BleepingComputer.com: Vsmon Illegal Operation And System Lock-up

I am running Windows 98; AVG antivirus updated on Friday, October 21, 2005; zone alarm free; and I occasionally scan with HijackThis, Spybot S&D, and / or Ad-aware. I am on a cable modem.

My computer has been working relatively well until this morning. It was left on overnight (which is common) and I think the Zonealarm internet lock was on (it usually is but I am not sure about last night). I came in to find the system locked up, which happens occasionally, and I hit Ctrl+Alt+Del. A box came up showing IE as not responding, and when I hit the end task program the screen went all white with a text box that read something to the effect of IE being corrupted and stating that I would have to uninstall / reinstall Windows. Hoping this was an odd error, and because there was no navigation buttons out of the white screen, I chose to restart.

I restarted manually by pushing the button below the power button. When the system restarted it went through the normal start up until the Windows background screen came up, and just before the taskbar and icons would have appeared I got the following error message:

Vsmon

This program has performed an illegal operation and will be shut down. Quit all programs, and then restart your computer. If the problem persists, contact the program vendor. (With Close and Details Buttons to side of this message.)

The details button gave the following information:

Vsmon caused an exception O3H in module KERNEL32.DLL at 016f:bff768al.
Registers:
EAX=c0030900 CS=016f EIP=bff768al EFLGS=00000246
EBX=00000000 SS=0177 ESP=007ebb8c EBP=007ebbb0
ECX=ffffffffl DS=0177 ESI=007ebf88 FS=26c7
EDX=00000000 ES=0177 EDI=007ebf90 GS=0000
Bytes at CS:EIP:
c3 cc cc 55 8b ec 56 57 68 c0 94 fc bf e8 01 d9
Stack dump:
0285326d 0285cadc 7fffffff 00003438 00000000
034ca00 00000000 007ebbb4 0354f024 007ebbdc
02853412 007ebc60 007ebcd8 034495c8 00000000
00000000

When I hit the close button the system continued startup as if everything was normal, however, after the icons all appeared on the screen, I essentially had no access to my system. The mouse pointer would move around but the mouse buttons do not respond. Ctrl+Alt+Del gives the close dialog box (eventually), and the box shows two programs as not responding (1) Msgsrv 32; and (2) VSMON. I can scroll within the close dialog box, but I have no control of the mouse buttons to end task or cancel. I essentially have no option that I am aware of except to restart. Every time I restart I get the same process as detailed above starting with the startup and Vsmon error message (but nothing about IE being corrupted). I think it is also worth noting that once the startup continues after closing the initial Vsmon error box, Zone Alarm does not load in the taskbar.

I have very little knowledge of starting and navigating in safe mode, and although I am a quick study, I am a complete novice at troubleshooting (in other words, I can follow directions but need some hand holding). I have never uninstalled, reinstalled windows on the problem machine and it is about seven years old. I have no problem doing that if it is the recommendation, however, I would like to backup data if possible and I would not know how to uninstall if I have no system control. Any help is greatly appreciated.

VSMON seems to be part of zonelab. Try uninstalling and then reinstalling zonelab.
Try a repair on Internet Explorer: Click on My Computer / Control Panel / Add/remove programs / Highlight Microsoft Internet Explorer / click on Add/remove. On a panel that opens choose Repair Internet Explorer / OK. You will have to restart after the repair is finished.
Update all anti-virus and spyware and run to make sure your system is clean. You can't run (or update) your security programmes often enough.
Hope all will then be well.

I started in safe mode. I did a virus scan and nothing was found. I then tried to uninstall ZoneAlarm, but it would not uninstall. I first got a Glba0d0 illegal operation message, and when I closed that box it tried to uninstall but i got the following sequence of errors:

Invalid VxD dynamic link call from VSDATA95(01) + 002FC3C to device “0028”, service 800A. Your windows configuration is invalid. Run the Windows Setup program again to correct this problem.

I pushed Y to continue:

Invalid VxD dynamic link call from VSDATA95(01) + 0002FD22 to device “0028”, service 8029. Your windows configuration is invalid. Run the Windows Setup program again to correct this problem.

I pushed Y to continue:

Another Invalid VxD

I pushed Y to continue:

A fatal exception OE has occurred at 0028:00000013. The current application will be terminated. Push any key to terminate …

I pushed space bar and system locked up to a black screen.

I then hit Ctrl+Alt+Del and got a close program box with Vsmon not responding. I ended the task and it returned me to windows safe mode and attempted to complete the uninstall of Zonealarm, but then it gave me the familiar Vsmon illegal operation error message. I hit the close button, and it tried to uninstall again and again gave me the Vsmon illegal operation error message. I hit close button again and the Zonealarm uninstall panel came up, but when I hit uninstall, I got a Glb61 illegal operation error message. I closed that box and it then returned me to the Windows Safe mode with no uninstall operation in progress.

I then tried uninstall again and it immediately went to the Vsmon illegal operation box.

AAAAAAAAAACCCCCCCCKKKKKKKKK.

I also tried to repair IE as suggested. When I went to Add/Remove programs, the window that should have listed all the software that could be "automatically removed" was blank. In other words, there was no IE for me to highlight and repair, or any other program for that matter. Is this typical in Safe Mode, or is it a possible symptom of my problems?

Any additional suggestions?

It sounds like ZoneAlarm is corrupted. If you can boot to safe mode, press Ctrl+Alt+Del to bring up the Close Program box and End task on ZoneAlarm, vsmon or vsdata, anything that looks like ZoneAlarm. Then follow these instructions: (You really don't need to do #1 thru 8 if already in safe mode)

============
Windows 98*Grinler ============
01.) Click Start, Run
02.) In the Run box type in MSConfig
03.) Click OK
04.) Click the Advanced Button
05.) Place a check in Enable Startup Menu
06.) Click OK, then OK again
07.) Restart your computer
08.) Upon restart choose Safe Mode off the menu by using the arrow keys
on the
keyboard and pressing Enter
09.) Once in Safe Mode close the help and support screen
10.) Double Click My Computer
11.) Click View, Folder Options, View Tab
12.) Place a dot next to "Show Hidden Files and Folders" or Show All Files
13.) Remove the check from "Hide Protected Operating System Files
(Recommended)"
14.) Choose Yes to the warning
15.) Click OK
16.) Double click "C:"

Note: In the future steps if you do not see any files or folders, please click
the
"Show Files" link to view them.

17.) Double Click the Program Files Folder
18.) Right Click the Zone Labs Folder, click Delete, and choose Yes
19.) Close this window
20.) Click Start, My Computer
21.) Double Click the C:
22.) Double Click the Windows Folder
23.) Right Click the Internet Logs Folder, click Delete, and choose Yes
24.) Double Click the System Folder
25.) Click View, Details
26.) Right Click the Zone Labs Folder, click Delete, and choose Yes
27.) Right Click the file VSData95.VxD, click Delete, and choose Yes
28.) Right Click the file VSUtil.dll, click Delete, and choose Yes
29.) Right Click the file VSInit.dll, click Delete, and choose Yes
30.) Close this window
31.) Click Start, Run
32.) In the Run box type in RegEdit
33.) Click OK
34.) Click the + next to HKEY_LOCAL_MACHINE
35.) Click the + next to SYSTEM
36.) Click the + next to CurrentControlSet
37.) Click the + next to Services
38.) Click the + next to VxD
39.) Highlight the "VSData95" folder
40.) Press Delete, click Yes
41.) close the registry Editor
42.) Click Start, Run
43.) In the Run box type in MSConfig
44.) Click OK
45.) Click the Advanced Button
46.) Remove check in Enable Startup Menu
47.) Click OK, then OK again
48.) Restart your computer

I am down to items number 38 and 39, but I don't have a VSData95 folder. The only folder close to that is a VSD folder. When I highlight that folder it brings up name and data columns and three "files" that look like little torn pieces of paper. The first "file" is named ab(Default) and the data is (Value not set); the second is named Start and has two symbols that look kinda like stick figures (one right side up and the other upside down) on the paper and the data is 00; and the last is ab StaticVxD and the data is "VSD".

I don't want to do anything to this file until I know if it is what I should delete, or I don't want to ignore 38/39 until you verify. Maybe VSData95 is already deleted because of step 27?

Thanks for your help so far.

That is something else entirely. If its not there don't worry about it.

If you are comfortable in the registry go to Edit and Find and type in VSData95 and delete it wherever it exists.