Tech Support Forum - View Single Post - Win2kPro restarts automaticly after log in

gomer1075 · 06-08-2006, 04:56 AM

I can log in to the computer I'm using currently (I'm an administrator and the OS is Win2kPro) on any of the 3 admin accounts on the computer and once I do the computer hangs and reboots in about a minute or so (the wallpaper comes up and the cursor is the full "busy" hourglass, then presto, restarted on it's own.) I've been able to get desktop icons to apear by ctrl-alt-del>log off and then logging back in, but the computer still restarts and does so about 5 seconds max after logging back in.

I'm able to get into the system through safe mode although after a while the computer restarts again. No specific ammount of time with safe mode though.

I hope you all can help me out with this... here's my Hijack This log from safemode. I'll keep trying to get a regular login one in the meantime.

Logfile of HijackThis v1.99.1
Scan saved at 3:37:16 AM, on 6/8/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\savedump.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\explorer.exe
C:\Documents and Settings\gomer\Desktop\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe C:\WINNT\svchost.exe
F3 - REG:win.ini: load=C:\WINNT\svchost.exe
F3 - REG:win.ini: run=C:\WINNT\svchost.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTSysVol] D:\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTDVDDET] D:\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [IW Controlcenter] d:\INSTAN~1\IWCTRL.EXE
O4 - HKLM\..\Run: [RemoteControl] C:\WINNT\system32\rmctrl.exe
O4 - HKLM\..\Run: [wnddrv] C:\WINNT\svchost.exe
O4 - HKLM\..\Run: [nvchost] C:\WINNT\winlogon.exe
O4 - HKLM\..\Run: [jssvc23] jsssvc.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Manager 006] C:\WINNT\svchost.exe
O4 - HKLM\..\Run: [icsc] C:\WINNT\system32\icsc.exe
O4 - HKLM\..\Run: [icsc] C:\WINNT\system32\icsc.exe
O4 - HKLM\..\Run: [skcs] C:\WINNT\system32\skcs.exe
O4 - HKLM\..\Run: [desman] C:\WINNT\system32\desman.exe
O4 - HKLM\..\Run: [comms] C:\WINNT\system32\comms.exe
O4 - HKLM\..\Run: [mgrds] C:\WINNT\system32\mgrds.exe
O4 - HKLM\..\Run: [monmc] C:\WINNT\system32\monmc.exe
O4 - HKLM\..\Run: [wiznt] C:\WINNT\system32\wiznt.exe
O4 - HKLM\..\Run: [foks] C:\WINNT\system32\foks.exe
O4 - HKLM\..\Run: [fowi] C:\WINNT\system32\fowi.exe
O4 - HKLM\..\Run: [idapi] C:\WINNT\system32\idapi.exe
O4 - HKLM\..\Run: [dsut] C:\WINNT\system32\dsut.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [icmsg] C:\WINNT\system32\icmsg.exe
O4 - HKLM\..\Run: [32hlp] C:\WINNT\system32\32hlp.exe
O4 - HKLM\..\Run: [wmid] C:\WINNT\system32\wmid.exe
O4 - HKLM\..\RunServices: [0mcamcap] C:\WINNT\system32\0mcamcap.exe
O4 - HKLM\..\RunServices: [jssvc23] jsssvc.exe
O4 - HKCU\..\Run: [0mcamcap] C:\WINNT\system32\0mcamcap.exe
O4 - HKCU\..\Run: [Manager 006] C:\WINNT\svchost.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...38&clcid=0x409
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04c5c40f...p/RdxIE601.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemp...ogin-devel.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://fastconnectkitsetup.cox.net/...lowActiveX.CAB
O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab
O20 - AppInit_DLLs: srrs44855981.dll nwwk44855981.dll
O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll
O20 - Winlogon Notify: cfgmngr32 - C:\WINNT\system32\cfgmngr32.dll
O20 - Winlogon Notify: directpt - directpt.dll (file missing)
O20 - Winlogon Notify: hnup - C:\WINNT\system32\hnup.dll
O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll
O20 - Winlogon Notify: SensSrv - C:\WINNT\
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe

-=edit=-

Sorry if this seems rushed but I'm in safe mode and I'm not sure how much time I've got before the next restart. *^_^*

06-08-2006, 04:56 AM	#1 (permalink)
gomer1075 Registered User Join Date: Jun 2006 Posts: 10 OS: Win2kPro	Win2kPro restarts automaticly after log in I can log in to the computer I'm using currently (I'm an administrator and the OS is Win2kPro) on any of the 3 admin accounts on the computer and once I do the computer hangs and reboots in about a minute or so (the wallpaper comes up and the cursor is the full "busy" hourglass, then presto, restarted on it's own.) I've been able to get desktop icons to apear by ctrl-alt-del>log off and then logging back in, but the computer still restarts and does so about 5 seconds max after logging back in. I'm able to get into the system through safe mode although after a while the computer restarts again. No specific ammount of time with safe mode though. I hope you all can help me out with this... here's my Hijack This log from safemode. I'll keep trying to get a regular login one in the meantime. Logfile of HijackThis v1.99.1 Scan saved at 3:37:16 AM, on 6/8/2006 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\savedump.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINNT\explorer.exe C:\Documents and Settings\gomer\Desktop\HijackThis.exe F2 - REG:system.ini: Shell=explorer.exe C:\WINNT\svchost.exe F3 - REG:win.ini: load=C:\WINNT\svchost.exe F3 - REG:win.ini: run=C:\WINNT\svchost.exe O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTSysVol] D:\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTDVDDET] D:\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [IW Controlcenter] d:\INSTAN~1\IWCTRL.EXE O4 - HKLM\..\Run: [RemoteControl] C:\WINNT\system32\rmctrl.exe O4 - HKLM\..\Run: [wnddrv] C:\WINNT\svchost.exe O4 - HKLM\..\Run: [nvchost] C:\WINNT\winlogon.exe O4 - HKLM\..\Run: [jssvc23] jsssvc.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Manager 006] C:\WINNT\svchost.exe O4 - HKLM\..\Run: [icsc] C:\WINNT\system32\icsc.exe O4 - HKLM\..\Run: [icsc] C:\WINNT\system32\icsc.exe O4 - HKLM\..\Run: [skcs] C:\WINNT\system32\skcs.exe O4 - HKLM\..\Run: [desman] C:\WINNT\system32\desman.exe O4 - HKLM\..\Run: [comms] C:\WINNT\system32\comms.exe O4 - HKLM\..\Run: [mgrds] C:\WINNT\system32\mgrds.exe O4 - HKLM\..\Run: [monmc] C:\WINNT\system32\monmc.exe O4 - HKLM\..\Run: [wiznt] C:\WINNT\system32\wiznt.exe O4 - HKLM\..\Run: [foks] C:\WINNT\system32\foks.exe O4 - HKLM\..\Run: [fowi] C:\WINNT\system32\fowi.exe O4 - HKLM\..\Run: [idapi] C:\WINNT\system32\idapi.exe O4 - HKLM\..\Run: [dsut] C:\WINNT\system32\dsut.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [icmsg] C:\WINNT\system32\icmsg.exe O4 - HKLM\..\Run: [32hlp] C:\WINNT\system32\32hlp.exe O4 - HKLM\..\Run: [wmid] C:\WINNT\system32\wmid.exe O4 - HKLM\..\RunServices: [0mcamcap] C:\WINNT\system32\0mcamcap.exe O4 - HKLM\..\RunServices: [jssvc23] jsssvc.exe O4 - HKCU\..\Run: [0mcamcap] C:\WINNT\system32\0mcamcap.exe O4 - HKCU\..\Run: [Manager 006] C:\WINNT\svchost.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/game...ts/y/ct2_x.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?link...38&clcid=0x409 O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/04c5c40f...p/RdxIE601.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemp...ogin-devel.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - https://fastconnectkitsetup.cox.net/...lowActiveX.CAB O16 - DPF: {B9A296D4-38AC-4566-8168-F7ACAF7D35E6} (Eyeball Video Session Control) - http://imlive.com/ChatSource/gVideoContol.cab O20 - AppInit_DLLs: srrs44855981.dll nwwk44855981.dll O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O20 - Winlogon Notify: cfgmngr32 - C:\WINNT\system32\cfgmngr32.dll O20 - Winlogon Notify: directpt - directpt.dll (file missing) O20 - Winlogon Notify: hnup - C:\WINNT\system32\hnup.dll O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll O20 - Winlogon Notify: SensSrv - C:\WINNT\ O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe -=edit=- Sorry if this seems rushed but I'm in safe mode and I'm not sure how much time I've got before the next restart. ^_^ Last edited by gomer1075; 06-08-2006 at 04:59 AM.