There is a computer that has been running fine and all of a sudden it
came up with a WIN32K.SYS page fault in non page area message. Followed by a much of numbers and near the end of the maessage it mentions that is beginning its physical dump. The owner has run AVG and
Spybot and did not find anything un usual. It occurs at any time without warning and it will reboot but only after waitng a while. She is running XP home. My gut call at the moment is a memory problem but was wondering about a worm or trojan? Any thoughts and suggestions?

Now would be a good time to back up anything important on her PC. (just in case)

I would be inclined to go with the memory call too. Its probably worthwhile going through all the hardware (starting with the memory) to make sure its all A1.

Here is a link to simtester
http://www.simmtester.com/default.asp
It will do a sw test of the memory although nothing tests it better than swapping it out with known good sticks of memory!

Good luck, Inka

I have been doing some research on this page fault problem and I need to know what is contain in the Win32.sys folder? Whats in it and what
should not be in it? I talked with the owner today and she says she gets a variety of meassages, the latest being an alert from microsoft about her XP being vunerable to malicious code being run by a hacker
who could take over the machine.This is a full screen meassage. Now we know that microsoft does not send out messages per say by email. I still think she has ahold of something that keeps throwing this stuff up at her. I just have to figure out where the junk is located. Her virus scan is normal and so is spybot. Suggestions?

Windows Messenger service needs to be disabled, easiest way is to download
"Shoot the Messenger" from free stuff at Gibson Research Corp site.

Is the unit protected with a proper firewall program?

I figure it is two problems by the description, this will at least stop the popups.

Yes it has a proper firewall. Where in XP do you go to turn off Windows messenger?

go to RUN and type SERVICES.msc and scroll down until you see it. Right click and choose properties and then disable.

If you go here you will find a list of the services it is safe to turn off. Very good site and reliable info.
http://www.blackviper.com/WinXP/servicecfg.htm

I was thinking that there are two messengers under services and yep one is the one I'm looking for and the other was very important to the overall scheme of things and should not be disabled.Am I thinking right
on this?;)

As far as I know there shuld only be ONE listing for messenger in services.

I have messenger (disabled) and I have Internet messenger installed and this is not listed in services. Though I have IM set to be started manually so this could be the reason for the exclusion of the second item in my listing

What are the two items actually called (in services).

Windows messenger is listed simply as MESSENGER.
I would disable both and see what happens