kernel32.dll error? registry key error? ...what do you think?

Avast Free Antivirus / Premium Security
1

Hi there. Last week, whenever I would click on my Avast! tray icon, my computer would restart. When attempting to disable it from MSCONFIG it told me that I didn’t have administrator rights (even though I did) to disable it from starting up. I couldn’t uninstall it from the add/remove programs menu either. Eventually I did find a way to delete the main Avast! program files folder this week, but it wasn’t from the install/uninstall menu. I had to go into safe mode and delete the folder.

When I had the program “installed” (wasn’t working), I attempted to re-install the program through running the installer…and I still got the same error I’m about to tell you about now.

Here it is:

[b]avast.setup has encountered a problem and needs to close. We are sorry for the inconvenience.

If you were in the middle of something, the information you were working on might be lost. For more information about this error, click here.[/b]

I then click on the “here” part, and I get this:

AppName: avast.setup AppVer: 4.8.0.0 ModName: kernel32.dll
ModVer: 5.1.2600.3119 Offset: 00018943

Looks like kernel32.dll is corrupted. Is it?

I have since tried to run avclear, and it tells me:

The avast! self protection module is enabled. For this reason, the operation cannot be completed. To complete the operation, either run this program from Windows Safe Mode, or disable the avast! self protection (via Settings → Troubleshooting page).

I’ve gone through safe mode, and aswclear works(!) but it does tell me that everything will be deleted in the folder I choose…which is redundant because I’ve already deleted the folder that contained all the program files. So, aswclear is pointless for me to use.

I’m thinking that there’s a registry key that’s still there and working. So I went to regedit and found all the registry keys that are ‘avast’ and deleted them. Many were deleted, but these won’t be deleted at all – even in safe mode. They are:

Name: DeviceDesc Device Type: REG_SZ Data: avast! Network Shield Support
Name: DeviceDesc Device Type: REG_SZ Data: avast! iAVS4 Control Service
Name: Service Device Type: REG_SZ Data: avast! Antivirus

And, in the folder tree:

LEGACY_AVAST!_ANTIVIRUS
LEGACY_AVAST!_MAIL_SCANNER
LEGACY_AVAST!_WEB_SCANNER

Anyone got ideas?

Thanks!

2

I doubt that the kernel32.dll is corrupt as this is an essential system file and there would be much more going wrong (I would have thought). I would have just rebooted and done a manual update and see if that worked.

The aswclear does more than just clearing the program folder (as you are now finding) it if you didn’t or couldn’t use add remove programs, it will clear the registry keys and the files that aren’t in the avast4 program folder.

The Legacy Keys are actually controlled by windows I believe so I’m not sure if aswclear would get those, but it should get the others.

3

So…how would i used aswclear now that the folder has been deleted?

Adobe Illustrator CS3 was also giving me error messages associated with kernel32.dll; I uninstalled it as well.

And, please keep this in mind: when avast was ‘installed’ anytime I would click on the program icon in the systray or from the programs list, it would then restart my computer. There is no way I would have been able to update it. I did have my computer scanned from a network location (another computer on my home network scanned my drives) and nothing was found as far as a virus or adware/spyware.

If I am to use aswclear, how would I do it now that the program folder is gone?

Thanks for the help.

4

I don’t know if you would have to create an empty folder or simply tell it where it was, C:\Program Files\Alwil Software\Avast4 if you installed it in the default folder.

How would you know it was gone after running the aswclear, by physically checking in explorer that it was gone that is who.

Further to your original post, avast 4.8 has a self-defence module that would stop you messing with it in the msconfig, the same thing you found when trying to run aswclear when avast was running.

There would appear to have been something wrong with your installation from the start.
Have (or did) you another AV installed in this system, if so what was it and how did you get rid of it ?

5

Thanks for the help you’ve given, DavidR.

I re-created the folder, ran the aswclear.exe utility in safe mode, and restarted the computer. It said it worked when I ran it. But…I tried to run the installer program again, and no luck.

Oddly enough, I got a slightly different error message from the setupeng.exe installer program. It now reads:

AppName: avast.setup AppVer: 4.8.0.0 ModName: kernel32.dll
ModVer: 5.1.2600.2945 Offset: 00018943

The difference is the ‘ModVer: 5.1.2600.2945’ …it used to be ‘5.1.2600.3119’ so I have no idea what’s changed.

Remember: I deleted the original files and the folder it’s in, so I’m thinking that the aswclear.exe program won’t be able to find all the files it needs to delete. :frowning: Please let me know what else you can think of.

6

Well I would hazard a guess that you have just updated to XP SP3 ?
If not it may just be a recent windows update.

If so I believe that kernel32.dll has been updated and somehow it has become damaged/corrupt and that is why you are also seeing this error with other applications that have to use this dll.

The new error seems to relate to the XP SP2 version of windows 5.1.2600.2945, so it would appear that you may have two versions of this file on your system which would be very strange or you have been trying things like system restore of rolling back to an earlier version. This could account for the seemingly XP SP2 version number in the error.

This google search for 5.1.2600.3119, returns many hits http://www.google.co.uk/search?q=5.1.2600.3119 some of those also mention errors with kernel32.dll, so you aren’t alone. I suggest you take a look at some of the hits and see if there is a resolution.

You could also do a google search for 5.1.2600.2945 there are lots of hits on that.

7

DavidR,

This is very odd. I had XP2 then and I have XP2 now. I was actually thinking I should in fact have XP3 – then this might be updated. But, well, I didn’t upgrade to XP3.

Since I don’t have an antivirus program gulp on my system, I hesitate to surf anywhere else but here. Is there a patch or restore for kernel32.dll that you know of? One that I can click from this forum without going on sites that I’m not familiar with? I’m very cautious, now especially without avast! installed.

I’ve gone to the windows update (now microsoft update) site, and have clicked ‘express’ as well as ‘custom’…and I get the scan screen for about 10 minutes. It’s a hanging screen for that whole time. Nothing happens after that.

I have my automatic updates configured to notify, but not download or install them without my permission. When I have said that it would be fine to install updates, they can’t be installed. They can be downloaded, but not installed.

Ideas?

:frowning:

8

I would install avast pronto again (and leave the tray icon alone for the time being), if the only problem was that the update wasn’t working, you also said avast wasn’t working, but didn’t elaborate.

However you never answered my question about a previous AV ?

Whilst you might not have any great success as you really have to resolve the problem with kernel32.dll or it may never work as AVs work at kernel level in some functions. I’m not shure how you are going to do that, which was why I gave the google link in the hope that you might find a resolution.

I don’t even know if the latest patch Tuesday would have updated the kernel32.dll or not, http://www.microsoft.com/technet/security/bulletin/ms08-jun.mspx this might show what was set to be updated.

Other than that, the only thing I could suggest is see if System Restore will take you back to a restore point before time this first reared its ugly head. Unfortunately system restore is not infallible.

9

I’m assuming by
“I would install avast pronto again” that you mean ‘install avast right away’ – unless there is some odd version of avast called ‘avast pronto’… :slight_smile:

I’ll give the highlights of what I’ve done in a short-list format for you.
-All avast! software is gone.
-This means there is no tray icon; not a thing active that I know of.
-Avast was the only antivirus I’ve used; only one previous installation of it.
-I cannot use windows update; it only hangs when scanning my computer for appropriate updates.
-I cannot use microsoft update; it only hangs when scanning my computer for appropriate updates.
-I have been doing nothing more than trying to get avast! to install; this thread is about installation problems.

SO. I’ll try the link, but seeing as how my windows/microsoft update can only download things automatically but not install them, there is already a problem with the ‘updates’…let’s hope there is a way to install this microsoft.com update directly and successfully (without the windows update feature).

10

Yes, you’ve got it.

How did you uninstall it?
I suggest an installation from the scratch:

  1. Uninstall avast from Control Panel first.
  2. Boot.
  3. Download the latest version of Avast Uninstall and use it for complete uninstallation.
  4. Boot.
  5. Install again the latest avast! version.
  6. Boot.
  7. Check and post the results.
11

Yes I meant quickly as any protection is better than none, even if you can’t update for the time being, whilst you sort out the main problem.

Based on what you have done, I would say you should try the system restore if it hauls your a** out if the fire great if not you probably haven’t complicated the problem.

That link isn’t windows update but a location where information on the security updates can be viewed and also downloaded manually, saving them to your hard disk to install when off-line.

12

OK I have been having a rummage in the avast chest, System Files section, these are backups of important system files and not to be messed with, especially restored.

I found the latest version (date of Transfer to the chest, 3/July/2007 in my case) kernel32.dll and I extracted that (right click on the file in the chest) and saved it to a temporary location. I could now look at the file properties and that has a version number of 5.1.2600.3119, your original error number.

So I don’t know if that is an option to try and copy that the replace the one in the system32 folder. Even if windows would allow replacing the one in the system32 folder as it would be active. This is certainly a last resort measure and fraught with danger (backing up data that you don’t want to lose as a reinstall of windows isn’t out of the question) and would probably have to be done before windows boots and that isn’t easy if you aren’t comfortable working from a command prompt.

13

Tech,

Thanks for the interest in helping. Unfortunately, nothing you’ve said is new. I hate to have to go through what I’ve done so far, but I’ll repeat it all briefly here.

What I’ve done:
Avast! tray icon as well as the icon on the start menu – when clicked – would restart the computer. There was no ‘using the Avast program’ for anything. Couldn’t access it, it was useless.

SO…I originally tried to uninstall Avast! from the control panel, and it was unable to be uninstalled. I tried to disable the program from running in the systray through using msconfig; it told me I was not an ‘administrator’ and didn’t have rights (which, I really actually did).

As a result of these bizarre errors, I devised a work-around via safe mode and deleted the original files and the file folder. I eventually came here after that didn’t get rid of all traces of the program – didn’t know about ‘the uninstaller’ – and by the time I recreated the folder to use the uninstaller, the uninstaller was pointless. Throughout this process, I’ve tried to reinstall it, with no success. Error messages I’ve gotten in the past are written in BOLD in this thread. :slight_smile:

From what I’ve read here and throughout the internet, I believe the InstallShield is ‘broken’ and kernel32.dll is broken as well. Macrovision – now Acresso – has partnered with Adobe to put a series of programs that ‘validate’ the validity of Adobe CS3 licenses. Flexnet is a little program that messes up kernel32.exe and the InstallShield program through needing it for some monitoring/installing in the background. In other words, my kernel32.dll error is part of a messed up InstallShield. To add to this unfortunate series of events, Adobe also has installed ‘bonjour’ as part of a license verification protocol. Bonjour is a program made by Apple; it is crapware in my opinion. Adobe is quite rediculous. They do not give you notice that these things are being installed when you install their programs. The option to ‘not install it’ is not there. Bonjour, FlexNet, or any other monitoring service they include with their products are never mentioned to the user upon install.

I can install other programs that assumably use kernel32.dll but not InstallShield-based program installs.

Oh, and the avast error I’ve been getting? It’s now back to ‘5.1.2600.3119’… :slight_smile: I used the kernelupdater from InstallShield, so I believe that’s what happened to bring it back to that version.

14

Hi…

I have a hunch this isn’t an avast related problem, since the same error was repeated with another application. :frowning:

Try clicking on “Start”—>“Run” and then enter “chkdsk /r” in the white box minus the quotations. It will probably ask you if you want to start the scan after you reboot, click “yes.” This might fix the problem with the kernel file.

Apart from that, I could only suggest a system restore or reinstallation of XP from scratch. :frowning:

Best Regards…

15

I see no other way to solve that overinstalling avast correctly, restoring the files and the registry keys and correctly uninstall it after (if you need). Manual deleting of the files won’t uninstall avast for sure.

16

Since avast uses kernel32.dll and it is not an avast file, an over installation won’t resolve the problem, which is down to a problem with kernel32.dll

[b]avast.setup has encountered a problem and needs to close. We are sorry for the inconvenience.

If you were in the middle of something, the information you were working on might be lost. For more information about this error, click here.[/b]

I then click on the “here” part, and I get this:

AppName: avast.setup AppVer: 4.8.0.0 ModName: kernel32.dll
ModVer: 5.1.2600.3119 Offset: 00018943

So Confused has to first resolve the problem with kernel32.dll before avast will work correctly and be able to update, or any time it uses kernel32.dll, etc.

17

Thanks for the response(s). Anyone know where I can get a fresh, reliable copy of kernel32.dll? And, how do I install it safely after I get it?

18

I have told you were you can get a copy of kernel32.dll and one that is relative to your system (as that is where avast copied it from).

As to how to replace it I don’t know an easy way to do that certainly not whilst windows is running as the file would be in use and as such protected.

19

DavidR,

I followed your advice already and that’s why the error number had changed; it was the previous, undamaged version of kernel32.dll that was saved over the new version while in safe mode. When the kernelupdater program was run from microsoft, it changed the error number back to the most recent version of kernel32.dll. InstallShield is perhaps the culprit; I don’t know anymore.

20

Hi…

If you want to try reinstalling InstallShield to see if that will fix it, you can choose from these two versions…

http://www.microsoft.com/downloads/details.aspx?FamilyID=889482FC-5F56-4A38-B838-DE776FD4138C&displaylang=en

http://www.microsoft.com/downloads/details.aspx?familyid=5A58B56F-60B6-4412-95B9-54D056D6F9F4&displaylang=en

Hope this helps. :slight_smile:

Best Regards…