Win32k.sys Problem

Status
Not open for further replies.
J

Josho495

Posts: 34   +0
Lately I've been getting frequent BSOD caused by win32k.sys

These restarts have been happening randomly... while on the net or playing a game.

Here is a list of my specs.

Windows: Windows XP5.1 (Build 2600) Service Pack 3
Internet Explorer: 7.0.5730.13
Memory (RAM): 2815 MB
CPU Info: Intel® Core™2 Extreme CPU Q6850 @ 3.00GHz
CPU Speed: 2956.8 MHz
Sound card: SB X-Fi Audio [8C00]
Display Adapters: NVIDIA GeForce 8800 Ultra | NVIDIA GeForce 8800 Ultra | NetMeeting driver | RDPDD Chained DD
Monitors: 1
Screen Resolution: 1680 X 1050 - 32 bit
Network: Network Present
Network Adapters: NVIDIA nForce Networking Controller #2 - Packet Scheduler Miniport
CD / DVD Drives: E: ASUS DRW-1814BLT | F: TAZWH T2JCX63
COM Ports: COM1
LPT Ports: NOT Present
Mouse: 3 Button Wheel Mouse Present
Hard Disks: C: 465.8GB | D: 465.8GB
Hard Disks - Free: C: 205.2GB | D: 117.5GB
USB Controllers: 2 host controllers.
Firewire (1394): 1 host controllers.
PCMCIA (Laptops): Not Installed
Manufacturer: Phoenix Technologies, LTD
Product Make: 122-CK-NF68
AC Power Status: OnLine
BIOS Info: AT/AT COMPATIBLE | 09/28/07 | Nvidia - 42302e31
Time Zone: E. Australia Standard Time
Battery: No Battery
Motherboard: EVGA 122-CK-NF68
Modem: Nokia N95 USB Modem

:


I had this problem previously and I bought new ram thinking it would solve it but to no avail.

Any help appreciated!
 
I've followed the 8 steps.

Here is my hijack log
Malwarebytes Anti Malware log
SuperAntiSpyware log

Hopefully this can explain something.

I didn't mention in the original post , IE and Firefox is consistently crashing.

Cheers
 
Good morning Josh

Run HJT Scan only select and remove the entry below
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

These logs were clean, did you run these other times before this?

Do the below

Update then run SAS
Click Preferences-Repairs
Then counting down from top do the following entries

Numbers 6, 8, 11, 12, 13, 15,18, 19, 20, 21, 22, 24, 25, 26 and 27!

Then...

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

Install Recovery Console if connected to the Internet!

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Reboot test the issues and report back status!

Mike
 
Thanks for all your help.

Attached is the SD Fix Report, ComboFix Report & the new HJ Log.

Cheers.

Thanks again.

PS. When in Safe Mode completing the SDFix step, during the process the following message appear several times.

"The file or directory c:\$Mft is corrupt & unreadable. Please run the Chkdsk utility"
 
Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner.

Reboot here before continuing.

The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.

Reboot and try to incur a win32k.sys to see if improved.

Also for the error reported by SDFix. Do this..

Start-Run
type
chkdsk /r
enter or ok

It will want exclusive access and ask to do it on next boot, so reboot.

Then run SDfix again from Safe mode to confirm error is gone.

Mike
 
Good morning Mike,

Thanks again for everything. I greatly appreciate it. Thought I was going to have to format.

I fell asleep last night completing the chkdsk /r utility hence the late reply.

This morning I ran SDFix again.

Things look back to normal but will see if anything comes up.

Firefox and IE haven't closed at all yet which are good signs.

I'll keep you posted.

Josh
 
Ok now I am satisfied!

Thread closing-------------------------------------------------------------------

Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

Remove ComboFix
Start-Run
type
combofix /u
Hit enter or click OK.

Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.


Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

If prompted to Reboot click, Yes.
OTCleanit will delete itself when finished, If not delete it by yourself.

-------------------------------------------------------------------------------------
Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner.
-------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
-------------------------------------------------------------------------------------

Every two weeks or so, run MBAM and SAS until clean.

They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

If they find something they can not clean, then get back to us.

Additionally run CCleaner. ATF-Cleaner and KCleaner.
----------------------------------------------------------------------------------------
I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to be used with and to co-exist with other Virus scanners.

Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

It's like looking at it with 2 sets of eyes and from a different angle.

It works like some Firewalls do to learn what is good/bad.

After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

As it queries you about the prompt to help you determine to approve or not you can google it with one click.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

A Disk Scan (chkdsk) and Defrag are in order.

Mike
 
Thank you Mike for all you've done. My computer is running fine.

I don't know how you know all this info but I'm glad you do.

I will take all your advice and put it to good use.

Many thanks.

Josh
 
I do this for a living Josh for 30 years!

Here I am just giving back to what has been good to me!

And I enjoy helping people!

Mike
 
Status
Not open for further replies.

Similar threads

R
Typing delay in Firefox on Windows 7
Replies
7
Views
6K
Tmagic650
Tmagic650
A
Computer shuts down while playing
Replies
4
Views
3K
advancedbr
A
8
Strange problem, has temporary fix
Replies
0
Views
2K
83Chevy
8

Latest posts

Back