TechSpot

Win32k.sys Problem

By Josho495
Feb 12, 2009
  1. Lately I've been getting frequent BSOD caused by win32k.sys

    These restarts have been happening randomly... while on the net or playing a game.

    Here is a list of my specs.

    Windows: Windows XP5.1 (Build 2600) Service Pack 3
    Internet Explorer: 7.0.5730.13
    Memory (RAM): 2815 MB
    CPU Info: Intel® Core™2 Extreme CPU Q6850 @ 3.00GHz
    CPU Speed: 2956.8 MHz
    Sound card: SB X-Fi Audio [8C00]
    Display Adapters: NVIDIA GeForce 8800 Ultra | NVIDIA GeForce 8800 Ultra | NetMeeting driver | RDPDD Chained DD
    Monitors: 1
    Screen Resolution: 1680 X 1050 - 32 bit
    Network: Network Present
    Network Adapters: NVIDIA nForce Networking Controller #2 - Packet Scheduler Miniport
    CD / DVD Drives: E: ASUS DRW-1814BLT | F: TAZWH T2JCX63
    COM Ports: COM1
    LPT Ports: NOT Present
    Mouse: 3 Button Wheel Mouse Present
    Hard Disks: C: 465.8GB | D: 465.8GB
    Hard Disks - Free: C: 205.2GB | D: 117.5GB
    USB Controllers: 2 host controllers.
    Firewire (1394): 1 host controllers.
    PCMCIA (Laptops): Not Installed
    Manufacturer: Phoenix Technologies, LTD
    Product Make: 122-CK-NF68
    AC Power Status: OnLine
    BIOS Info: AT/AT COMPATIBLE | 09/28/07 | Nvidia - 42302e31
    Time Zone: E. Australia Standard Time
    Battery: No Battery
    Motherboard: EVGA 122-CK-NF68
    Modem: Nokia N95 USB Modem

    :


    I had this problem previously and I bought new ram thinking it would solve it but to no avail.

    Any help appreciated!
     
  2. mflynn

    mflynn TS Rookie Posts: 2,655

    Start here!

    Do the TechSpot 8 steps: http://www.techspot.com/vb/topic58138.html

    Skip no steps (do not install another virus scanner if you already have one, ask me before installing a Firewall).

    Most importantly update MalwareBytes and SuperAntiSptware!

    Mike
     
  3. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    Thanks boss!

    I'm using the Windows Firewall and NOD32 AV.

    That's ok?
     
  4. mflynn

    mflynn TS Rookie Posts: 2,655

    Thats OK but turn off/disable NOD while doing the 8 Steps!

    Mike
     
  5. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    I've followed the 8 steps.

    Here is my hijack log
    Malwarebytes Anti Malware log
    SuperAntiSpyware log

    Hopefully this can explain something.

    I didn't mention in the original post , IE and Firefox is consistently crashing.

    Cheers
     
  6. mflynn

    mflynn TS Rookie Posts: 2,655

    Good morning Josh

    Run HJT Scan only select and remove the entry below
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    These logs were clean, did you run these other times before this?

    Do the below

    Update then run SAS
    Click Preferences-Repairs
    Then counting down from top do the following entries

    Numbers 6, 8, 11, 12, 13, 15,18, 19, 20, 21, 22, 24, 25, 26 and 27!

    Then...

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.
    =========================================
    Download ComboFix

    NOTE: If you have had ComboFix more than a few days old delete and re-download.

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    Install Recovery Console if connected to the Internet!

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Reboot test the issues and report back status!

    Mike
     
  7. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    Thanks for all your help.

    Attached is the SD Fix Report, ComboFix Report & the new HJ Log.

    Cheers.

    Thanks again.

    PS. When in Safe Mode completing the SDFix step, during the process the following message appear several times.

    "The file or directory c:\$Mft is corrupt & unreadable. Please run the Chkdsk utility"
     
  8. mflynn

    mflynn TS Rookie Posts: 2,655

    Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

    Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

    KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
    Fantastic cleaner.

    Reboot here before continuing.

    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.

    Reboot and try to incur a win32k.sys to see if improved.

    Also for the error reported by SDFix. Do this..

    Start-Run
    type
    chkdsk /r
    enter or ok

    It will want exclusive access and ask to do it on next boot, so reboot.

    Then run SDfix again from Safe mode to confirm error is gone.

    Mike
     
  9. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    When do I use the KCleaner? Before I create the system restore?
     
  10. mflynn

    mflynn TS Rookie Posts: 2,655

    Yes in the order presented!

    Mike
     
  11. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    Good morning Mike,

    Thanks again for everything. I greatly appreciate it. Thought I was going to have to format.

    I fell asleep last night completing the chkdsk /r utility hence the late reply.

    This morning I ran SDFix again.

    Things look back to normal but will see if anything comes up.

    Firefox and IE haven't closed at all yet which are good signs.

    I'll keep you posted.

    Josh
     
  12. mflynn

    mflynn TS Rookie Posts: 2,655

    Just run SDFix again so I can confirm a clean log!

    Mike
     
  13. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    Attached logs:

    SDFix
    Combo Fix
     
  14. mflynn

    mflynn TS Rookie Posts: 2,655

    Ok now I am satisfied!

    Thread closing-------------------------------------------------------------------

    Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

    Remove ComboFix
    Start-Run
    type
    combofix /u
    Hit enter or click OK.

    Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

    Save to desktop.

    This will remove all the tools we used to clean your computer.


    Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

    Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

    If prompted to Reboot click, Yes.
    OTCleanit will delete itself when finished, If not delete it by yourself.

    -------------------------------------------------------------------------------------
    Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

    Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

    KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
    Fantastic cleaner.
    -------------------------------------------------------------------------------------
    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.
    -------------------------------------------------------------------------------------

    Every two weeks or so, run MBAM and SAS until clean.

    They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

    If they find something they can not clean, then get back to us.

    Additionally run CCleaner. ATF-Cleaner and KCleaner.
    ----------------------------------------------------------------------------------------
    I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

    It was designed to be used with and to co-exist with other Virus scanners.

    Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

    It's like looking at it with 2 sets of eyes and from a different angle.

    It works like some Firewalls do to learn what is good/bad.

    After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

    As it queries you about the prompt to help you determine to approve or not you can google it with one click.

    http://www.threatfire.com/Download/
    -------------------------------------------------------------------------------------
    Look at http://www.javacoolsoftware.com/spywareblaster.html

    Run SpyBot ocassionally and use the Immunize function.
    http://www.safer-networking.org/en/download/

    I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

    Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

    A Disk Scan (chkdsk) and Defrag are in order.

    Mike
     
  15. Josho495

    Josho495 TS Rookie Topic Starter Posts: 34

    Thank you Mike for all you've done. My computer is running fine.

    I don't know how you know all this info but I'm glad you do.

    I will take all your advice and put it to good use.

    Many thanks.

    Josh
     
  16. mflynn

    mflynn TS Rookie Posts: 2,655

    I do this for a living Josh for 30 years!

    Here I am just giving back to what has been good to me!

    And I enjoy helping people!

    Mike
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...