REGCLEAN

[mrblake50]

I have Regclean, when I try to use it, I get the following error message "Reg Clean has caused an error in Kernel32.DLL", what do I do? Am running Windows ME, tried to find regedit, not found. Thanks in advance for any help!!! Maureen

[Smitty]

Hi

Could you post the EXACT error message...Its relatively easy to upgrade/replace kernel32.dll but the message will help pinpoint your problem for the members here.





Smitty

[mrblake50]

Hi Smitty-"Regclean has caused an error in KERNEL32.DLL. Regclean will now close. If you continue to experience problems, try restarting your computer." That's the whole exact message, and yes, obviously I tried restarting my computer, that did not help, let me know what you think I should do! Thanks, Maureen

[Smitty]

Maureen

Your error message (ie. does not indicate an invalid page fault), plus the fact that "regedit.exe" has been deleted points strongly towards a virus. I hope I am mistaken..
-------------------------------------------------
From an Anti-virus site the following:
-----------------------------
VBS_STAGES.A
(continued from profile page)

In the wild: Yes
Payload 1: Deletes Files (deletes REGEDIT.EXE)
Trigger date 1: Any Day
Payload 2: Others (sends unsolicited messages via Outlook, Pirch and mIRC)
Trigger date 2: Any Day
Discovered: June 7, 2000
Detection available: June 10, 2000
Detected by pattern file#: 727 (note about pattern numbering)
Detected by scan engine#: 5.170
Language:
English
Platform: Windows
Encrypted: No
Size of virus: ~ 39,936 Bytes
-----------------------------
I haven't had an opportunity to read the remedies myself, and having so many other very experienced members at this site I think you will be better served by one of them. ie..reghakr, Mosaic, Simon, O'Brien, et al.

Until one of these fellows picks up this thread you could verify by navigating to this site and have a FREE scan on your computer. After answering yes to the prompt for a scan allow the download and tick off the drives you want scanned.

<a target="_blank" href=http://housecall.antivirus.com/>Click here to go to Housecall</a>

Post back with results..

The good news is...there is a removal tool at Symantec..! or you may not be infected...!

Smitty<P ID="edit"><FONT class="small">Edited by Smitty on 11/05/01 11:15.</FONT></P>

[mrblake50]

Hi Smitty! I went to the site you suggested, and the good news is I am virus free, now what do I do? Thanks, Maureen

[Smitty]

Maureen

Glad you don't have a virus. You have several options, the easiest being System Restore back to a date when your computer was working fine. Try this first. Its found at Start&gt;Programs&gt;Accessories&gt;System Tools&gt;System Restore..Try and pick a date when you did not have this problem..When computer restarts see if everything is OK. If so, then do you have regedit back? If not then:

WHERE did regedit.exe go? If you cannot find it with a search of your drive then see below to replace it. As for Regclean it can be downloaded and reinstalled anytime. See readme.txt file in the same folder regclean is installed in for locations. Since you don't have regedit.exe you cannot use UNDO.reg file restore. I would uninstall it using Add/Remove Programs in Control Panel.

REPLACE REGEDIT.EXE
--------------------------------------------------------------------------------
**You may need your WindowsME CDROM

Start&gt;Run&gt;type <font color=blue>MSCONFIG</font color=blue>, enter
Choose Extract File button
In box type <font color=blue>regedit.exe</font color=blue>, select Start
Type <font color=blue>C:\WINDOWS\OPTIONS\INSTALL</font color=blue> in Restore from bar
**If the above directory doesn't exist on your machine then its " E:\win9x\
Type <font color=blue>C:\Windows</font color=blue> in the Save file in bar, click OK
At the "file has been successfully extracted message", click OK
Close System Configuration Utility
This should provide you with Regedit.exe..my Version is 4.10.0.1998
--------------------------------------------------------------------------------

I would do this as the last step, check your version and size against mine. Right click file,choose properties
Mine... KERNEL32.DLL 524 KB (536,576 bytes) Version 4.90.0.3000 If different replace it. There are several different methods of replacing a system protected file. The following is just ONE.

REPLACE KERNEL32.DLL
--------------------------------------------------------------------------------
***You will need your Emergency Boot/Recovery Diskette

1. You should be able to use above process but Kernel32.dll may be in C:\WINDOWS\OPTIONS\INSTALL
**If the above directory doesn't exist on your machine then its " E:\win9x\
2. Extract it to C:\
3. Restart machine with Emergency Boot Disk
4. Select 4. 'Minimal Boot", enter
5. Type <font color=blue>C:</font color=blue>, enter
6. Type <font color=blue>copy c:\kernel32.dll c:\windows\system</font color=blue>, enter
7. Answer yes to replace message
8. Remove EMB diskette
9. Restart machine and see what's up
--------------------------------------------------------------------------------

If everything seems okay I would add a restore point via System Restore before I added any more programs or replaced Regclean..

Sorry for the long post but I really don't want to mislead you. Post back with problems or successes.

Regards

Smitty

[mrblake50]

Smitty, Sorry it took me so long to get back to you. It turned out the problem was that when I thought I was deleting regclean, I really deleted regedit. We did a system restore today and all is well again. Thanks so much for all the help, I really appreciate it!!! Maureen