Member Panel

Hello all, this is my first time visiting these forums and I thought I'd ask for some help. I'll explain what normally happens...

I log onto my Windows XP Pro system and everytime I log on, I get a few errors. I'm not sure if these are related to my winlogon.exe BSOD problem or not, but they may. The first one is named C:\WINDOWS\msupdate.exe and says:
Windows cannot find 'C:\WINDOWS\msupdate.exe'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

The next error continues after I click OK on the previous error. It is named Desktop and says:
Could not load of run 'C:\WINDOWS\msupdate.exe' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.

I click OK on that and sometimes (not always) I get an error come up that is named winlogon.exe and says "winlogon.exe encountered a problem and needed to close." and the Send Error Report and Don't Send buttons. I close it and sometimes it pops up again or leaves me alone. It seems I can leave my computer on for a while and it runs fine. I can visit websites on Mozilla and Internet Explorer fine for hours if I want without problems. I can chat on AIM if I want or MSN. The biggest problem usually happens when I am playing the game "Final Fantasy XI" and using the voice chat program Ventrilo. It'll happen randomly when I am playing, but I can almost garuntee that sometime when I am playing it will BSOD. I'm not sure completely if Ventrilo or FFXI are involved or not, but it seems like a coincidence.

When my computer BSOD's I get the following error information:

STOP: c000021a {Fatal System Error}
The Windows Logon Process system process terminated unexpectedly with a status of 0x0000005 (0x00000000 0x00000000)
The system has been shut down.

I've searched for information about this...and I can't figure it out. Obviously winlogon.exe is a vital process and is being terminated, but I don't understand why...I've run virus scans with AVG 7.5 and have done scans with Ad-aware and Spybot...they sometimes show problems and I fix them, but this error keeps happening. Any help would be greatly appreciated! Thanks for your time!

Hello Adore You

Welcome to PC Help Forums

One or more of our Technical Support Team will be with you shortly Adore, please bear with us for the time being.

Try this go to start the run type msconfig then click on go to the startup tab and disable all the things in there reboot the pc and see if you still get the errors. If you don't then it would appear to be somthing in the startup add each Item back till you workout what is causing the problem.

Kind Regards,
Matt
Mp4 Player Digital Camera Spy Camera Car T.V DVD Audio

Welcome to the PCHF AdoreYou,

To me it sounds more like a malware issue...

It might be an idea to follow the prework link in my signiture and post the resulting logs back here. One of the security team will be able to look over them for you.

Hi AdoreYou,

Welcome to PCHF.

Did the problem start after running SpyBot? The first time you run SpyBot, using Service Pack 2, it will list the new Windows security features as spyware, even though they are not! These are Windows Firewall, Windows Automatic Updates and Windows Anti Virus protection, and would have been listed as "Windows Security Center.". If these were ticked when fixing, it would explain your problems?

If so, SpyBot does have a good recovery system, as long as you backed up your registry when installing SpyBot. Go into SpyBot, and click on the Recovery section. Tick everything that starts with "Windows Security Centre", and the click on the Recover Selected Items button.

Hi and thanks so much for all the responses. I've been running spybot for a few years now and the same with Ad-aware. I use them both fairly often to keep my system relatively clean...so its not a recent thing that spybot has caused. I've had SP2 for a long time as well. The last time I reformatted my computer I installed XP pro and then service pack 2.

Also, I unchecked everything in msconfig like you said, madmatt2006, and it seems that when I restarted...I recieved no error messages! I'm not too sure if the problem is fixed yet, so here is my hijackthis log:

Logfile of HijackThis v1.99.1
Scan saved at 6:41:15 PM, on 12/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Rob\Desktop\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {013A653B-49A6-4f76-8B68-E4875EA6BA54} - C:\WINDOWS\system32\bojxhwxj.dll (file missing)
O2 - BHO: (no name) - {0285F3D1-2B41-4019-93D7-C5918F26316a} - C:\WINDOWS\system32\vjpknvcm.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {22BA401F-5B26-48F6-B622-D76BC829FA90} - C:\WINDOWS\system32\vjpknvcm.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A3B5FC16-7DFC-4E02-8F4C-F8E6ACC00819} - C:\WINDOWS\system\awvears.dll (file missing)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1156973453921
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1156973696968
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab47946.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/game...Plugin9USA.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: awvears - C:\WINDOWS\system\awvears.dll (file missing)
O20 - Winlogon Notify: dwfrqytk - C:\WINDOWS\SYSTEM32\dwfrqytk.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzzc32 - winzzc32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IWin service - Unknown owner - C:\WINDOWS\system32\iwinapp.exe (file missing)
O23 - Service: Neth - Unknown owner - C:\WINDOWS\system32\netid.exe (file missing)

Thanks AdoreYou,

I've moved this to the HJT log section for the security team to see it easier