kernel32 error

[MajBach1]

Hi all. I have been getting a reoccurring problem with a kernel32 error in
WindowsME. I have AcDsee 5.0 that gives me the following error:
AcDSee caused and error in Kernel32.dll. ACDSee will now close.
When I try and diagnose it with Dr.Watson I get this:
The application overflowed its temporary memory area.

Module Name: KERNEL32.DLL
Description: Win32 Kernel core component
Version: 4.90.3000
Product: Microsoft(R) Windows(R) Millennium Operating System
Manufacturer: Microsoft Corporation

Application Name: Acdsee5.exe
Description: ACDSee
Version: 5, 0, 0, 25
Product: ACDSee
Manufacturer: ACD Systems, Ltd.

--------------------
If the Taskbar is behaving strangely, try exiting Multimedia background task
support module.

Module Name: mmtask.tsk
Description: Multimedia background task support module
Version: 4.90.3000
Product: Microsoft Windows
Manufacturer: Microsoft Corporation


Interestingly, this only occurs when I am in browser mode in ACDSee. In
other words, if I click on an image file to open ACDSee, it opens fine and I
can even cycle from one pic to the next but the moment I switch over to
browser mode, it crashes.
This happens 100% of the time.

I also have been getting this error in Internet explorer. That is, IE casued
an error in Kernel32.dll. However, although this started happening around
the same time, it happens very infrequently.

This is what I have done to troubleshoot.
- Replaced Kernell32.dll and mmtask.tsk
- Repaired and then reinstalled IE 6.0
- Uninstalled ACDSee, then used JV16 Powertools and removed all registry
entries as well as do a registry clean.
- Reinstalled ACDSee - no change -error still occurs.
- cheacked for viruses and spyware

I have done several searches and trouble-shooting steps - obviously to no
avail. There is no new software signifcant enough installed that I might
suspect could be causing this nor did the sysmptoms suddenly appear after
installing said software.
There is no new hardware. This problem also occurs when the computer is
freshly turned on ( not an overheat).
I have the lastest video drivers installed. -Although i dont see how this
could be a driver problem as the PC has performed fine for many months (i.e.
ACDSee and IE ) under the same config. I have made no changes to the BIOS or
video settings or anything else to cause this problem.
I do have mcafee Pro 7.0 installed on the machine but I never load it except
on demand - have removed it from the start-up. Using an appswat program,
there is no evidence that Mcafee is running however, I did notice not to
long ago after installing a program ( a background monitoring program) that
Mcafee popped up a warning saying that this program was executing a script -
or something like that. I was surprised as I had never seen this message
before and I wasn't aware Mcafee was still monitoring.

Anyhow, the above steps might eliminate some possible causes.
Any other suggestions?
Thanks in advance!!

 

[MajBach1]

I recently realized that the error in IE6 occurs repeatedly at the same
websites and not others. In other words, doesn't appear to be random. These
would be those annoying websites (like porn) that ultimately come back from
a google search when trying to find something else. Maybe a script? I don't
now. This is an example:
http://60pictures.com/?id=loliza.com
THIS IS NOT SPAM FOR THE ABOVE WEBSITE. This is merely an example of a
website that causes a problem.
This is the error it gives from Dr.Watson:
Win32 Kernel core component performed an invalid memory access.

Module Name: KERNEL32.DLL
Description: Win32 Kernel core component
Version: 4.90.3000
Product: Microsoft(R) Windows(R) Millennium Operating System
Manufacturer: Microsoft Corporation

Application Name: Iexplore.exe
Description: Internet Explorer
Version: 6.00.2800.1106
Product: Microsoft® Windows® Operating System
Manufacturer: Microsoft Corporation

--------------------
If the Taskbar is behaving strangely, try exiting Multimedia background task
support module.

Module Name: mmtask.tsk
Description: Multimedia background task support module
Version: 4.90.3000
Product: Microsoft Windows
Manufacturer: Microsoft Corporation

 

[Mike Burgess]

That link contains a Trojan! (coolwebsearch)
This will infect unpatched machines automatically!
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid

 

[MajBach1]

Mike. Thanks for this warning.
Can I assume that I have a Trojan on my PC? How do I scan for/remove it?
How do I prevent it from happening again, i.e. security setting in IE or
third party software?

 

[Charlie Tame]

Try this lot for a start... sorry, it may take some time. I didn't see the
original link (I assume you posted) so I don't know what the problem is but
no doubt it is spyware. If it were left to me I might seriously injure the
people who do this <g>.
--
Interesting Article
http://www.pcmag.com/article2/0,4149,1524248,00.asp

Help Removing Parasites and AdWare
http://mvps.org/winhelp2002/unwanted.htm
http://www.mvps.org/sramesh2k/Defend_CWS.htm
www.lavasoftusa.com
http://security.kolla.de/index.php?lang=en&page=about
http://www.spywareguide.com/product_list_full.php

IE Won't work after removing spyware
http://www.cexx.org/lspfix.htm

More Secure ActiveX Settings
http://www.tames.net/security/activexsettings.htm

A Java Machine Problem
http://www.merijn.org/cwschronicles.html#byteverify

Even better browser security
http://www.staff.uiuc.edu/~ehowes/resource6.htm

Charlie

Mike. Thanks for this warning.
Can I assume that I have a Trojan on my PC? How do I scan for/remove it?
How do I prevent it from happening again, i.e. security setting in IE or
third party software?

That link contains a Trojan! (coolwebsearch)
This will infect unpatched machines automatically!
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid

 

[Don Varnau]

Hi,
Mike was warning that this link
http://60[break]pictures.com/?id=[break]loliza.com would download
coolwebsearch onto unpatched machines.

The IE problem could be parasite caused. Did you try Ad-aware and Spybot and
CWShredder? If those programs fail, you should use HijackThis to post a log
to the appropriate forum at
http://www.net-integration.net/forums.html
(HijackThis & Browser Hijacking)
or
http://forum.mvps.org
(Parasites - Adware, Spyware & Other Scumware)
or
http://www.computing.net/forums/
(security & virus)

Instructions and HijackThis download at
http://www.net-integration.net/tools/hijackthis.html

You should still be looking at any other program running in the background
and any add-on or program which might interact with IE.

Don

 

[Mike Burgess]

MajBach1,
How to remove Coolwebsearch and affiliates
http://mvps.org/winhelp2002/unwanted.htm#Coolwebsearch

Note: this type hijack indicates an unpatched machine, that is lacking
in "Defense". Please visit Windows Update to avoid these exploits.
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid
--

Mike. Thanks for this warning.
Can I assume that I have a Trojan on my PC? How do I scan for/remove it?
How do I prevent it from happening again, i.e. security setting in IE or
third party software?

That link contains a Trojan! (coolwebsearch)
This will infect unpatched machines automatically!
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid

 

[Mike Burgess]

Don,

Mike was warning that this link"

Exactly, the link contains a <IFrame> that leads to:
[<applet archive=arch.jar code=BlackBox.class]
http://securityresponse.symantec.com/avcenter/venc/data/trojan.byteverify.html
http://www3.ca.com/virusinfo/virus.aspx?ID=36725

MS patch info:
http://www.microsoft.com/technet/security/bulletin/MS03-011.asp
____________________________________________________________
Mike Burgess [MVP Windows Shell\User] http://www.mvps.org/winhelp2002/
Blocking Spyware, Adware, Parasites, Hijackers, Trojans, with a HOSTS file
http://www.mvps.org/winhelp2002/hosts.htm [updated 02-18-04]
Please post replies to this Newsgroup, email address is invalid
--

Hi,
Mike was warning that this link
http://60[break]pictures.com/?id=[break]loliza.com would download
coolwebsearch onto unpatched machines.

The IE problem could be parasite caused. Did you try Ad-aware and Spybot and
CWShredder? If those programs fail, you should use HijackThis to post a log
to the appropriate forum at
http://www.net-integration.net/forums.html
(HijackThis & Browser Hijacking)
or
http://forum.mvps.org
(Parasites - Adware, Spyware & Other Scumware)
or
http://www.computing.net/forums/
(security & virus)

Instructions and HijackThis download at
http://www.net-integration.net/tools/hijackthis.html

You should still be looking at any other program running in the background
and any add-on or program which might interact with IE.

Don
--
MVP IE/OE
Please reply to the newsgroup so that others may participate.

Mike. Thanks for this warning.
Can I assume that I have a Trojan on my PC? How do I scan for/remove it?
How do I prevent it from happening again, i.e. security setting in IE or
third party software?

 

[MajBach1]

Don, I did try those programs as well as hijack this. I have a lot of links
to sort through but if they do not help, I will take your advice regarding
posting the results of 'hijack this', in the appropriate forums.
Thanks

Hi,
Mike was warning that this link
http://60[break]pictures.com/?id=[break]loliza.com would download
coolwebsearch onto unpatched machines.

The IE problem could be parasite caused. Did you try Ad-aware and Spybot and
CWShredder? If those programs fail, you should use HijackThis to post a log
to the appropriate forum at
http://www.net-integration.net/forums.html
(HijackThis & Browser Hijacking)
or
http://forum.mvps.org
(Parasites - Adware, Spyware & Other Scumware)
or
http://www.computing.net/forums/
(security & virus)

Instructions and HijackThis download at
http://www.net-integration.net/tools/hijackthis.html

You should still be looking at any other program running in the background
and any add-on or program which might interact with IE.

Don
--
MVP IE/OE
Please reply to the newsgroup so that others may participate.

Mike. Thanks for this warning.
Can I assume that I have a Trojan on my PC? How do I scan for/remove it?
How do I prevent it from happening again, i.e. security setting in IE or
third party software?