Explorer invalid page fault in <unknown> and in Kernel32

Recently I've been battling with Explorer invalid page faults in

module <unknown> at 0096:xxxxxxxx
module KERNEL32.DLL at 0197:bff9dc19 (recently)
0197:bff7b9f5

These can occur as often as every few minutes, sometimes in the very
process of cleaning up after the last event. This behaviour is
uncharacteristic, but follows a number of recent hardware-induced
crashes that resulted in modest disc data and file errors. The
hardware trouble is corrected.

This is a W98 2Ed installation that has been used daily, without a
reinstall, for more than nine years. Currently it resides as the most
frequently used OS in a dual boot system with W2K SP4, in four
year old hardware (....new power supply, floppy, video card and HDD in
the mean-time).

The unofficial KERNEL32.dll fix for large file transfer errors,
and the unofficial SHELL32.DLL fix for explorer lock-up have both been
installed for a number of years, and performed as advertised.

Any suggestions on tracking this issue down. I've already re-installed
explorer.exe from cab files.

The error can occur simply opening and closing different windows, and
or the 'find files' utility. It has also occurred in copy and paste
file transfer operations between different open file windows, without
failure of the actual file transfer.

The symptom is less severe than some actual OS crash behaviour that
preceded it - occurring under similar circumstances. The crashes
seemed to stop occurring after I increased virtual memory 'minimum'
setting from zero to a larger number. (Maximum virtual memory setting
is unchanged at 750M - roughly twice the installed RAM).

I've been avoiding file transfer in the W98 mode for real work by
using W2K to manipulated files on the W98 HDD, over the last few days.

Any suggestions from people still nursing a W98 system out there?

RL

 

Unexplained computer behavior may be caused by deceptive software (or your
old box may be on its last "leggs" <w>).
http://support.microsoft.com/kb/827315
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002

legg wrote:
> Recently I've been battling with Explorer invalid page faults in
>
> module <unknown> at 0096:xxxxxxxx
> module KERNEL32.DLL at 0197:bff9dc19 (recently)
> 0197:bff7b9f5
>
> These can occur as often as every few minutes, sometimes in the very
> process of cleaning up after the last event. This behaviour is
> uncharacteristic, but follows a number of recent hardware-induced
> crashes that resulted in modest disc data and file errors. The
> hardware trouble is corrected.
>
> This is a W98 2Ed installation that has been used daily, without a
> reinstall, for more than nine years. Currently it resides as the most
> frequently used OS in a dual boot system with W2K SP4, in four
> year old hardware (....new power supply, floppy, video card and HDD in
> the mean-time).
>
> The unofficial KERNEL32.dll fix for large file transfer errors,
> and the unofficial SHELL32.DLL fix for explorer lock-up have both been
> installed for a number of years, and performed as advertised.
>
> Any suggestions on tracking this issue down. I've already re-installed
> explorer.exe from cab files.
>
> The error can occur simply opening and closing different windows, and
> or the 'find files' utility. It has also occurred in copy and paste
> file transfer operations between different open file windows, without
> failure of the actual file transfer.
>
> The symptom is less severe than some actual OS crash behaviour that
> preceded it - occurring under similar circumstances. The crashes
> seemed to stop occurring after I increased virtual memory 'minimum'
> setting from zero to a larger number. (Maximum virtual memory setting
> is unchanged at 750M - roughly twice the installed RAM).
>
> I've been avoiding file transfer in the W98 mode for real work by
> using W2K to manipulated files on the W98 HDD, over the last few days.
>
> Any suggestions from people still nursing a W98 system out there?
>
> RL

 

PA Bear [MS MVP] wrote:
> Unexplained computer behavior may be caused by deceptive software (or
> your old box may be on its last "leggs" <w>).
> http://support.microsoft.com/kb/827315

In addition..

The issue may come from the cab file installations. You likely had
updated the system prior to whatever errors you encountered to cause you
to try that type of fix.

Did/do you have an %windir%/Options/CABS folder?
That might {have} contained updated files from which to fix the issue
from [though it may have been a registry error].

You used CABS [from what versions?] which may have overwritten newer
files from later updates or changed registry entries [or are not
set-up/registered correctly].

For a start:

1. Look for an older version of CC [component checker from Microsoft -
cc_pkg.exe or whatever it is now] and check your version(s) installed.

2. Run QFE to see if your updates are still found/shown as installed.
Note potential issues.

3. Run Process Explorer and check through there for running processes
and files.

4. Run Dependency Walker on the target issues [such as explorer] and
other base applications to find whatever errors occur. You should be
able to locate the files or errors in files causing the issues, for
comparison with searched issues and file version information.

These four check tools are invaluable for maintaining Win98.

5. If necessary, run regmon and/or *filemon* [from
sysinternals/Microsoft Tech] and monitor for the actual failures.
CAPTURE the error(s) and review those issues.


--
~
--
MEB
http://peoplescounsel.org/ref/windows-main.htm
Windows Diagnostics, Security, Networking
http://peoplescounsel.org
The *REAL WORLD* of Law, Justice, and Government
_______

 

On Fri, 15 May 2009 21:23:33 -0400, "PA Bear [MS MVP]"
<PABearMVP@gmail.com> wrote:

>Unexplained computer behavior may be caused by deceptive software (or your
>old box may be on its last "leggs" <w>).
>http://support.microsoft.com/kb/827315

I'm aware of possible hardware problems, having dealt with many over
the years. I;m prepared to tackle any new ones that you may suggest.
The issue is obviously not thermal. It's not the graphics card or
power supply. The HDD is checked by internal and external utilities.
Once this issue is cleared up, it is due for ternary HDD back-up
rotation, which is my currnt method of disaster recovery.

This issue seems to have something to do with the programs or OS of
this particulat hard drive - the OS in particular, if memory
management settings can change a crash into an apparently manageable
explorer fault. The system and hardware were characteristically stable
prior to the last series of problems.

In any event, the OS has current NOD32 Avirus, hardware and software
firewalls, adaware and antitrojan utilities etc etc etc. Processes and
resources are monitored and unstressed at the time of explorer
faulting.

Maintaining a working W98 system is required to maintain linked
resources of software and hardware that cannot be replaced. Other
systems are available to handle more current (downwardly incompatible)
software and hardware.

RL

 

MEB wrote:
> PA Bear [MS MVP] wrote:
>> Unexplained computer behavior may be caused by deceptive software (or
>> your old box may be on its last "leggs" <w>).
>> http://support.microsoft.com/kb/827315
>
> In addition..
>
>

Sorry, sent that before asking:

Did you had checked your memory yet?

Since you did all these hardware upgrades, did you make sure to check
all connections?
Easy to bump something and cause intermittent errors.

--
~
--
MEB
http://peoplescounsel.org/ref/windows-main.htm
Windows Diagnostics, Security, Networking
http://peoplescounsel.org
The *REAL WORLD* of Law, Justice, and Government
_______

 

On Fri, 15 May 2009 22:20:02 -0400, MEB <meb-not-here@hotmail.com>
wrote:

>MEB wrote:
>> PA Bear [MS MVP] wrote:
>>> Unexplained computer behavior may be caused by deceptive software (or
>>> your old box may be on its last "leggs" <w>).
>>> http://support.microsoft.com/kb/827315
>>
>> In addition..
>>
>>
>
>Sorry, sent that before asking:
>
> Did you had checked your memory yet?
>
> Since you did all these hardware upgrades, did you make sure to check
>all connections?
> Easy to bump something and cause intermittent errors.
>

Yes, I've run RAM tests (MEMTEST'86)on boot, without errors.

I'm also confident of connectors and sockets - checked during the root
hardware cure to the innitial crashes. Hardware cure was PSU
replacement (psu refurb was not effective). Symptoms of a HDD loose
connector are, from experience, much more severe and less GUI
application operator action-dependant.

RL

 

If the system is stable when you are running W2K, then it's probably not a
memory error. However, an extensive RAM test for at least a few hours (and
preferably overnight) is simple enough, and worthwhile in order to eliminate
that possibility.

You have not indicated that you know that the system is free of viruses or
trojans - that would be my prediction of the most likely cause after bad
memory.

You should remove that maximum and minimum setting for virtual memory - W98
does not need those values set, and they can cause odd problems.

When did the problem start? What changed immediately before the problem
started? If the problem existed before you copied Explorer.EXE from the
CAB files, and didn't change after the copy, then that suggests that there
is no version problem as a result, but a better practice would be to copy
those sorts of files from a backup you made before the problem started.
--
Jeff Richards
MS MVP (Windows - Shell/User)
"legg" <legg@nospam.magma.ca> wrote in message
news:1j7s059gag73q3qkimsrjb6300e9h4tmma@4ax.com...
> On Fri, 15 May 2009 21:23:33 -0400, "PA Bear [MS MVP]"
> <PABearMVP@gmail.com> wrote:
>
>>Unexplained computer behavior may be caused by deceptive software (or your
>>old box may be on its last "leggs" <w>).
>>http://support.microsoft.com/kb/827315
>
> I'm aware of possible hardware problems, having dealt with many over
> the years. I;m prepared to tackle any new ones that you may suggest.
> The issue is obviously not thermal. It's not the graphics card or
> power supply. The HDD is checked by internal and external utilities.
> Once this issue is cleared up, it is due for ternary HDD back-up
> rotation, which is my currnt method of disaster recovery.
>
> This issue seems to have something to do with the programs or OS of
> this particulat hard drive - the OS in particular, if memory
> management settings can change a crash into an apparently manageable
> explorer fault. The system and hardware were characteristically stable
> prior to the last series of problems.
>
> In any event, the OS has current NOD32 Avirus, hardware and software
> firewalls, adaware and antitrojan utilities etc etc etc. Processes and
> resources are monitored and unstressed at the time of explorer
> faulting.
>
> Maintaining a working W98 system is required to maintain linked
> resources of software and hardware that cannot be replaced. Other
> systems are available to handle more current (downwardly incompatible)
> software and hardware.
>
> RL

 

legg wrote:
> On Fri, 15 May 2009 22:20:02 -0400, MEB <meb-not-here@hotmail.com>
> wrote:
>
>> MEB wrote:
>>> PA Bear [MS MVP] wrote:
>>>> Unexplained computer behavior may be caused by deceptive software (or
>>>> your old box may be on its last "leggs" <w>).
>>>> http://support.microsoft.com/kb/827315
>>> In addition..
>>>
>>>
>> Sorry, sent that before asking:
>>
>> Did you had checked your memory yet?
>>
>> Since you did all these hardware upgrades, did you make sure to check
>> all connections?
>> Easy to bump something and cause intermittent errors.
>>
>
> Yes, I've run RAM tests (MEMTEST'86)on boot, without errors.
>
> I'm also confident of connectors and sockets - checked during the root
> hardware cure to the innitial crashes. Hardware cure was PSU
> replacement (psu refurb was not effective). Symptoms of a HDD loose
> connector are, from experience, much more severe and less GUI
> application operator action-dependant.
>
> RL

Right, actually I was thinking more towards memory modules... but if
you've run the test then that's been taken care of if run for a while
without errors.

You mentioned you had all the A-V and stuff, we presume you ran tests
or you wouldn't have posted here [seems you've posted here before, maybe
not]. These are updated of course...
How about HighJackThis? Look good?

We also presume you checked and if necessary, properly set the
BIOS/CMOS to reflect your old settings after the PSU replacement.

Just one more question, did you burn-out the PSU, meaning overheated
rather than just a slow death [voltage spikes verses low voltage or
wrong voltages for a long period]?

Part of the issue may be VMM and swap related. You could try booting
to Safe Mode, shutting off Windows control of virtual memory, delete the
swap file in DOS Mode or let Windows do it when re-booting to *Safe
Mode* [not Normal Boot - it will baulk or may cause further errors
depending upon how much memory you have and programs loaded at start-up].
As Jeff indicated, remove the memory limitations unless you're dealing
with large amounts [like 768 > 1 gig or more], virtual control should be
left to Windows generally.
Any memory related entries in your sys.ini? [swap, cache, memory
limits, etc..]

While in Safe Mode - Check Device Manager for duplicate entries,
remove any; remove the hard drive controllers [both entries - drives and
controllers]; re-enable Windows Control of virtual memory; boot
normally. Check Device Manager for correct controllers and drives, and
settings [such as DMA for hard drives and CD].

So if you've run the normal tests and you are clean, and read the
Microsoft material and checked BIOS/CMOS, try the things I mentioned
before adding the second post, and these new potentials.

--
~
--
MEB
http://peoplescounsel.org/ref/windows-main.htm
Windows Diagnostics, Security, Networking
http://peoplescounsel.org
The *REAL WORLD* of Law, Justice, and Government
_______

 

On Fri, 15 May 2009 22:11:41 -0400, MEB <meb-not-here@hotmail.com>
wrote:

>PA Bear [MS MVP] wrote:
>> Unexplained computer behavior may be caused by deceptive software (or
>> your old box may be on its last "leggs" <w>).
>> http://support.microsoft.com/kb/827315
>
> In addition..
>
> The issue may come from the cab file installations. You likely had
>updated the system prior to whatever errors you encountered to cause you
>to try that type of fix.
>
> Did/do you have an %windir%/Options/CABS folder?
> That might {have} contained updated files from which to fix the issue
>from [though it may have been a registry error].
>
> You used CABS [from what versions?] which may have overwritten newer
>files from later updates or changed registry entries [or are not
>set-up/registered correctly].

The cabs are from the W98 2Ed disc, stored on the HDD for easy access
(in two locations). Explorer.exe for W98 hasn't changed since April'99
(ver 4.72.3110.1).

The only file restored so far was the explorer executable.

> For a start:
>
>1. Look for an older version of CC [component checker from Microsoft -
>cc_pkg.exe or whatever it is now] and check your version(s) installed.

I'm not sure what cc_pkg is supposed to be, but getting one for W98
could prove a problem.

I've run SFC with no major issues, though I'm always curious to see
those date stamp issues that have exactly 1 hour of discrepancy. Dated
logs for these checks are traceable back to pre support termination.

>
>2. Run QFE to see if your updates are still found/shown as installed.
>Note potential issues.

Running QFE on this machine simply opens the QFE folder window, with
the W98 folder.

>
>3. Run Process Explorer and check through there for running processes
>and files.

Both Task Info and Process Explorer show nothing surprising. One thing
I will do is reduce priority on these monitoring tools. No point in
adding complications.
>
>4. Run Dependency Walker on the target issues [such as explorer] and
>other base applications to find whatever errors occur. You should be
>able to locate the files or errors in files causing the issues, for
>comparison with searched issues and file version information.

Not heard of this, or ever seen it used. Will see what I can make of
it.

>
> These four check tools are invaluable for maintaining Win98.
>
>5. If necessary, run regmon and/or *filemon* [from
>sysinternals/Microsoft Tech] and monitor for the actual failures.
>CAPTURE the error(s) and review those issues.
>
The RegMon98 I have loaded seems pretty useless without a license. The
only info supplied with the package is info on obtaining same.

I'm fairly sure there are no 'obvious invalid' links in the registry.
These are checked whenever sw is installed or removed, using simple
Norton tools from the 90s. There's no knowing what dlls or executables
are actually trying to do, however.

This system has MS ODBC and MS Visual C++ v5 installed, courtesy of my
(late) younger brother, who was the programmer in the family. There
are instances where I'm offered the opportunity to troubleshoot a
noted hiccough, but it's outside my area of expertise. Seeing ???
occurring with increasing periodicity in the second column of the
report means nothing to me. They are also incredibly long and hard to
navigate with the GUI, without knowing what you're looking for (or
trying to do.....).

Frankly, I'm temperamentally alergic to SW above machine code and
assembler levels for PICs/FPGAs and often need my arm twisted to work
even there, if there's someone else around who's more inclined that
way. I'm hardware hardwired. There comes a point where knowing more
than you ever wanted to know or should have ever have needed to know
about PCs, just to keep the bastards running, becomes an absolute
farce.

RL

 

legg wrote:
> On Fri, 15 May 2009 21:23:33 -0400, "PA Bear [MS MVP]"
> <PABearMVP@gmail.com> wrote:
>
>> Unexplained computer behavior may be caused by deceptive software (or
>> your
>> old box may be on its last "leggs" <w>).
>> http://support.microsoft.com/kb/827315
>
> I'm aware of possible hardware problems, having dealt with many over
> the years. I;m prepared to tackle any new ones that you may suggest.
> The issue is obviously not thermal. It's not the graphics card or
> power supply. The HDD is checked by internal and external utilities.
> Once this issue is cleared up, it is due for ternary HDD back-up
> rotation, which is my currnt method of disaster recovery.
>
> This issue seems to have something to do with the programs or OS of
> this particulat hard drive - the OS in particular, if memory
> management settings can change a crash into an apparently manageable
> explorer fault. The system and hardware were characteristically stable
> prior to the last series of problems.
>
> In any event, the OS has current NOD32 Avirus, hardware and software
> firewalls, adaware and antitrojan utilities etc etc etc. Processes and
> resources are monitored and unstressed at the time of explorer
> faulting.
>
> Maintaining a working W98 system is required to maintain linked
> resources of software and hardware that cannot be replaced. Other
> systems are available to handle more current (downwardly incompatible)
> software and hardware.

What version of NOD32 is installed (e.g., v2.51.26 ) and is your
subscription current?

 

On Sat, 16 May 2009 13:55:44 +1000, "Jeff Richards"
<JRichards@msn.com.au> wrote:

>If the system is stable when you are running W2K, then it's probably not a
>memory error. However, an extensive RAM test for at least a few hours (and
>preferably overnight) is simple enough, and worthwhile in order to eliminate
>that possibility.

I guess the last 8 hours of testing, overnight, was enough to vet
memory hardware. The explorer fault occurred again when I first opened
my news client from the toolbar minutes ago.

>
>You have not indicated that you know that the system is free of viruses or
>trojans - that would be my prediction of the most likely cause after bad
>memory.

Sorry, there will be at least 1 hour latency in responses to posts on
this thread, if not overnight. AV and trojan status is per NOD32
(defns 4080) and Trojan Remover 6.7.8. (database 7329). Adaware and
HijackThis also recent.
>
>You should remove that maximum and minimum setting for virtual memory - W98
>does not need those values set, and they can cause odd problems.

This is the first time I've heard anyone, besides MS, recommend
allowing the W98 OS to handle virtual memory. The settings in this
system have never done so.

My recent change of the minimum value was incidental to temporarilly
adjusting hardware accelleration settings, as it occurred to me that
most limited dynamic systems seem to have difficulty with the concept
of absolute zero. The perceived benefit was unexpected and is as yet
unproven through an iterative reversal.

As I recall, the major issue with native management was that, if
unchecked, it increased swap files gradually without apparent limit -
never reducing, despite lowered system resource demands, eventually
hobbling performance and user GUI response unpredictably with the
unmanageable file size. Perhaps this isn't an issue now, with larger
hard drive and physical memory, and muti-GHz processors.
>
>When did the problem start? What changed immediately before the problem
>started? If the problem existed before you copied Explorer.EXE from the
>CAB files, and didn't change after the copy, then that suggests that there
>is no version problem as a result, but a better practice would be to copy
>those sorts of files from a backup you made before the problem started.

The current problem is the last remaining symptom of apparent power
supply intermitency-generated system/disc freezes that were
characteristicaly random and unpredictable and which generated lost
clusters and other disc errors.

The resulting explorer problems are user-input generated (ie opening
and closing windows and transfering files) without loss of information
or file corruption. I simply close the error message and reopen the
previous windows to go about the previous business. The explorer
errors all seem to be accurately recorded in the systems faultlog.

There is a HDD back-up, but from the previous quarter (ie more than 3
months old). If all else fails, that is the last resort, and one
normally adopted only for non-funtional HDD. File transfers from this
back-up are not out of the question, however, if you can suggest
likely candidates that might address this specific issue.

RL

RL

 

On Sat, 16 May 2009 03:08:51 -0400, "PA Bear [MS MVP]"
<PABearMVP@gmail.com> wrote:

>
>
>legg wrote:
>> On Fri, 15 May 2009 21:23:33 -0400, "PA Bear [MS MVP]"
>> <PABearMVP@gmail.com> wrote:
>>
>>> Unexplained computer behavior may be caused by deceptive software (or
>>> your
>>> old box may be on its last "leggs" <w>).
>>> http://support.microsoft.com/kb/827315
>>
>> I'm aware of possible hardware problems, having dealt with many over
>> the years. I;m prepared to tackle any new ones that you may suggest.
>> The issue is obviously not thermal. It's not the graphics card or
>> power supply. The HDD is checked by internal and external utilities.
>> Once this issue is cleared up, it is due for ternary HDD back-up
>> rotation, which is my currnt method of disaster recovery.
>>
>> This issue seems to have something to do with the programs or OS of
>> this particulat hard drive - the OS in particular, if memory
>> management settings can change a crash into an apparently manageable
>> explorer fault. The system and hardware were characteristically stable
>> prior to the last series of problems.
>>
>> In any event, the OS has current NOD32 Avirus, hardware and software
>> firewalls, adaware and antitrojan utilities etc etc etc. Processes and
>> resources are monitored and unstressed at the time of explorer
>> faulting.
>>
>> Maintaining a working W98 system is required to maintain linked
>> resources of software and hardware that cannot be replaced. Other
>> systems are available to handle more current (downwardly incompatible)
>> software and hardware.
>
>What version of NOD32 is installed (e.g., v2.51.26 ) and is your
>subscription current?

AV and trojan status is per NOD32 v2.70.32 (defns 4080) and Trojan
Remover 6.7.8. (database 7329). Adaware and HijackThis surveys are
also recent.

The machine is connected through a NAT router and has a SW firewall
limiting/monitoring access to/from the outside world and maintaining
MD5 manifests for most processes that use these contacts.

RL

 

legg wrote:
> Recently I've been battling with Explorer invalid page faults in
>
> module <unknown> at 0096:xxxxxxxx
> module KERNEL32.DLL at 0197:bff9dc19 (recently)
> 0197:bff7b9f5
>
> These can occur as often as every few minutes, sometimes in the very
> process of cleaning up after the last event. This behaviour is
> uncharacteristic, but follows a number of recent hardware-induced
> crashes that resulted in modest disc data and file errors. The
> hardware trouble is corrected.
>
> This is a W98 2Ed installation that has been used daily, without a
> reinstall, for more than nine years. Currently it resides as the most
> frequently used OS in a dual boot system with W2K SP4, in four
> year old hardware (....new power supply, floppy, video card and HDD in
> the mean-time).
>
> The unofficial KERNEL32.dll fix for large file transfer errors,
> and the unofficial SHELL32.DLL fix for explorer lock-up have both been
> installed for a number of years, and performed as advertised.
>
> Any suggestions on tracking this issue down. I've already re-installed
> explorer.exe from cab files.
>
> The error can occur simply opening and closing different windows, and
> or the 'find files' utility. It has also occurred in copy and paste
> file transfer operations between different open file windows, without
> failure of the actual file transfer.
>
> The symptom is less severe than some actual OS crash behaviour that
> preceded it - occurring under similar circumstances. The crashes
> seemed to stop occurring after I increased virtual memory 'minimum'
> setting from zero to a larger number. (Maximum virtual memory setting
> is unchanged at 750M - roughly twice the installed RAM).
>
> I've been avoiding file transfer in the W98 mode for real work by
> using W2K to manipulated files on the W98 HDD, over the last few days.
>
> Any suggestions from people still nursing a W98 system out there?
>
> RL
I know this may sound a little strange, but try repairing IE. I know you're
talking about Explorer and not IE, but IE can still do strange things to
Explorer.
I believe you can go into Add-Remove and select IE and then it will give you
the choice to 'repair' IE.
I think you can also do it through System Informations under the Tools tab.
If you have time, try downloading, installing, updating and running the
following two free programs:
SAS (SuperAntiSpyware) http://www.superantispyware.com/download.html
MBAM (MalwareBytes AntiMalware) caution, only dl it from the
http://www.malwarebytes.org/ site. Reason being that some folks misspelled
MalwareBytes or left a space between Malware and Bytes and got a spyware
site with a malware download.
If you decide to get rid of them, they both uninstall cleanly.
And NO, they do not ask you to upgrade to the paid version to fix anything
they find.
The free versions of both will find and clean just as well as the paid
versions, but the free versions are manual scan only, not real-time.

Before running them. it helps to delete your temp files, your TIF files and
cookies that you don't need to keep.

A free program called CrapCleaner makes that task easier, but I would
recommend against using CC's registry cleaner UNLESS you really know what
you're doing.
Buffalo

 

>On Sat, 16 May 2009 01:11:01 -0400, MEB <meb-not-here@hotmail.com> wrote:

>>legg wrote:
>> On Fri, 15 May 2009 22:20:02 -0400, MEB <meb-not-here@hotmail.com>
>> wrote:
>>
>>> MEB wrote:
>>>> PA Bear [MS MVP] wrote:
>>>>> Unexplained computer behavior may be caused by deceptive software (or
>>>>> your old box may be on its last "leggs" <w>).
>>>>> http://support.microsoft.com/kb/827315
>>>> In addition..
>>>>
>>>>
>>> Sorry, sent that before asking:
>>>
>>> Did you had checked your memory yet?
>>>
>>> Since you did all these hardware upgrades, did you make sure to check
>>> all connections?
>>> Easy to bump something and cause intermittent errors.
>>>
>>
>> Yes, I've run RAM tests (MEMTEST'86)on boot, without errors.
>>
>> I'm also confident of connectors and sockets - checked during the root
>> hardware cure to the innitial crashes. Hardware cure was PSU
>> replacement (psu refurb was not effective). Symptoms of a HDD loose
>> connector are, from experience, much more severe and less GUI
>> application operator action-dependant.
>>
>> RL
>
> Right, actually I was thinking more towards memory modules... but if
>you've run the test then that's been taken care of if run for a while
>without errors.

8hrs overnight just to be sure, without errors or stalling.

>
> You mentioned you had all the A-V and stuff, we presume you ran tests
>or you wouldn't have posted here [seems you've posted here before, maybe
>not]. These are updated of course...

No previous posts on this issue. Large file tranfers were my last
issue a few years ago. The adoption of two unofficial patches
mentioned earlier seemed to cure the behavior, with no reoccurences.

> How about HighJackThis? Look good?

No issues there.

>
> We also presume you checked and if necessary, properly set the
>BIOS/CMOS to reflect your old settings after the PSU replacement.

There are no non-default user adjustments made that are psu-related on
this system. No disc spin-up sequencing is enforced. No weaking of
processor speed or supply voltages or memory settings. No thermal
issues.

>
> Just one more question, did you burn-out the PSU, meaning overheated
>rather than just a slow death [voltage spikes verses low voltage or
>wrong voltages for a long period]?

The supply, two years old, had no obvious symptoms of aging. Ripple
responce to HDD and processor dynamic draw were actually scoped in Jan
of this year, and were seen to be optimal. This was in troubleshooting
of a new World Community Grid agent's processor resource and idling
behavior for W98, just prior to decommissoning W98 installations here.
The new BOINC task handler just proved too intrusive to the W98 system
- this after running United Devices for 8 years without any issues
arrising. WCG 'advisors' were not interested in W98 problems with the
new agent, and stated as much. I believe they were a little
resource-limited, themselves.

In any event, The random system disc freezes were just too much like
previous supply issues. A refurb of life-limited components proved
ineffective (that's my area of expertise, having designed conversion
products for some years) imn preventing the behavior. Replacement did
prevent it, and left me cleaning up the remenants of resulting SW
abnormalities. The explorer faults are the last issue.
>
> Part of the issue may be VMM and swap related. You could try booting
>to Safe Mode, shutting off Windows control of virtual memory, delete the
>swap file in DOS Mode or let Windows do it when re-booting to *Safe
>Mode* [not Normal Boot - it will baulk or may cause further errors
>depending upon how much memory you have and programs loaded at start-up].
> As Jeff indicated, remove the memory limitations unless you're dealing
>with large amounts [like 768 > 1 gig or more], virtual control should be
>left to Windows generally.

As noted to Jeff, I'm curious to hear these recommendations to allow
W98 virtual memory management. You two are the first proponents I've
ever run across.... It has always been disabled in this W98
installation. Does this affect your suggestion re SWP file deletion
and rebuild?

> Any memory related entries in your sys.ini? [swap, cache, memory
>limits, etc..]

The only memory-related entries in system.ini (note:not 'sys.ini')
that I identify are:

EMMExclude=C000-CFFF,C000-CFFF
PagingDrive=C:
MaxPagingFileSize=768000
MinPagingFileSize=358400

>
> While in Safe Mode - Check Device Manager for duplicate entries,
>remove any; remove the hard drive controllers [both entries - drives and
>controllers]; re-enable Windows Control of virtual memory; boot
>normally. Check Device Manager for correct controllers and drives, and
>settings [such as DMA for hard drives and CD].
>
> So if you've run the normal tests and you are clean, and read the
>Microsoft material and checked BIOS/CMOS, try the things I mentioned
>before adding the second post, and these new potentials.
>
I'll recheck device manager in safe mode, as advised. This almost
always raises side issues. What are you thinking to correct that would
affect explorer.exe behavior?

RL

 

>On Sat, 16 May 2009 12:18:14 -0600, "Buffalo" <Eric@nada.com.invalid> wrote:

>
>
>>legg wrote:
>> Recently I've been battling with Explorer invalid page faults in
>>
>> module <unknown> at 0096:xxxxxxxx
>> module KERNEL32.DLL at 0197:bff9dc19 (recently)
>> 0197:bff7b9f5
<snip>
>> I've been avoiding file transfer in the W98 mode for real work by
>> using W2K to manipulated files on the W98 HDD, over the last few days.
>>
>> Any suggestions from people still nursing a W98 system out there?
>>
>> RL
>I know this may sound a little strange, but try repairing IE. I know you're
>talking about Explorer and not IE, but IE can still do strange things to
>Explorer.
>I believe you can go into Add-Remove and select IE and then it will give you
>the choice to 'repair' IE.
>I think you can also do it through System Informations under the Tools tab.
>If you have time, try downloading, installing, updating and running the
>following two free programs:
>SAS (SuperAntiSpyware) http://www.superantispyware.com/download.html
>MBAM (MalwareBytes AntiMalware) caution, only dl it from the
>http://www.malwarebytes.org/ site. Reason being that some folks misspelled
>MalwareBytes or left a space between Malware and Bytes and got a spyware
>site with a malware download.
>If you decide to get rid of them, they both uninstall cleanly.
>And NO, they do not ask you to upgrade to the paid version to fix anything
>they find.
>The free versions of both will find and clean just as well as the paid
>versions, but the free versions are manual scan only, not real-time.
>
>Before running them. it helps to delete your temp files, your TIF files and
>cookies that you don't need to keep.
>
I'm afraid I've never heard of these, and would need more than just
one recommendation before considering using them. The NOD32 and other
programs currently installed will have to do for the moment.

I don't use IExplorer, though it is installed, unless I run across web
sites that insist on no other. I'm not sure I have 'repair' capacity
for the last rev installed by the last enforced MSupdate to ver.
6.0.2800.1106IC.

RL

 

legg wrote:
>>>> Unexplained computer behavior may be caused by deceptive software (or
>>>> your
>>>> old box may be on its last "leggs" <w>).
>>>> http://support.microsoft.com/kb/827315
>>>
>>> I'm aware of possible hardware problems, having dealt with many over
>>> the years. I;m prepared to tackle any new ones that you may suggest.
>>> The issue is obviously not thermal. It's not the graphics card or
>>> power supply. The HDD is checked by internal and external utilities.
>>> Once this issue is cleared up, it is due for ternary HDD back-up
>>> rotation, which is my currnt method of disaster recovery.
>>>
>>> This issue seems to have something to do with the programs or OS of
>>> this particulat hard drive - the OS in particular, if memory
>>> management settings can change a crash into an apparently manageable
>>> explorer fault. The system and hardware were characteristically stable
>>> prior to the last series of problems.
>>>
>>> In any event, the OS has current NOD32 Avirus, hardware and software
>>> firewalls, adaware and antitrojan utilities etc etc etc. Processes and
>>> resources are monitored and unstressed at the time of explorer
>>> faulting.
>>>
>>> Maintaining a working W98 system is required to maintain linked
>>> resources of software and hardware that cannot be replaced. Other
>>> systems are available to handle more current (downwardly incompatible)
>>> software and hardware.
>>
>> What version of NOD32 is installed (e.g., v2.51.26 ) and is your
>> subscription current?
>
> AV and trojan status is per NOD32 v2.70.32 (defns 4080) and Trojan
> Remover 6.7.8. (database 7329). Adaware and HijackThis surveys are
> also recent.
>
> The machine is connected through a NAT router and has a SW firewall
> limiting/monitoring access to/from the outside world and maintaining
> MD5 manifests for most processes that use these contacts.

Is NOD32 v2.70.32 supported in Win98? Is your subscription current?

AFAIK, no currently-supported version of Ad-Aware is supported in Win98.

 

On Sat, 16 May 2009 15:03:09 -0400, "PA Bear [MS MVP]"
<PABearMVP@gmail.com> wrote:

>legg wrote:
>>>>> Unexplained computer behavior may be caused by deceptive software (or
>>>>> your
>>>>> old box may be on its last "leggs" <w>).
>>>>> http://support.microsoft.com/kb/827315
>>>>
>>>> I'm aware of possible hardware problems, having dealt with many over
>>>> the years. I;m prepared to tackle any new ones that you may suggest.
>>>> The issue is obviously not thermal. It's not the graphics card or
>>>> power supply. The HDD is checked by internal and external utilities.
>>>> Once this issue is cleared up, it is due for ternary HDD back-up
>>>> rotation, which is my currnt method of disaster recovery.
>>>>
>>>> This issue seems to have something to do with the programs or OS of
>>>> this particulat hard drive - the OS in particular, if memory
>>>> management settings can change a crash into an apparently manageable
>>>> explorer fault. The system and hardware were characteristically stable
>>>> prior to the last series of problems.
>>>>
>>>> In any event, the OS has current NOD32 Avirus, hardware and software
>>>> firewalls, adaware and antitrojan utilities etc etc etc. Processes and
>>>> resources are monitored and unstressed at the time of explorer
>>>> faulting.
>>>>
>>>> Maintaining a working W98 system is required to maintain linked
>>>> resources of software and hardware that cannot be replaced. Other
>>>> systems are available to handle more current (downwardly incompatible)
>>>> software and hardware.
>>>
>>> What version of NOD32 is installed (e.g., v2.51.26 ) and is your
>>> subscription current?
>>
>> AV and trojan status is per NOD32 v2.70.32 (defns 4080) and Trojan
>> Remover 6.7.8. (database 7329). Adaware and HijackThis surveys are
>> also recent.
>>
>> The machine is connected through a NAT router and has a SW firewall
>> limiting/monitoring access to/from the outside world and maintaining
>> MD5 manifests for most processes that use these contacts.
>
>Is NOD32 v2.70.32 supported in Win98? Is your subscription current?
>
I've had no notice of potential incompatabilities. Subscription is
current for 4 systems, W98 through to XP.

>AFAIK, no currently-supported version of Ad-Aware is supported in Win98.

Right, and the last definitions for W98 were issued in mid'06. I guess
I just don't take the adware threat that seriously. The scan is
current. Is there an issue with explorer.exe and adware?

RL

 

legg wrote:
>> On Sat, 16 May 2009 12:18:14 -0600, "Buffalo"
>> <Eric@nada.com.invalid> wrote:
>
>>
>>
>>> legg wrote:
>>> Recently I've been battling with Explorer invalid page faults in
>>>
>>> module <unknown> at 0096:xxxxxxxx
>>> module KERNEL32.DLL at 0197:bff9dc19 (recently)
>>> 0197:bff7b9f5
> <snip>
>>> I've been avoiding file transfer in the W98 mode for real work by
>>> using W2K to manipulated files on the W98 HDD, over the last few
>>> days.
>>>
>>> Any suggestions from people still nursing a W98 system out there?
>>>
>>> RL
>> I know this may sound a little strange, but try repairing IE. I know
>> you're talking about Explorer and not IE, but IE can still do
>> strange things to Explorer.
>> I believe you can go into Add-Remove and select IE and then it will
>> give you the choice to 'repair' IE.
>> I think you can also do it through System Informations under the
>> Tools tab. If you have time, try downloading, installing, updating
>> and running the following two free programs:
>> SAS (SuperAntiSpyware) http://www.superantispyware.com/download.html
>> MBAM (MalwareBytes AntiMalware) caution, only dl it from the
>> http://www.malwarebytes.org/ site. Reason being that some folks
>> misspelled MalwareBytes or left a space between Malware and Bytes
>> and got a spyware site with a malware download.
>> If you decide to get rid of them, they both uninstall cleanly.
>> And NO, they do not ask you to upgrade to the paid version to fix
>> anything they find.
>> The free versions of both will find and clean just as well as the
>> paid versions, but the free versions are manual scan only, not
>> real-time.
>>
>> Before running them. it helps to delete your temp files, your TIF
>> files and cookies that you don't need to keep.
>>
> I'm afraid I've never heard of these, and would need more than just
> one recommendation before considering using them. The NOD32 and other
> programs currently installed will have to do for the moment.
>
> I don't use IExplorer, though it is installed, unless I run across web
> sites that insist on no other. I'm not sure I have 'repair' capacity
> for the last rev installed by the last enforced MSupdate to ver.
> 6.0.2800.1106IC.
>
> RL

Check in the anti-spyware and anti-virus ngs and you will find high
recommendations for the two programs I mentioned.
As far as repairing IE, you do have that option. Check in SI
(Start,Programs,SystemTools,System Information and then click on the Tools
tab.
Also, letting Windows handle your swap file is highly recommended. Check in
the Ahuma recommendations.
Some say to set the same value for min and max to keep the page file from
changing size.

Where ever you got the idea to make the max size twice the physical ram is
most likely wrong.
IE: You have 1GB of ram so now you are going to set the max at 2GB??
I have 1GB of ram in my dual boot 98SE-2000Pro system and I barely use any
of the actual page file.
If you want to keep the pagefile size down, try adding this line to your
System.ini file under the (386Enh) header:
ConservativeSwapFileUsage=1
This basically makes the computer use all your physical ram before it will
use the pagefile.
Mnay gamers swore by this addition.
If it possibly causes problems, just change the value to 0 instead of 1
or delete (or put a ; in front of) the entry and save and
reboot.
To make a value in System.ini not recognized, just put a ; in front of
that line.
For instance, I think you should put a ; in front of all your entries
under the (vcache) header and then reboot.
(minfilecache,maxfilecache,chunksize)

That way you don't have to remember the spelling or anything to change it
back, just remove the ; and save and reboot and it will be back.
Buffalo

 

legg wrote:
<snip>
>>>> What version of NOD32 is installed (e.g., v2.51.26 ) and is your
>>>> subscription current?
>>>
>>> AV and trojan status is per NOD32 v2.70.32 (defns 4080) and Trojan
>>> Remover 6.7.8. (database 7329). Adaware and HijackThis surveys are
>>> also recent.
>>>
>>> The machine is connected through a NAT router and has a SW firewall
>>> limiting/monitoring access to/from the outside world and maintaining
>>> MD5 manifests for most processes that use these contacts.
>>
>> Is NOD32 v2.70.32 supported in Win98? Is your subscription current?
>>
> I've had no notice of potential incompatabilities. Subscription is
> current for 4 systems, W98 through to XP.

http://download.eset.com/manuals/StandardInstallGuide.pdf confirms that v2.x
is Win98-compatible.

>> AFAIK, no currently-supported version of Ad-Aware is supported in Win98.
>
> Right, and the last definitions for W98 were issued in mid'06. I guess
> I just don't take the adware threat that seriously. The scan is
> current. Is there an issue with explorer.exe and adware?

<pft> You're wasting your time scanning with such old definitions. Might
was well uninstall that version of Ad-Aware.

 

On Sat, 16 May 2009 15:53:58 -0400, "PA Bear [MS MVP]"
<PABearMVP@gmail.com> wrote:

>legg wrote:
><snip>
>>>>> What version of NOD32 is installed (e.g., v2.51.26 ) and is your
>>>>> subscription current?
>>>>
>>>> AV and trojan status is per NOD32 v2.70.32 (defns 4080) and Trojan
>>>> Remover 6.7.8. (database 7329). Adaware and HijackThis surveys are
>>>> also recent.
>>>>
>>>> The machine is connected through a NAT router and has a SW firewall
>>>> limiting/monitoring access to/from the outside world and maintaining
>>>> MD5 manifests for most processes that use these contacts.
>>>
>>> Is NOD32 v2.70.32 supported in Win98? Is your subscription current?
>>>
>> I've had no notice of potential incompatabilities. Subscription is
>> current for 4 systems, W98 through to XP.
>
>http://download.eset.com/manuals/StandardInstallGuide.pdf confirms that v2.x
>is Win98-compatible.
>
>>> AFAIK, no currently-supported version of Ad-Aware is supported in Win98.
>>
>> Right, and the last definitions for W98 were issued in mid'06. I guess
>> I just don't take the adware threat that seriously. The scan is
>> current. Is there an issue with explorer.exe and adware?
>
><pft> You're wasting your time scanning with such old definitions. Might
>was well uninstall that version of Ad-Aware.

Is adware an issue for explore.exe?
Is it not covered by NOD32 or HijackThis?
Are you recommending something as a replacement for use in W98 2Ed?

RL