System Safety Monitor (SSM) v2.0.8.583 Conflicts ?

[herbalist]

Prozactive,

Thanks for posting the setup that you had when you tried SSM and KEX.

If 585 crashes, the bug that appeared in 584 wasn't fixed. There's nothing in 585 that makes any significant improvement when used on 9X systems that I can see.

I was planning to uninstall KernelEx first and install SSM and then put KernelEx back on ... herbalist (Rick) was a little vague (at least to me) on all that. He didn't seem to have much trouble either way on the virtual machine.

On Virtual PC SSM and KEX had issues no matter which was installed first. Disabling KEX for the SSM executable seems to solve it. On a real Pentium 4 PC, SSM and KEX get along fine, at least they do on mine. I'm not certain of it, but I think Connectix Virtual PC simulates a Pentium II, but the speed rating seems to be inherited from the hosts processor.

The 2.4 versions have no chance of running on 98, even with KernelEX. They were designed from the ground up for NT architecture.

I'm in the process of rebuilding 2 other PCs for testing and will probably also temporarily switch over my old HP for this as well. One is a Compaq P3-866mhz, 128MB RAM The other is a Gateway P2-266mhz, 384MB RAM. The rest of the details I don't know yet. I'm going to put basic but fully updated 98 systems on both and see how well KEX and SSM get along on these units. The P3 is almost ready for an OS. The others will take a bit longer.

[PROBLEMCHYLD]

If 585 crashes, the bug that appeared in 584 wasn't fixed. There's nothing in 585 that makes any significant improvement when used on 9X systems that I can see.

No need to updated from 583 to 585. You are right the only thing changed was languages.

[herbalist]

I just installed 2.0.8.585 on the 98 system of my primary PC. This version is not stable on 98. Opening the SSM interface consistently causes a BSOD, after which SSM crashes. This is not KernelEx related. Version 585 will randomly crash on 98 whether KEX is present or not. Version 2.0.8.583 is the last stable version for 98.

The links in my post at the beginning of this thread still work. Those are the last reliable versions.

Rick

[Monroe]

herbalist ... OK, yesterday I finally put SSM v2.0.8.583 back on two of my notebooks. Started brand new with putting my Ghost backup (from late December) on each computer. So far everything going good ... for the first few hours I let it run in the Learning Mode ... seems to make it a bit easier. Now I just have a quick question about those "freaking global hook" decisions ... I am never sure what to do about those things, I always just give permission or some things just don't open up. I thought I had some information posted by you on the global hooks subject but I can't seem to find it in any of my folders. Without going in too deep on global hooks ... I'm waiting for your tutorial one day, when you can fit it to the schedule ... back to the global hook thing, is there one program or area that a person should be real careful when giving permission to allowing global hooks to proceed? ... I'm thinking when I hear the term "global hooks", that there is something out there spreading around in cyberspace that might connect somewhere and bring something back into my computer. The term "global hooks" itself is kind of worrisome. ... thanks

[Prozactive]

duffy98,

You asked this same question about global hooks a while back and Rick/herbalist answered it FYI.

Edited February 14, 2011 by Prozactive

[Monroe]

Thanks Prozactive ... I was positive I had asked herbalist some global hook questions and he had responded but I couldn't come up with the thread. I thought he might post a link but you did. I thought I had also copied what he posted for future reference but I have the information now. ... thanks again for pointing me in the right direction.

Edited February 14, 2011 by duffy98

[herbalist]

In themselves, hooks are not good or malicious. They're a normal system function. Like any other system function, it's how they're used that decides if they're malicious. Linux enthusiasts are used to them. Most Windows users first learned of hooks from the commercial security-ware industry, which hyped all the potential malicious uses for them to scare the hell out of the average user, then promote their wares that can intercept this "new threat". They've been there all along but Windows users weren't aware of them. Compared to 98, XP uses a lot more of them. In over-simplified terms, hooks are a way to send/receive information from one thread to another or for one process to monitor/control another in specific ways. AntiViruses depend on them heavily.

The main thing to watch with hooks is what process wants to set it. Malware has to execute before it can set hooks. When it does, it's a way for that malicious process to inject its code into a legitimate one. Explorer.exe is a common target. Iexplore.exe is another. Most of the prompts you'll see are legitimate system components hooking other system components. If the target files are legitimate and the process doing the hooking is too, they're probably necessary.

[herbalist]

I just finished the first round of testing SSM compatibility with KernelEX on the hardware I had available.

The first PC is a Compaq with Pentium3-866mhz, an i815/E/EP chipset and 128MB RAM.

The OS is Lite 98SE (no Internet Explorer) with all the required drivers and the following upgrades:

SESP2.1a

RP9.7.2

Unofficial Shell32.DLL fix

Unofficial 2-4GB Kernel32.dll fix

Enable 48bitLBA fix for >137GB drives

NUSB 3.3e

Copy 2GB fix

Ttf pak

Additional software:

TestRun 2.12

Kerio 2.1.5

7Zip

SSM 2.0.8.583

When the configuring was done and the PC was running properly, I installed KernelEX 4.5final, enabled it for all applications, and rebooted.

After restarting, attempting to open the Kerio status screen from the tray icon resulted in an illegal operation error message. invalid page fault in module <unknown> 0000:9eff03ae

Attempting to open Kerio's help file from the tray menu gave this error: KDSE.DLL Exception Occurred (address 0x9EFF03AE, exception code: 0xC0000005)- firewall driver interface will be closed.

If SSM is shut down and the start button is then pressed, the resulting error message is:

Explorer caused an invalid page fault in module <unknown>0000:9eff049c

These errors are all repeatable. If "disable KernelEx extensions" is selected for SysSafe.exe, the error messages disappear.

The 2nd PC is my old workhorse, an HP Pavilion 4463, running 98FE. CPU-Z identifies its processor as an Intel Celeron , 366mhz. System information identifies it as a Pentium 2, MMX. I'd have to completely dismantle the unit to physically verify which it is. The chipset is an i440BX/ZX. The unit has 160MB RAM.

The upgrades and software installs are far too numerous to list. It does not have Revolutions Pack and KEX wasn't installed prior to the testing.

I installed KEX, selected enabled by default, and restarted the PC.

The actions that triggered error messages on the 98SE Compaq unit caused the exact same error messages on the 98FE HP unit. On both of them, disabling KernelEx extensions for SysSafe.exe eliminated the errors.

These are the same results I obtained on a virtual 98SE unit, built on Connectix VirtualPC 5.1 build 370. CPU-Z gives no chipset information when run on the virtual system. The processor information it displays appears to be that of the host PC. The only information I can obtain regarding what chipset VPC simulates comes from Belarc Advisor. It identifies the virtual PCI Bus Master IDE Controller as an 82371AB/EB.

My present PC, a Dell Optiplex GX260 with a Pentium 4-2.4GHZ and 1GB RAM uses the i845G chipset. It has the same group of upgrades used on the test PCs except that it's had several versions of KEX installed. On this PC, there's no conflict between KEX and SSM. When I can, I'll swap drives in the Dell and build another 98SE test system using the same setup as the test units in order to see if the lack of a conflict on this PC is repeatable. At present, it appears that how well KEX and SSM get along on the default KEX settings is dependent on the chipset, or possibly other installed drivers. Except for drivers and some installed software on the primary PC, these units are equipped very similar. As soon as I can, I'll repeat the tests with all PCI cards removed and as few installed drivers and updates as possible.

[Monroe]

Rick ... ran into major problems with SSM and another media player and also the explorer thing. When I first mentioned to you about Media Player Classic conflicting with SSM several years back, you were able to confirm that. Well, when there seem to be no work around or fix for the problem, I just took MPC off my computer and hunted around a bit and found KM Player. Really like that player ... anyway I had no problem on the computers on Sunday after I installed SSM on two of them. Yesterday I finally got around to opening KM Player and a box popped up labeled "Prpcui" saying "has performed an illegal operation" ... the whole computer freezes and I have a hard shutdown ... did the same thing twice on me ... then the "explorer" problem started popping up and I can't get past the "Start" tab to shut the computer down. I am using an older version of KM Player, the last to work with Win 98SE before they dropped 9x altogether. I had KernelEx already installed and then I installed SSM on Sunday. I put everything to heavy use and there were no warning boxes popping up ... everything seem to working just fine until Monday when I decided to open KM Player. I have taken SSM off for now ... when I restarted the computer after the hard shut down sometimes there were warning boxes popping up immediately. Just thought I would fill you in ... these crazy "media players" seem to conflict with SSM. ... as I said, I like KM Player ... it IDs all your audio and video files ... if you have a folder with avi, mkv, mp4 or other files ... it tells you what each file is so you don't have to right click Properties to see what file is what. Really hate to abandon KM player ... VLN just has the orange cones but doesn't tell you what a file is exactly until you right click on Properties. ... well, anyway ... thought it was the real thing this time. If anyone knows of another media player that Ids all your files so you know right away ... what is what ... let me know and I will try it with SSM.

Edited February 15, 2011 by duffy98

[herbalist]

Which version of KMPlayer are you using? I'm trying 3.0.0.1439 and can't get it to work, even with KernelEX.

The error I get is:

The KMPLAYER.EXE file is linked to missing export KERNEL32.DLL: GetVolumeNameForVolumeMountPointA

[Monroe]

OK ... I am not 100% sure what version I have on my computers ... when I go into KM Player and go to About, the version is 5 question marks (?????) but I do have the version number on the KM Player folder on a CD at home. I have a media software backup CD with different Media programs and Codec downloads stored on it. I can't check that out till later tonight. However, I think it might be KMPlayer 2.9.3.1428 ... it would be the last version listed as working with Windows (All) and File Hippo has that as KMPlayer 2.9.3.1428 ... that seems to be in my head that that could be the version ... it is from May 07,2008.

http://www.filehippo.com/download_kmplayer/tech/4120/

The very next version has dropped the Windows (All) label ... but as I said earlier, I am not 100% sure that is the version. I was able to get a newer KM Player version to work in Dec with KernelEx set to Windows XP SP2 and everything seemed to work OK ... but I need to test all that out some more. I didn't post anything at the KernelEx thread about it, I wanted to work with it some more but at that time I didn't have SSM installed on my computer. ... thanks

.... UPDATE: I just had a "brainstorm" a few minutes after posting this ... I went to the KM folder on my computer and right clicked on the KMPLAYER.EXE ... the version tab in Properties shows that it is v2.9.3.1428. Sometimes that doesn't always work but the KM Player version is there.

Edited February 16, 2011 by duffy98

[Prozactive]

@duffy98:

Glad it helped. I clearly remembered you asking that question before as I was also puzzled by the global hooks issue with SSM.

@herbalist:

Thanks as always for your thorough technical investigation of this conflict(s) between KernelEx and SSM. It looks like you've successfully duplicated the error that I experienced immediately after installing SSM for the first time. As I believe I stated in an earlier post, I got the exact same error with EXPLORER that you did as I clicked on the Start menu:

EXPLORER caused an invalid page fault in

module <unknown> at 0000:9eff049c.

And while I also have Kerio 2.1.5 installed (per your strong recommendation), I did not experience the errors associated with it that you cited, probably because the previous errors occurred so quickly after installing SSM that I immediately disabled the associated KernelEx extensions.

It certainly does sound like the conflict/errors are chipset-dependent. FWIW, I had to disassemble my laptop recently for some hardware repairs and I physically verified that I have the Intel 440ZX chipset, which apparently is a cut-back version of the 440BX chipset. And while I've never used them, apparently many virtual systems use the 440BX chipset in their emulation as a result of its broad compatibility. I still have not tested enabling KernelEx extensions for SSM on my desktop PC (which uses completely different chipsets) but when I do so I'll report back with the results.

[herbalist]

Duffy98.

I tried the version of KMplayer you posted the link for. On my primary PC, (98SELite) it did nothing at all. When I switched to an image with IE6 and all the updates for it, SSM and KMplayer conflicted badly. Almost every running process crashed. Media players do seem to be a problem. On mine, I use an old version of WinAmp for audio, WMP for video, and a freestanding flash player. Other than listening to music, I don't get a lot of use out of media players. Fortunately there are quite a few more to try.

[Monroe]

herbalist,

Thanks for the KMPlayer information. What version of WMP are you using? I have just the older 6.4 with some updates installed. I did open that version and nothing seem to conflict with it and SSM. I have downloaded two new media players ... they still list Windows (All) and they aren't that old. ... Jan 2011 and Nov 2010 ... BSPlayer and GOM Player ... will see how these two work with SSM and report back ... maybe over the week-end.

Update ... Not much luck with those media players ... BSPlayer is not for Windows 9x, even though it says "Windows All", still wouldn't install with KernelEx changed to Win XP SP3 and GOM Player installs OK but doesn't seem to play videos as well as KM Player. I put KM Player back on and will leave all this SSM stuff for another day. Just looks like SSM will have conflicts with some newer programs.

Edited February 17, 2011 by duffy98

[Foxbat]

The last version of BS.Player that supported Win98SE was 2.43.1008.

Unfortunately, many software developers use "Windows all" as their OS requirement, even though they usually mean Windows 2000 and above. Are they aware of how many OSs they're skipping in using that statement? Windows 1, 2, 3, NT, 95, 98, ME, CE, Mobile, etc? They might as well say "Bill's OS".