cubswin

Hey all,

I'm experiencing very random automatic system shutdowns. I can't get through any complete virus scan or spyware/adware scans before the whole system just crashes and completely restarts windows. Half the time it happens when I just click on folders!

Didn't know if there was anything out there that could help me... I'm pretty sure my HJT log is clean but I'll post my HJT Analyzer log anyway.

Thanks in advance for any assistance you can give. Here is the log:



Log was analyzed using HijackThis Analyzer - Updated on 1/7/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Logfile of HijackThis v1.99.0
Scan saved at 5:30:47 PM, on 3/6/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

O4 - HKLM\..\Run: [LVComs] C:\WINNT\system32\LVComS.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB


End of HijackThis Analyzer Log.



Case

greyknight17

Yes, it's clean.

Did you check the memory/RAM for any errors? How about running chkdsk for Windows? Did you add any new hardware? Check your PC fans to see if it has proper ventilation also.

Does Windows give you any errors before it shuts down?

__________________
Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it.

Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D

Anti-Spyware Tutorial :: Spyware Prevention Tools

cubswin

How specifically do you check the memory/RAM for any errors? Or is that what the chkdsk is?

I ran chkdsk and it went through the stage 1, 2, and 3 but that was it…. Nothing came up.


Fan is working and is has plenty of free space.

New programs include:
- All-in-one secretmaker for popup killer
- Aboutbuster
- Cleanup
- Semantic antivirus pro

Doesn’t produce any errors prior to shutdown…. Just completely shuts off and restarts. Seems to happen when accessing system files. Any time I try to do a search for anything or when I try to look into system folders it just blanks and resets.

thnx for your continued support
case

cubswin

One error that has started occuring is when trying to open a PDF:
"AcroRd32.exe has generated errors and will be closed by Windows. You will need to restart the program" -- however, this does not cause the system to crash and restart.

I ran across a couple exe programs that I wasn't sure about in my WINNT folder:
apixio32.exe
uneng.exe
twunk_16.exe
twunk_32.exe
UNWISE.exe

didn't know if these meant anything to anyone that has more knowledge than I.

thanks!
case

johnwill

Start with the basics, run one of these memory tests overnight, you should have NO errors of any kind. If you have errors, we need to fix those first.

Microsoft Memory Diagnostic

MEMtest86

__________________
If TSF has helped you, Tell us about it! or Donate to help keep the site up!

Microsoft MVP - Windows Desktop Experience

cubswin

thanks Johnwill!

I'll follow up in the morning if the test is completed.

cubswin

Sorry didn't get this posting earlier today....

Okay... I ran through the regular scan once and then again after I hit "t" for a more in-depth scan.... NO Errors were logged.

What's the next step?

thnx

johnwill

Check the System Event Log for any logged errors when it crashes.

__________________
If TSF has helped you, Tell us about it! or Donate to help keep the site up!

Microsoft MVP - Windows Desktop Experience

cubswin

Okay, I believe I this is what you were asking for. The first set of entries is from a shutdown that just occured from simply clicking on a folder. The last set of entries is from a crash the other day. This is kind of long but I wanted to give you as much as possible in an attempt to try and isolate the problem.

Thanks for you continued support!
This was under the application Log:

Event Type: Warning
Event Source: EventSystem
Event Category: Firing Agent
Event ID: 4100
Date: 3/13/2005
Time: 9:35:44 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The COM+ Event System failed to create an instance of the subscriber {6295DF2D-35EE-11D1-8707-00C04FD93327}. CoCreateInstanceEx returned HRESULT 8000401A.


This was a security Log:

Event Type: Warning
Event Source: Srv
Event Category: None
Event ID: 2013
Date: 3/13/2005
Time: 9:36:28 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The C: disk is at or near capacity. You may need to delete some files.
Data:
0000: 00 00 00 00 02 00 48 00 ......H.
0008: 00 00 00 00 dd 07 00 80 ....Ý..€
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


The other day I had 4 Errors logged (under application log) and they were as follows:
Event Type: Error
Event Source: rasctrs
Event Category: None
Event ID: 2001
Date: 3/8/2005
Time: 10:41:41 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The description for Event ID ( 2001 ) in Source ( rasctrs ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: The event log file is corrupt..


Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2002
Date: 3/8/2005
Time: 10:41:41 PM
User: N/A
Computer: CASEY-23432AD3
Description:
Unable to open the Redirector service. Redirector performance data will not be returned. Error code returned is in data DWORD 0.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2004
Date: 3/8/2005
Time: 10:41:41 PM
User: N/A
Computer: CASEY-23432AD3
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
Data:
0000: 34 00 00 c0 4..À

Event Type: Error
Event Source: PerfDisk
Event Category: None
Event ID: 1000
Date: 3/8/2005
Time: 10:41:40 PM
User: N/A
Computer: CASEY-23432AD3
Description:
Unable to open the Disk performance object. Status code returned is data DWORD 0.
Data:
0000: 70 10 00 00 p...



Additionally, these came up under the system Log:
Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10010
Date: 3/8/2005
Time: 10:48:33 PM
User: NT AUTHORITY\SYSTEM
Computer: CASEY-23432AD3
Description:
The server {1BE1F766-5536-11D1-B726-00C04FB926AF} did not register with DCOM within the required timeout.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:41 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7026
Date: 3/8/2005
Time: 10:41:22 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The following boot-start or system-start driver(s) failed to load:
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
SAVRT
SMTCPMON
SYMTDI
Tcpip

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:22 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The Computer Browser service depends on the Server service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:21 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The System Event Notification service depends on the COM+ Event System service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:21 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The Messenger service depends on the NetBIOS Interface service which failed to start because of the following error:
A device attached to the system is not functioning.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:19 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The TCP/IP NetBIOS Helper Service service depends on the AFD Networking Support Environment service which failed to start because of the following error:
No attempts to start the service have been made since the last boot.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:19 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:
A device attached to the system is not functioning.

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6005
Date: 3/8/2005
Time: 10:41:19 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The Event log service was started.

Event Type: Information
Event Source: EventLog
Event Category: None
Event ID: 6009
Date: 3/8/2005
Time: 10:41:19 PM
User: N/A
Computer: CASEY-23432AD3
Description:
Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Uniprocessor Free.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7001
Date: 3/8/2005
Time: 10:41:19 PM
User: N/A
Computer: CASEY-23432AD3
Description:
The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:
A device attached to the system is not functioning.

Moridin333

I have the same problem

It didn't happen when I uninstalled Norton, although that isn't a fix it might tell you what's wrong.

Moridin333

I fixed my problem by using a pci lan card instead of onboard. This is probabbly not your problem but it's worth a try.