| | |
Random restarts (XP Pro) with certain programs
![]() |
•
•
Join Date: Mar 2004
Posts: 6
Reputation:
Solved Threads: 0
I was in the middle of a post when (surprise) my computer restarted on me.
So here's the quick and dirty version.
My computer runs completely fine when it's used for everyday things. But once I start to run (or so it seems) system type programs, my computer bluescreens and restarts. I'm running XP Pro (all patched), McAfee Professional (all updated) and SpyBot (immunized).
It runs fine until I try to run things that are "system" programs. I try to run things like Virus Scanners, Defrags, Spyware detectors, Registry cleaners, and various other programs of this nature and my computer just blue screens and restarts. It then runs fine until I try and go at it again with the system programs. I've gotten nowhere with this problem and I'm looking at a format, but that's time consuming and I'm reluctant cuz my computer still technically runs.
Please help me if you can!
I've run Hijack This and here's the log:
----------------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 8:27:27 PM, on 3/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\Daemon\daemon.exe
C:\WINDOWS\System32\taskswitch.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
F:\Clockx\ClocX.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\iTunes\iTunesHelper.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
F:\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\AIM\aim.exe
C:\Documents and Settings\William K. Yam\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SpyBot\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Daemon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [ClocX] F:\Clockx\ClocX.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] F:\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TrojanScanner] F:\SpyWare Utilities\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Stardock ObjectDock.lnk = F:\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...975.4252314815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
---------------------------------------
So here's the quick and dirty version.
My computer runs completely fine when it's used for everyday things. But once I start to run (or so it seems) system type programs, my computer bluescreens and restarts. I'm running XP Pro (all patched), McAfee Professional (all updated) and SpyBot (immunized).
It runs fine until I try to run things that are "system" programs. I try to run things like Virus Scanners, Defrags, Spyware detectors, Registry cleaners, and various other programs of this nature and my computer just blue screens and restarts. It then runs fine until I try and go at it again with the system programs. I've gotten nowhere with this problem and I'm looking at a format, but that's time consuming and I'm reluctant cuz my computer still technically runs.
Please help me if you can!
I've run Hijack This and here's the log:
----------------------------------------------
Logfile of HijackThis v1.97.7
Scan saved at 8:27:27 PM, on 3/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\Daemon\daemon.exe
C:\WINDOWS\System32\taskswitch.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
F:\Clockx\ClocX.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\iTunes\iTunesHelper.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
F:\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\AIM\aim.exe
C:\Documents and Settings\William K. Yam\Desktop\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = home.netscape.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SpyBot\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Daemon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKLM\..\Run: [ClocX] F:\Clockx\ClocX.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [iTunesHelper] F:\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [TrojanScanner] F:\SpyWare Utilities\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Stardock ObjectDock.lnk = F:\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...975.4252314815
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
---------------------------------------
Hi. First you need to get HijackThis into it's own folder or it will not create back-ups.
Rescan & get HJT to fix these entries:
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch This is related to wild Tangent.
Apart from that I can't see anything.
If you want to stay as free of bugs as you can,
download & install Adaware, update it & in settings make sure to tick; scan within archives, deep scan registry & then in 'Tweak' tick automatically try to unregister objects prior to deletion. Run the scan & place a check next to everything it finds & remove them.
Download Spybot S & D, update & run it. Remove everything it finds. Within this program there is an option to 'immunise'. do this. There is also a link to spywareblaster, follow the link, download & install it, then update it. This program runs in the background to keep those little bugs out.
Rescan & get HJT to fix these entries:
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch This is related to wild Tangent.
Apart from that I can't see anything.
If you want to stay as free of bugs as you can,
download & install Adaware, update it & in settings make sure to tick; scan within archives, deep scan registry & then in 'Tweak' tick automatically try to unregister objects prior to deletion. Run the scan & place a check next to everything it finds & remove them.
Download Spybot S & D, update & run it. Remove everything it finds. Within this program there is an option to 'immunise'. do this. There is also a link to spywareblaster, follow the link, download & install it, then update it. This program runs in the background to keep those little bugs out.
•
•
Join Date: Mar 2004
Posts: 6
Reputation:
Solved Threads: 0
•
•
•
•
Originally Posted by crunchie
Hi. First you need to get HijackThis into it's own folder or it will not create back-ups.
Rescan & get HJT to fix these entries:
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch This is related to wild Tangent.
Apart from that I can't see anything.
If you want to stay as free of bugs as you can,
download & install Adaware, update it & in settings make sure to tick; scan within archives, deep scan registry & then in 'Tweak' tick automatically try to unregister objects prior to deletion. Run the scan & place a check next to everything it finds & remove them.
Download Spybot S & D, update & run it. Remove everything it finds. Within this program there is an option to 'immunise'. do this. There is also a link to spywareblaster, follow the link, download & install it, then update it. This program runs in the background to keep those little bugs out.
Go to trend-micro for a free on-line scan
http://housecall.trendmicro.com/
http://housecall.trendmicro.com/
•
•
Join Date: Mar 2004
Posts: 6
Reputation:
Solved Threads: 0
•
•
•
•
Originally Posted by caperjack
A trip to wimdows updates wouldn't hurt .
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Also I would be a little suspisious of this ,do you know what it is.
O4 - HKLM\..\Run: [ClocX] F:\Clockx\ClocX.exe
That's a clock feature I added, I know what it is.
•
•
Join Date: Mar 2004
Posts: 6
Reputation:
Solved Threads: 0
•
•
•
•
Originally Posted by crunchie
Go to trend-micro for a free on-line scan
http://housecall.trendmicro.com/
The only other thing I can think of is to start HJT, go to config/misc tools & generate a start up list & post it here. Maybe someone will spot something that shouldn't be there.
•
•
Join Date: Mar 2004
Posts: 6
Reputation:
Solved Threads: 0
•
•
•
•
Originally Posted by crunchie
The only other thing I can think of is to start HJT, go to config/misc tools & generate a start up list & post it here. Maybe someone will spot something that shouldn't be there.
mmmkay, here it is.
------------------------------
StartupList report, 3/12/2004, 10:02:53 AM
StartupList version: 1.52
Started from : F:\Highjack This\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\Daemon\daemon.exe
C:\WINDOWS\System32\taskswitch.exe
F:\Clockx\ClocX.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\iTunes\iTunesHelper.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
F:\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
F:\AIM\aim.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\ABC\abc.exe
C:\Program Files\Outlook Express\msimn.exe
F:\Highjack This\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Documents and Settings\William K. Yam\Start Menu\Programs\Startup]
Stardock ObjectDock.lnk = F:\ObjectDock\ObjectDock.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
UserFaultCheck = %systemroot%\system32\dumprep 0 -u
SoundMan = SOUNDMAN.EXE
DAEMON Tools-1033 = "F:\Daemon\daemon.exe" -lang 1033
CoolSwitch = C:\WINDOWS\System32\taskswitch.exe
ClocX = F:\Clockx\ClocX.exe
ATIPTA = C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
iTunesHelper = F:\iTunes\iTunesHelper.exe
TrojanScanner = F:\SpyWare Utilities\Trojan Remover\Trjscan.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
STYLEXP = C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
McAfee.InstantUpdate.Monitor = "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - F:\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - F:\SpyBot\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
--------------------------------------------------
Enumerating Download Program Files:
[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\xscan53.ocx
CODEBASE = http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.co...975.4252314815
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
End of report, 5,183 bytes
Report generated in 0.046 seconds
- The following possible fishy entries are benign, I know what each of them does. ClockX, StyleXP, Daemon, ABC and ObjectDock.
Thanks for your help on this !
Well, I think that we can eliminate any malware. I really cannot see anything there. I was going to ask about the ABC thing, but you know what that is.
Can you point your finger at any particular thing you did prior to this happening?
Can you point your finger at any particular thing you did prior to this happening?
![]() |
Other Threads in the Windows NT / 2000 / XP Forum
- Previous Thread: Windows 2K Disk Space problem
- Next Thread: DirectX woes
| Thread Tools | Search this Thread |
.net 3.5 3daccelertion 2007 2010 a.exe alaris apache application appstore arm auto automatically black blue book cellphones collaboration computer computerfreezes crash cursor deployment desktop desktops dns domain dotnetnuke drive eartlink error errors features folder fontmanagers fonts format framework gadgets intel interoperability killprocess laptop latitude linux load login mac microsoft minimalizes mobile monitor motionle1600 netbooks novell nvidia open operatingsystems osx outlook palm partition patch printer product raid rds remotedesktop remotedesktopconnection repair replacingraiddrive retrieve screen server. simplifiedchinese sp1 unreadable update usb verizon videodrivers videogames virtual virus vista visual vulnerability wab webos weecam win win32/heur window windows windows7 windowsxp windowsxpnotstartingup. worm xp xpde






