Attachment of Requested Logs:
1.MBAM
2.SAS
3.HJT

Attached Files

	hijackthis7.2.2009.txt (5.9 KB, 1 views)
	SUPERAntiSpyware Scan Log - 07-06-2009 - 19-22-34.log (747 Bytes, 1 views)
	mbam-log-2009-07-06 (19-16-30).txt (837 Bytes, 1 views)

You're running Windows Live Oncare for the AV and firewall.

You also have a process for a-squared. I suggest you uninstall:
C\Program Files\a-squared Free\a2service.exe

Please give us some information of where you saw this: Win32K.sys error w/ service executable dialogue boxes

And what problems you are experiencing on the system. I'd like to see a log from scan with AV please.

Mbam and SAS are clean. The only thing in the HijackThis log that peeks my interest are these 4 entries:
is a part of the Microsoft Doctor Watson error reporting tool which comes packaged with some Microsoft products

C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe

Bottom line> need more information.

Bobbye,
This is what came up on one of the many Dialogue Boxes since this problem began...
I tried a 6.6.2009 Restore date & not successful..
I followed all 8 steps...
Still getting Serv Executa D Boxes all the time now when try to Browse in IE7.
When I scan AV in Windows One Cra it says No Issues...
Won't let me copy a 'log file for you to see' Sorry...
Any other ideas.. I have spent 8 Hours now on this Box..
Bill & thanx for your reply I do appreciate it...

Bill, I really need for you to explain just exactly what you are seeing: Is it this:

IF that is the case, you need to find out what this service is associated with:
Click on Start> Run> services.msc>
Click on services find the one you are having problems with and post the description here.

I have read that this is sometimes associated with windows Live OneCare.

Checking the Event Viewer might show: Stop: 0x0000008E & win32k.sys Error:

This problem has been identified as a problem with ATI Catalyst Control Center 7.3.

If this could apply to you, please go to: http://support.amd.com/us/Pages/AMDSupportHub.aspx

I tried to get the info but have to plug in specifics for the system which I don't have. I saw a hot fix but the link given wasn't good.

Bobbye,
Thank you for your patience. I thought yall would have seen this issue prior. This has been prevalent on Internet for some time...My Chipset is Intel so the theory of AMD is not logical here. Good thought though. These Dialogue Boxes come up as I Browse using Internet Explorer 7.0.. All My Services are started; I checked them all jus now...
One of the executables involved is MsMpEng.exe.
I do run XP and Ult Vista through a KVM switch. Prior this has NOT been a problem.
Both OS's have worked flawlessly...
I use SAS MBAM & CC Cleaner all the time...
My hypothesis is to Uninstall One Care Live and Load Avast for now.. Trying to diagnose litlle at a time..
I truly think is issue is coming from 'outside' if you know what I mean.
Thank you all agin for your tireless help... My Pere to Peer Netowrk (8 Nodes) usually runs flawlessly, i.e I have Mac's & PC's Laps and workstations ...Quite a connundrum, indeed Any help is truly appreciated. Thanks Bill MCSE MCP+i MCP

Bill, msmpeng.exe or msmpeng process info for Microsoft Windows Defender Antispyware.

Windows Defender is built in to Windows Live OneCare. So by removing One Care and using Avast instead resolve at least part of that problem.

The P2P will continue to be a threat and make the system vulnerabilities. i would still like to see an AV log. Can you try to run the Eset online scan? How about Eset Nod32 online scan with log?
Run Eset NOD32 Online AntiVirus Scanner HERE

Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the Active X control to install
• Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
• Click Start
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
• Click Scan
• Wait for the scan to finish
• Re-enable your Antivirus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

logESET0708092035HDST.txt
Bobbye,
Here is ESET AV Scan...
I am re-enabling Avast presently...

Okay, scan is clean. I have questions and answers-or suggestions.

MsMpEng.exe. is a process that originally was in Windows Defender Antispyware. It was known to cause problems then. And now that Windows One Care is out, users are finding that problem is still turning up.

First, if you have not done it already, download Avast if that's the AV you want to use> save it to your desktop. Don't run it yet:

Please reopen the HijackThis log to 'do system scan only.'
Check each of the following if present. Note: Don't click on Fix Checked until you have checked them all

C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

Close all Windows except HijackThis and click on 'Fix Checked.'


Boot into Safe Mode> Set the system to Work Offline

Start> Run> type in msconfig> enter> Selective Startup> Startup tab> UNCHECK the Windows OneCare entries:
OcHealthMon.exe
winssnotify.exe
msfwsvc.exe
Also uncheck WinCinemaMgr.exe
Apply> OK

Control Panel> Add/Remove Programs> UNINSTALL the Windows One Care entries.

Start> Run> type in services.msc> double click on a2service> change Startup type to Manual.

Double click the Avast setup on the desktop to run/install.

Reboot into Normal Mode. Note: ignore the nag message and close it after checking 'don't show this message again.' Stay in Selective Startup.

See if this resolves the problem. If it does not:
Do the Error Check
Run the System FileChecker.

I have 2 more steps if the above doesn't handle it. From what I read, this continues to be an ongoing 'bug' because it's dependent on the system configurations and users have different configurations- at least that's the excuse Ms is currently using.

BTW, several people found the Win32.sys problem was being caused by the Logitech Quick Cam. Changing the Service for LVPrcSrv.exe resolved it!.

Edit: Remind me to remind you to empty the Recycle Bin!