Close Program" requestor. Also, many of the icons in the
Tray (that holds the clock) may disappear until a reboot is done.

> ..................................end
>>As they have separate uninstall routines, I guess they are separate
>>enough to keep one & loose the other. Sounds like it's Shell32.dll
>>that's the actual culprit, but you have a good plan. Keep us informed.
>>My own SHELL32.DLL is...
>>
>>SHELL32.DLL
>>Desc: Windows Shell Common Dll
>>Loc: C:\WINDOWS\SYSTEM
>>Size: 1,388,816 bytes
>>Mod: Thursday, December 06, 2001 11:25:08 PM
>>Ver: 4.72.3812.600
>>
>>That appears to be updated from the original...
>>
>>Cabinet WIN98_41.CAB
>>04-23-1999 10:22:00p A--- 1,400,832 shell32.dll
>>
>>I'm not sure what updated that file for me. I'm not finding it in my
>>IE6 .cabs. Good thing that site allowed you to back it up!
>>
> <snip>
>>It could be something about that crash upset the new SHELL32.DLL.
>>Maybe the Registry got mussed in some interfering way or something. I
>>see MEB has reminded me of the history of this problem-- but I can't
>>really recall all of that gargantuan thread! What was that site
>>again that provided those .dlls? I would want to keep the one that
>>does the most work, if possible. There may be some talk of it over
>>there.
>
> From my records, the software was accessed through:
>
>
http://www.msfn.org/board/index.php?s=& ... t&p=572137

All right. I was going to go & look around there for a clue. But this
looks now to have nothing to do with their versions of Kernel32.exe &
Shell32.exe nor anything to do with those two packages.

Look through these...

http://aumha.org/win5/a/kernel32.htm
Eshelman's page about Kernel32 errors

YOW-- that one is scary! But maybe try the stuff way at the bottom. I've
actually got most of that in my Config.sys & System.ini, myself. I've
got...

Config.sys
-------------
FILESHIGH=80
BUFFERSHIGH=40,4

System.ini
-------------
[386Enh]
MinSPs=4

http://support.microsoft.com/search/def ... m=1&res=20
251 articles mention Kernel32 at the MSKB. I haven't got more time
tonight, but I'll click through a bunch myself tomorrow.

http://www.colba.net/~hlebo49/errkrn32.htm
Many are here too. I'm glad to see Leboeuf's site is still there. I hope
I'm still spelling his name right-- & I wonder whether he's left me some
of those vowels in his will! Nothing has come in the mail yet!

> RL

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net

MEB wrote:
> You continue resist sound basis and explanation. As that is the
> case, I bow out of further discussions with you related to these and
> any further issues you may have.
>
> Good luck...

I guess we can make our own gargantuan thread without you!


....snip
--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net

PCR wrote:

Where I said Kernel32.exe & Shell32.exe-- of course I meant to say .dll.

> legg wrote:
>> On Sun, 12 Jul 2009 19:36:43 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>>
>>>legg wrote:
>> <snip>
>>>> The kernel32.dll change, completed first, was immediately
>>>> demonstrated to have no effect - a non-fatal error repeated almost
>>>> immediately on first reboot. I'm still waiting for a re-occurance
>>>> of the non-fatal error after reverting to old shell32.dll. (6hrs ~
>>>> fairly impressed, but not yet considered conclusive).
>>>
>>>This is good news.
>>>
>>>> I think I saw a file search window
>>>> closed unexpectedly, since, but there was no error log and it could
>>>> have been simple user input sloppiness on my part.
>>>
>>>Could be you inadvertently hit a keybord shortcut to close it.
>>>
>> <snip>
>> I've examined the search window behaviour more closely, both in
>> normal and safe mode.
>>
>> It looks like there is still irregular behavior. In normal mode it
>> now just does not produce an error log.
>
> I've followed the procedure that follows in Normal Mode & did not get
> a crash.
>
>> from my notes:
>> ......................
>> In safe mode
>> from start menu
>> find files and folders
>> file name kernel32.dll
>> found in C:\Windows\System
>
> That's where it should be.
>
>> copied to C:\Windows\System\backup.
>
> Normally, I'd say not to fool with C:\Windows\System to create your
> own folder there. System is a special folder best left to Windows
> alone I think. However, I created the Backup folder there, & left
> Explorer open to it. From a Find box, & copied kernel32.dll into it
> (R-Clk, Copy, R-Clk, Paste). No crash occurred after closing the
> destination & Find windows. I repeated it, this time with a Drag/Drop
> into a little "Backup" window opened from a Find box (File menu, Open
> Containing Folder). Still no crash occurred after closing the windows
> in the order you did.
>
>> close destination directory window
>> close 'find files'
>> explorer crashes.
>> drwatson report:
>>
>> Win32 Kernel core component attempted to access memory that does not
>> exist.
>>
>> Module Name: kernel32.dll
>> Description: Win32 Kernel core component
>> Version: 4.10.2222
>> Product: Microsoft(R) Windows(R) Operating System
>> Manufacturer: Microsoft Corporation
>>
>> Application Name: Explorer.exe
>> Description: Windows Explorer
>> Version: 4.72.3110.1
>> Product: Microsoft(R) Windows NT(R) Operating System
>> Manufacturer: Microsoft Corporation
>
> You were running my versions of both those files now. What version of
> Shell32.exe did you revert to? Mine is 4.72.3812.600. However, I guess
> that's in the clear since DrWatson hasn't mentioned it.
>
> And surely msfn.org's Kernel32.exe & Shell32.exe files are both in the
> clear for this particular crash. I guess -- as well -- any Registry
> changes or other files from that site were also undone when you used
> their uninstall routines. I'm thinking something else must be to
> blame.
>
>> the explorer error window will not close.
>>
>> cntrl-alt-del shows programs running:
>> Notepad
>> Taskinfo
>
> I suppose you mean MSInfo32.
>
>> diagnose (open folder)
>
> I suppose that one is DrWatson's Diagnosis tab. But it shows up for me
> as "(untitled) - Dr. Watson)".
>
>> Explorer.exe
>
> What is that? It shows up for me in Msinfo32 like that, but not in the
> Ctrl-Alt-Del "Close Program" window. But in MSInfo32 the following
> will not show.
>
>> Explorer
>
> Only that shows up in my Close Program window. An open Explorer window
> would show up: "Exploring -- folder name".
>
>> Taskinfo shows:
>
> I suppose you mean MSInfo32, Software Information, Running Tasks.
>
>> DrWatson.exe
>> Explorer.exe
>> Taskinfo.exe
>> msgsrv32.exe
>> notepad.exe (this program)
>> kernel32.dll
>> mprexe.exe
>> vxd ntkern
>
> All of those seem normal, except you are writing Taskinfo for
> MSInfo32. I'm not seeing vxd or ntkern-- but I guess they show up in
> Safe Mode only. (I do see ntkern & vxdldr in DrWatson's Kernel
> Drivers tab, though.)
>
>> When this is done in normal mode
>> closing the destination directory window causes
>> explorer.exe to restart - closes 'find files' window
>> and any other folder windows that may be open, without
>> generating a drwatson log
>
> Yep. That describes what a crash of Explorer might look like in Normal
> Mode. It is the same as what happens when one closes Explorer using
> the Ctrl-Alt-Del "Close Program" requestor. Also, many of the icons
> in the Tray (that holds the clock) may disappear until a reboot is
> done.
>
>> ..................................end
>>>As they have separate uninstall routines, I guess they are separate
>>>enough to keep one & loose the other. Sounds like it's Shell32.dll
>>>that's the actual culprit, but you have a good plan. Keep us
>>>informed. My own SHELL32.DLL is...
>>>
>>>SHELL32.DLL
>>>Desc: Windows Shell Common Dll
>>>Loc: C:\WINDOWS\SYSTEM
>>>Size: 1,388,816 bytes
>>>Mod: Thursday, December 06, 2001 11:25:08 PM
>>>Ver: 4.72.3812.600
>>>
>>>That appears to be updated from the original...
>>>
>>>Cabinet WIN98_41.CAB
>>>04-23-1999 10:22:00p A--- 1,400,832 shell32.dll
>>>
>>>I'm not sure what updated that file for me. I'm not finding it in my
>>>IE6 .cabs. Good thing that site allowed you to back it up!
>>>
>> <snip>
>>>It could be something about that crash upset the new SHELL32.DLL.
>>>Maybe the Registry got mussed in some interfering way or something. I
>>>see MEB has reminded me of the history of this problem-- but I can't
>>>really recall all of that gargantuan thread! What was that site
>>>again that provided those .dlls? I would want to keep the one that
>>>does the most work, if possible. There may be some talk of it over
>>>there.
>>
>> From my records, the software was accessed through:
>>
>>
>
http://www.msfn.org/board/index.php?s=& ... t&p=572137
>
> All right. I was going to go & look around there for a clue. But this
> looks now to have nothing to do with their versions of Kernel32.exe &
> Shell32.exe nor anything to do with those two packages.
>
> Look through these...
>
> http://aumha.org/win5/a/kernel32.htm
> Eshelman's page about Kernel32 errors
>
> YOW-- that one is scary! But maybe try the stuff way at the bottom.
> I've actually got most of that in my Config.sys & System.ini, myself.
> I've got...
>
> Config.sys
> -------------
> FILESHIGH=80
> BUFFERSHIGH=40,4
>
> System.ini
> -------------
> [386Enh]
> MinSPs=4
>
>
http://support.microsoft.com/search/def ... m=1&res=20
> 251 articles mention Kernel32 at the MSKB. I haven't got more time
> tonight, but I'll click through a bunch myself tomorrow.
>
> http://www.colba.net/~hlebo49/errkrn32.htm
> Many are here too. I'm glad to see Leboeuf's site is still there. I
> hope I'm still spelling his name right-- & I wonder whether he's left
> me some of those vowels in his will! Nothing has come in the mail yet!
>
>> RL

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net

On Mon, 13 Jul 2009 21:44:40 -0400, "PCR" <pcrrcp@netzero.net> wrote:

>You were running my versions of both those files now. What version of
>Shell32.exe did you revert to? Mine is 4.72.3812.600. However, I guess
>that's in the clear since DrWatson hasn't mentioned it.

shell32.dll - v 4.72.3812.620

Watson's not big on 'why's or 'wherefore's. About the only suggestion
I've seen or heard of it making is to close tasks that are in the
taskbar.

>> Taskinfo

>I suppose you mean MSInfo32.

Task info is a commercial program similar to msinfo.

>> diagnose (open folder)

>I suppose that one is DrWatson's Diagnosis tab. But it shows up for me
>as "(untitled) - Dr. Watson)".
Just an open folder on C:\

>> Explorer.exe

>What is that? It shows up for me in Msinfo32 like that, but not in the
>Ctrl-Alt-Del "Close Program" window. But in MSInfo32 the following will
>not show.

>> Explorer

>Only that shows up in my Close Program window. An open Explorer window
>would show up: "Exploring -- folder name".

The Explorer.exe and Explorer entries seemed curious to me, bit one of
them had to indicate the error window that would not close. It's
probably the entry that you don't see in your ctrl-alt-del window.

>http://aumha.org/win5/a/kernel32.htm
>Eshelman's page about Kernel32 errors
>
>YOW-- that one is scary! But maybe try the stuff way at the bottom. I've
>actually got most of that in my Config.sys & System.ini, myself. I've
>got...
>
>Config.sys
>-------------
>FILESHIGH=80
>BUFFERSHIGH=40,4
>
>System.ini
>-------------
>[386Enh]
>MinSPs=4
>

I've tried:

Config.sys
-------------
Files=65
Buffers=40
stacks=64,512

with the added line to 386Enh of System.ini as alterations, without
noticeable changes to behavior. The same errors are recorded.

Previous versions of both files now restored. Don't know the
signifigance of 'buffers' vs 'buffershigh' - but suspect that only the
first few letters before the equals sign have relevance.

There doesn't seem to be much (googled) useful info on the nature of
the actual drwatson error messages as symptoms, or related pointers on
what to look for that may be causing them.

I'll keep the pot on low for a while, while reviewing the web links.

RL

legg wrote:
> On Mon, 13 Jul 2009 21:44:40 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>
>>You were running my versions of both those files now. What version of
>>Shell32.exe did you revert to? Mine is 4.72.3812.600. However, I guess
>>that's in the clear since DrWatson hasn't mentioned it.
>
> shell32.dll - v 4.72.3812.620
>
> Watson's not big on 'why's or 'wherefore's. About the only suggestion
> I've seen or heard of it making is to close tasks that are in the
> taskbar.

That's true. It's good for a clue to what programs/.dll's are involved &
their version numbers. But yours now match mine & only you get the
error. Something else must be involved to cause the error-- to cause two
good files to suddenly not like each other. But what could be doing that
even in Safe Mode where the Startup Group doesn't start? Dr.Watson's
Task tab probably showed exactly what your MSInfo32 & TaskInfo showed.
The other tabs are really difficult to look at.

Dr.Watson said: "Win32 Kernel core component attempted to access memory
that does not exist." You get the symptoms of a shut down of the
Explorer shell. It's possible something is shutting down the shell at an
inopportune time or in an improper manner (other than using the Close
Program requestor) that causes Kernel32 to loose track of memory. I'm
still trying to think what that could be.

>>> Taskinfo
>
>>I suppose you mean MSInfo32.
>
> Task info is a commercial program similar to msinfo.

OK.

>>> diagnose (open folder)
>
>>I suppose that one is DrWatson's Diagnosis tab. But it shows up for me
>>as "(untitled) - Dr. Watson)".
> Just an open folder on C:\

OK. That's right, that's what an open folder would look like.

>>> Explorer.exe
>
>>What is that? It shows up for me in Msinfo32 like that, but not in the
>>Ctrl-Alt-Del "Close Program" window. But in MSInfo32 the following
>>will not show.
>
>>> Explorer
>
>>Only that shows up in my Close Program window. An open Explorer window
>>would show up: "Exploring -- folder name".
>
> The Explorer.exe and Explorer entries seemed curious to me, bit one of
> them had to indicate the error window that would not close. It's
> probably the entry that you don't see in your ctrl-alt-del window.

The entry that says "Explorer" is the shell. What shows up for you at
"START, Run, SysEdit" in the [boot] section of System.ini...?...

System.ini
[boot]
shell=Explorer.exe

That must also run in Safe Mode. Ensure there is nothing else on the
shell line way off & invisible to the right. Anything else on that line
could be a virus. Also ensure you have only one file named Explorer.exe
& that it is located in C:\Windows. If another one exists in the root
C:\, it could be a virus & could take precedence.

>>http://aumha.org/win5/a/kernel32.htm
>>Eshelman's page about Kernel32 errors
>>
>>YOW-- that one is scary! But maybe try the stuff way at the bottom.
>>I've actually got most of that in my Config.sys & System.ini, myself.
>>I've got...
>>
>>Config.sys
>>-------------
>>FILESHIGH=80
>>BUFFERSHIGH=40,4
>>
>>System.ini
>>-------------
>>[386Enh]
>>MinSPs=4
>>
>
> I've tried:
>
> Config.sys
> -------------
> Files=65
> Buffers=40
> stacks=64,512
>
> with the added line to 386Enh of System.ini as alterations, without
> noticeable changes to behavior. The same errors are recorded.

All right. Too bad that wasn't it. Here's another fairly easy one to
try...
http://support.microsoft.com/default.as ... roduct=w98
Error Message: TASKMON Caused an Invalid Page Fault in Module...
EXPLORER caused an invalid page fault in module KERNEL32.DLL.

It says to rename the Applog folder & reboot. I think it's possible the
Applog folder functions in Safe Mode.

> Previous versions of both files now restored. Don't know the
> signifigance of 'buffers' vs 'buffershigh' - but suspect that only the
> first few letters before the equals sign have relevance.

I've been guessing high refers to RAM over 1MB. But you've done enough
with that-- that wasn't it.

> There doesn't seem to be much (googled) useful info on the nature of
> the actual drwatson error messages as symptoms, or related pointers on
> what to look for that may be causing them.
>
> I'll keep the pot on low for a while, while reviewing the web links.

Yep. Go through those URLs. I've been looking for one to mention both
Explorer & Kernel32 & memory. But try all easy fixes, even if the
symptoms aren't precisely yours.

> RL

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net

>On Tue, 14 Jul 2009 21:09:34 -0400, "PCR" <pcrrcp@netzero.net> wrote:


>The entry that says "Explorer" is the shell. What shows up for you at
>"START, Run, SysEdit" in the [boot] section of System.ini...?...
>
>System.ini
>[boot]
>shell=Explorer.exe
>
>That must also run in Safe Mode. Ensure there is nothing else on the
>shell line way off & invisible to the right. Anything else on that line
>could be a virus. Also ensure you have only one file named Explorer.exe
>& that it is located in C:\Windows. If another one exists in the root
>C:\, it could be a virus & could take precedence.

The System.ini line is clean. The Explorer executable is in the right
directory. v4.72.3110.1.


>Here's another fairly easy one to try...
>http://support.microsoft.com/default.as ... roduct=w98
>Error Message: TASKMON Caused an Invalid Page Fault in Module...
>EXPLORER caused an invalid page fault in module kernel32.dll.
>
>It says to rename the Applog folder & reboot. I think it's possible the
>Applog folder functions in Safe Mode.
>
The Applog folder is empty on this machine. Renaming it and rebooting
had no effect on the explorer.exe behavior.

That's all for now.

RL

legg wrote:
>>On Tue, 14 Jul 2009 21:09:34 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>
>
>>The entry that says "Explorer" is the shell. What shows up for you at
>>"START, Run, SysEdit" in the [boot] section of System.ini...?...
>>
>>System.ini
>>[boot]
>>shell=Explorer.exe
>>
>>That must also run in Safe Mode. Ensure there is nothing else on the
>>shell line way off & invisible to the right. Anything else on that
>>line could be a virus. Also ensure you have only one file named
>>Explorer.exe & that it is located in C:\Windows. If another one
>>exists in the root C:\, it could be a virus & could take precedence.
>
> The System.ini line is clean. The Explorer executable is in the right
> directory. v4.72.3110.1.

All right. Those are in the clear. I'm still mulling over what you saw
in Safe Mode in the Ctrl-Alt-Del Close Program requestor...

Notepad
Taskinfo
diagnose (open folder)
Explorer.exe
Explorer

This was after the DrWatson crash, & you believe the "Explorer.exe" item
is an Explorer window that won't close. But I'm wondering how an open
Explorer window would look like that in the first place. The shell is
the "Explorer" line: close that one & the shell restarts (which
approximates the symtoms you've reported). An open instance of Explorer
shows up as "Exploring - (drive/folder name)". Explorer opened to a
folder (such as using the Find box's "File menu, Open Containing
Folder") will show up as the folder name. I know a folder can be named
"Explorer.exe", but I don't think that's whats going on. So, I'm still
mulling over it. And I know the Startup Group won't run in Safe Mode--
so, it can't be something in there. I'll have to boot into Safe Mode
soon & play around.

>>Here's another fairly easy one to try...
>>http://support.microsoft.com/default.as ... 91&Product
=w98
>>Error Message: TASKMON Caused an Invalid Page Fault in Module...
>>EXPLORER caused an invalid page fault in module kernel32.dll.
>>
>>It says to rename the Applog folder & reboot. I think it's possible
>>the Applog folder functions in Safe Mode.
>>
> The Applog folder is empty on this machine. Renaming it and rebooting
> had no effect on the explorer.exe behavior.

All right. It was just a shot in the dark.

> That's all for now.

Keep looking through those MS & Leboeuf articles. Keep us informed.

> RL

--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
Should things get worse after this,
PCR
pcrrcp@netzero.net

On Thu, 16 Jul 2009 20:01:24 -0400, "PCR" <pcrrcp@netzero.net> wrote:

>legg wrote:
>>>On Tue, 14 Jul 2009 21:09:34 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>>
>>
>>>The entry that says "Explorer" is the shell. What shows up for you at
>>>"START, Run, SysEdit" in the [boot] section of System.ini...?...
>>>
>>>System.ini
>>>[boot]
>>>shell=Explorer.exe
>>>
>>>That must also run in Safe Mode. Ensure there is nothing else on the
>>>shell line way off & invisible to the right. Anything else on that
>>>line could be a virus. Also ensure you have only one file named
>>>Explorer.exe & that it is located in C:\Windows. If another one
>>>exists in the root C:\, it could be a virus & could take precedence.
>>
>> The System.ini line is clean. The Explorer executable is in the right
>> directory. v4.72.3110.1.
>
>All right. Those are in the clear. I'm still mulling over what you saw
>in Safe Mode in the Ctrl-Alt-Del Close Program requestor...
>
>Notepad
>Taskinfo
>diagnose (open folder)
>Explorer.exe
>Explorer
>
>This was after the DrWatson crash, & you believe the "Explorer.exe" item
>is an Explorer window that won't close. But I'm wondering how an open
>Explorer window would look like that in the first place. The shell is
>the "Explorer" line: close that one & the shell restarts (which
>approximates the symtoms you've reported). An open instance of Explorer
>shows up as "Exploring - (drive/folder name)". Explorer opened to a
>folder (such as using the Find box's "File menu, Open Containing
>Folder") will show up as the folder name. I know a folder can be named
>"Explorer.exe", but I don't think that's whats going on. So, I'm still
>mulling over it. And I know the Startup Group won't run in Safe Mode--
>so, it can't be something in there. I'll have to boot into Safe Mode
>soon & play around.
>
>>>Here's another fairly easy one to try...
>>>http://support.microsoft.com/default.as ... 91&Product
>=w98
>>>Error Message: TASKMON Caused an Invalid Page Fault in Module...
>>>EXPLORER caused an invalid page fault in module kernel32.dll.
>>>
>>>It says to rename the Applog folder & reboot. I think it's possible
>>>the Applog folder functions in Safe Mode.
>>>
>> The Applog folder is empty on this machine. Renaming it and rebooting
>> had no effect on the explorer.exe behavior.
>
>All right. It was just a shot in the dark.

>
>> That's all for now.
>
>Keep looking through those MS & Leboeuf articles. Keep us informed.
>

This is an old thread, but the original offending W98 system and
hardware are still around in an untampered-with condition, having been
used only sparingly in the meantime.

During one of those 'sparing' uses I had a fault that referred to a
program that wasn't supposed to be running - an 'on-demand' trojan
scanner that no longer supported W98 and had been removed from the
start-up menu.

This was Trojan Remover by Simply Super Software. The last revision
6.8.0 was supposed to be W98 compatible, but subsequent definition
updates would attempt to function - simply giving the 'OS not
compatible' warning. The version had been re-installed one month after
the first explorer issues arose, producing bugs that launched the MS
task scheduler every time the 'quick scan' was launched. I was issued
with a modified trjscan.exe to over-write the existing version, to
resolve that issue. Possibly other issues have been resolved since,
and SimplySup still offers a W98 compatible version.

Anyways, given the hint of this program's possible involvement, it was
uninstalled completely. It's highly unlikely that this woud have
anything to do with faults that occured in this OS in safe mode.

The other thing I've done is revisit the NVidia drivers, which are now
pretty unambiguous about which versions are W98 compatible, with
considerations for listed hardware. I reinstalled at version 81.89.

While I have later versions stored on the machine, there's no note in
my logs that anything later than 77.72 (in 2005) had ever been
installed. The video card is GeForce2 MX 400. There is a file from as
late as 2008 for the 'unofficial' 82.69 version, but then again
there's no note in the log suggesting that it was ever installed....
but that date is pretty coincidental with the beginning of the
explorer issues.

Since the 81.89 re-install, the explorer faults seem to have cleared
up when the W98 SP2 OS is run. This is just the sort of thing that was
suggested quite early on in the 'Explorer Invalid Page Fault' thread,
so ..... ' a boot to the head '.

There's one puzzling registry issue remaining.

The key, "CLSID\{9C2C8FBD-9F1B-4316-9846-1D63658C3D01}\DefaultIcon,"
refers to a missing icon,
"C\WINDOWS\SYSTEM\SHELL32.DLL,-134."

The 'problem' is in the -134 suffix. The old Norton registry checking
tools doesn't like icon entries that don't simply refer to straight
forward directory paths. I don't know why this ~switch is added to the
registry entry, but it occurred in the above-mentioned sw changes.

Don't know how serious it might be.

RL

On Sat, 11 Sep 2010 12:07:00 -0500, legg <legg@nospam.magma.ca> wrote:

>On Thu, 16 Jul 2009 20:01:24 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>
>>legg wrote:
<snip>
>>Keep looking through those MS & Leboeuf articles. Keep us informed.
>>
>
>This is an old thread, but the original offending W98 system and
>hardware are still around in an untampered-with condition, having been
>used only sparingly in the meantime.
>
>During one of those 'sparing' uses I had a fault that referred to a
>program that wasn't supposed to be running - an 'on-demand' trojan
>scanner that no longer supported W98 and had been removed from the
>start-up menu.
>
>This was Trojan Remover by Simply Super Software. The last revision
>6.8.0 was supposed to be W98 compatible, but subsequent definition
>updates would attempt to function - simply giving the 'OS not
>compatible' warning. The version had been re-installed one month after
>the first explorer issues arose, producing bugs that launched the MS
>task scheduler every time the 'quick scan' was launched. I was issued
>with a modified trjscan.exe to over-write the existing version, to
>resolve that issue. Possibly other issues have been resolved since,
>and SimplySup still offers a W98 compatible version.
>
>Anyways, given the hint of this program's possible involvement, it was
>uninstalled completely. It's highly unlikely that this woud have
>anything to do with faults that occured in this OS in safe mode.
>
>The other thing I've done is revisit the NVidia drivers, which are now
>pretty unambiguous about which versions are W98 compatible, with
>considerations for listed hardware. I reinstalled at version 81.89.
>
>While I have later versions stored on the machine, there's no note in
>my logs that anything later than 77.72 (in 2005) had ever been
>installed. The video card is GeForce2 MX 400. There is a file from as
>late as 2008 for the 'unofficial' 82.69 version, but then again
>there's no note in the log suggesting that it was ever installed....
>but that date is pretty coincidental with the beginning of the
>explorer issues.
>
>Since the 81.89 re-install, the explorer faults seem to have cleared
>up when the W98 SP2 OS is run. This is just the sort of thing that was
>suggested quite early on in the 'Explorer Invalid Page Fault' thread,
>so ..... ' a boot to the head '.
>
>There's one puzzling registry issue remaining.
>
>The key, "CLSID\{9C2C8FBD-9F1B-4316-9846-1D63658C3D01}\DefaultIcon,"
>refers to a missing icon,
>"C\WINDOWS\SYSTEM\shell32.dll,-134."
>
>The 'problem' is in the -134 suffix. The old Norton registry checking
>tools doesn't like icon entries that don't simply refer to straight
>forward directory paths. I don't know why this ~switch is added to the
>registry entry, but it occurred in the above-mentioned sw changes.
>
>Don't know how serious it might be.

Well, no invalid page faults, so far.

A number of instances where explorer gets lost - with large CPU use.

Sometimes an adobe acrobat program is listed as being unresponsive
(cntr-alt-del), though adobe hasn't been run for many minutes (adobe
6). Sometimes it's a web page with flash that I'd normally expect the
older browswers to choke on (seamonkey 1.7.1 browser and editing
features only installed)).

But no invalid page faults.

Looking in current system.ini and comparing a section of an older
(years) [386Enh] section, I see currently:

device=*enable
EMMExclude=C000-CFFF,C000-CFFF,C000-CFFF
PagingDrive=C:
MinPagingFileSize=358400
MaxPagingFileSize=773120

in older file:

MinPagingFileSize=716800
PagingDrive=C:
device=*enable
MaxPagingFileSize=716800
EMMExclude=C000-CFFF

Why the repeatition of C000-CFFF in the current file?
Is order of entry, line location important? I'm wondering where 773120
came from - was supposed to be twice minimum (just for form's sake).

RL

On Sun, 12 Sep 2010 15:29:42 -0500, legg <legg@nospam.magma.ca> wrote:

>On Sat, 11 Sep 2010 12:07:00 -0500, legg <legg@nospam.magma.ca> wrote:
>
>>On Thu, 16 Jul 2009 20:01:24 -0400, "PCR" <pcrrcp@netzero.net> wrote:
>>
<snip>t to the head '.
>>
>>There's one puzzling registry issue remaining.
>>
>>The key, "CLSID\{9C2C8FBD-9F1B-4316-9846-1D63658C3D01}\DefaultIcon,"
>>refers to a missing icon,
>>"C\WINDOWS\SYSTEM\shell32.dll,-134."
>>
>>The 'problem' is in the -134 suffix. The old Norton registry checking
>>tools doesn't like icon entries that don't simply refer to straight
>>forward directory paths. I don't know why this ~switch is added to the
>>registry entry, but it occurred in the above-mentioned sw changes.
>>
>>Don't know how serious it might be.
>
>Well, no invalid page faults, so far.
>
>A number of instances where explorer gets lost - with large CPU use.
>
>Sometimes an adobe acrobat program is listed as being unresponsive
>(cntr-alt-del), though adobe hasn't been run for many minutes (adobe
>6). Sometimes it's a web page with flash that I'd normally expect the
>older browswers to choke on (seamonkey 1.7.1 browser and editing
>features only installed)).
>
>But no invalid page faults.
>
>Looking in current system.ini and comparing a section of an older
>(years) [386Enh] section, I see currently:
>
>device=*enable
>EMMExclude=C000-CFFF,C000-CFFF,C000-CFFF
>PagingDrive=C:
>MinPagingFileSize=358400
>MaxPagingFileSize=773120
>
>in older file:
>
>MinPagingFileSize=716800
>PagingDrive=C:
>device=*enable
>MaxPagingFileSize=716800
>EMMExclude=C000-CFFF
>
>Why the repeatition of C000-CFFF in the current file?
>Is order of entry, line location important? I'm wondering where 773120
>came from - was supposed to be twice minimum (just for form's sake).
>
Last bit - the system.ini also neglects to list the GeForce adapter in
the display.drv line of the [boot.description] section. Instead it
lists 'Standard PCI Graphics Adapter (VGA)'.

How does system.ini get f'd about this way?

I've made changes to reduce these questionable entries.

After a full evening of mucking about with files, USB and slave
drives, Excel spreadsheets, and printing to hardware and soft files
simultaneously without a glitche, my confidence in the old OS is
returning.

The attached hardware was always in service during this long interval
of W98 inactivity - W2K alternate boot serving as the work horse.

Too bad we couldn't have cracked these simple issues at the time. My
fault I guess.

RL