TechSpot

Win32K.sys error w/ service executable dialogue boxes

By BillCE
Jul 6, 2009
  1. Attachment of Requested Logs:
    1.MBAM
    2.SAS
    3.HJT
     
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    You're running Windows Live Oncare for the AV and firewall.

    You also have a process for a-squared. I suggest you uninstall:
    C\Program Files\a-squared Free\a2service.exe

    Please give us some information of where you saw this: Win32K.sys error w/ service executable dialogue boxes

    And what problems you are experiencing on the system. I'd like to see a log from scan with AV please.

    Mbam and SAS are clean. The only thing in the HijackThis log that peeks my interest are these 4 entries:
    is a part of the Microsoft Doctor Watson error reporting tool which comes packaged with some Microsoft products

    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe

    Bottom line> need more information.
     
  3. BillCE

    BillCE TS Rookie Topic Starter

    Win32K.sys Error w/ Serc Execut Dialogue Boxes

    Bobbye,
    This is what came up on one of the many Dialogue Boxes since this problem began...
    I tried a 6.6.2009 Restore date & not successful..
    I followed all 8 steps...
    Still getting Serv Executa D Boxes all the time now when try to Browse in IE7.
    When I scan AV in Windows One Cra it says No Issues...
    Won't let me copy a 'log file for you to see' Sorry...
    Any other ideas.. I have spent 8 Hours now on this Box..
    Bill & thanx for your reply I do appreciate it...
     
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Bill, I really need for you to explain just exactly what you are seeing: Is it this:

    IF that is the case, you need to find out what this service is associated with:
    Click on Start> Run> services.msc>
    Click on services find the one you are having problems with and post the description here.

    I have read that this is sometimes associated with windows Live OneCare.

    Checking the Event Viewer might show: Stop: 0x0000008E & win32k.sys Error:

    This problem has been identified as a problem with ATI Catalyst Control Center 7.3.

    If this could apply to you, please go to: http://support.amd.com/us/Pages/AMDSupportHub.aspx

    I tried to get the info but have to plug in specifics for the system which I don't have. I saw a hot fix but the link given wasn't good.
     
  5. BillCE

    BillCE TS Rookie Topic Starter

    Service Executable has encountered a Problem and needs to close

    Bobbye,
    Thank you for your patience. I thought yall would have seen this issue prior. This has been prevalent on Internet for some time...My Chipset is Intel so the theory of AMD is not logical here. Good thought though. These Dialogue Boxes come up as I Browse using Internet Explorer 7.0.. All My Services are started; I checked them all jus now...
    One of the executables involved is MsMpEng.exe.
    I do run XP and Ult Vista through a KVM switch. Prior this has NOT been a problem.
    Both OS's have worked flawlessly...
    I use SAS MBAM & CC Cleaner all the time...
    My hypothesis is to Uninstall One Care Live and Load Avast for now.. Trying to diagnose litlle at a time..
    I truly think is issue is coming from 'outside' if you know what I mean.
    Thank you all agin for your tireless help... My Pere to Peer Netowrk (8 Nodes) usually runs flawlessly, i.e I have Mac's & PC's Laps and workstations ...Quite a connundrum, indeed Any help is truly appreciated. Thanks Bill MCSE MCP+i MCP
     
  6. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Bill, msmpeng.exe or msmpeng process info for Microsoft Windows Defender Antispyware.

    Windows Defender is built in to Windows Live OneCare. So by removing One Care and using Avast instead resolve at least part of that problem.

    The P2P will continue to be a threat and make the system vulnerabilities. i would still like to see an AV log. Can you try to run the Eset online scan? How about Eset Nod32 online scan with log?
    Run Eset NOD32 Online AntiVirus Scanner HERE

    Note: You will need to use Internet Explorer for this scan.
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the Active X control to install
    • Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    • Click Start
    • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    • Click Scan
    • Wait for the scan to finish
    • Re-enable your Antivirus software.
    • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
     
  7. BillCE

    BillCE TS Rookie Topic Starter

    Log File after ESET NOD32 Scan...

    View attachment 50455
    Bobbye,
    Here is ESET AV Scan...
    I am re-enabling Avast presently...
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Okay, scan is clean. I have questions and answers-or suggestions.

    MsMpEng.exe. is a process that originally was in Windows Defender Antispyware. It was known to cause problems then. And now that Windows One Care is out, users are finding that problem is still turning up.

    First, if you have not done it already, download Avast if that's the AV you want to use> save it to your desktop. Don't run it yet:

    Please reopen the HijackThis log to 'do system scan only.'
    Check each of the following if present. Note: Don't click on Fix Checked until you have checked them all

    C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
    C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
    C:\Program Files\Microsoft Windows OneCare Live\winss.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe
    O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe


    Close all Windows except HijackThis and click on 'Fix Checked.'


    Boot into Safe Mode> Set the system to Work Offline

    Start> Run> type in msconfig> enter> Selective Startup> Startup tab> UNCHECK the Windows OneCare entries:
    OcHealthMon.exe
    winssnotify.exe
    msfwsvc.exe
    Also uncheck WinCinemaMgr.exe
    Apply> OK

    Control Panel> Add/Remove Programs> UNINSTALL the Windows One Care entries.

    Start> Run> type in services.msc> double click on a2service> change Startup type to Manual.

    Double click the Avast setup on the desktop to run/install.

    Reboot into Normal Mode. Note: ignore the nag message and close it after checking 'don't show this message again.' Stay in Selective Startup.

    See if this resolves the problem. If it does not:
    Do the Error Check
    Run the System FileChecker.

    I have 2 more steps if the above doesn't handle it. From what I read, this continues to be an ongoing 'bug' because it's dependent on the system configurations and users have different configurations- at least that's the excuse Ms is currently using.

    BTW, several people found the Win32.sys problem was being caused by the Logitech Quick Cam. Changing the Service for LVPrcSrv.exe resolved it!.

    Edit: Remind me to remind you to empty the Recycle Bin!
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...