Karl`s PC Help Forums

Kernel32x.SYS
minlee - 18-4-2008 at 20:33

I have a problem with my Windows-XP notebook.
My notebook shuts down
after the errow message saying that
Your system is unstable.
... Kernel32x.SYS ... Windows has been shut down buggy...

Could you help me fix the problem?
Here let me attach the logfile from hijackthis.


LSemmens - 19-4-2008 at 11:44

Hi minlee, our resident expert Pancake, like me, resides in Oz, so may not see this for a day or so. At the head of this forum, he has pasted a comprehensive list of things to do to help you resolve the issue. Have a look here:http://www.karlsforums.com/forums/viewthread.php?tid=34905


Andre - 20-4-2008 at 00:45

I have the same problem as Minlee. Am at my wit's end with this. What is the solution? I have tried everything within my limited abilities and knowledge.


Pancake - 20-4-2008 at 03:45

Hi ninlee.
Looks like you have a small infection that need to come out...


Ok.We need to download ComboFix.exe. This will give a better view to the files running and also hidden on your computer.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix Please visit this webpage for download links, and instructions for running ComboFix


When the tool is finished, it will produce a report for you. Please copy and paste the "C:ComboFix.txt" along with a new 'HijackThis' log so that we can continue to do any further cleaning that your system may require.

Caution: Never run and remove files with Combofix unless supervised by a security analyst

NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.


Pancake - 20-4-2008 at 03:49

Quote:
Originally posted by Andre
I have the same problem as Minlee. Am at my wit's end with this. What is the solution? I have tried everything within my limited abilities and knowledge.


Please post in a seperate thread and I will have a look for you.


Please download HijackThis to your desktop..

http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
Alternate link
http://download.bleepingcomputer.com/hijackthis/HJTInstall.exe

This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:Program FilesTrend MicroHijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:Program FilesTrend MicroHijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.


minlee - 21-4-2008 at 03:11

Quote:
Originally posted by Pancake
Hi ninlee.
Looks like you have a small infection that need to come out...


Ok.We need to download ComboFix.exe. This will give a better view to the files running and also hidden on your computer.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix Please visit this webpage for download links, and instructions for running ComboFix


When the tool is finished, it will produce a report for you. Please copy and paste the "C:ComboFix.txt" along with a new 'HijackThis' log so that we can continue to do any further cleaning that your system may require.

Caution: Never run and remove files with Combofix unless supervised by a security analyst

NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.



Hi, Pancake! Thank you for your reply.
I have done what you said. Here let me attach a new log file of hijackthis with combofix log file added.
Your suggestion to fix the problem would be appreciated.


Pancake - 21-4-2008 at 03:40

This should fix your problem.

Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.


C:WINDOWSsystem32.f88175cff88175cf.core.dll

Reboot...

========================

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Quote:


Killall::

File::
C:WINDOWSsystem32psqlpwd.dll
C:WINDOWSsystem32qpmjskla.dll

Registry::
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifypsfus]
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyqpmjskla]




Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


[bad img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/bad img]

Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your compter*


minlee - 21-4-2008 at 15:23

Quote:
Originally posted by Pancake
This should fix your problem.

Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.


C:WINDOWSsystem32.f88175cff88175cf.core.dll

Reboot...

========================

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Quote:


Killall::

File::
C:WINDOWSsystem32psqlpwd.dll
C:WINDOWSsystem32qpmjskla.dll

Registry::
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifypsfus]
[-HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwinlogonnotifyqpmjskla]




Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


[bad img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/bad img]

Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your compter*



Thanks for your help.
I couldn't find from hijackthis, C:WINDOWSsystem32.f88175cff88175cf.core.dll
But I made CFScript.txt so I run combofix.
Let me attach a new hijackthis log file with combofix log.
I'm not sure yet if the problem has been solved so I should check.


Pancake - 21-4-2008 at 22:23

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Quote:


Killall::

Folder::
C:WINDOWSsystem32.f88175cf



Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


[bad img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/bad img]

Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your compter*