Random reboots

[richardhollis]

I have been having random reboots..seems to be worse when I am on the internet and using Outlook.. and the mail process starts....I have also repaired my Office 2000 installation.........I have Norton AV as part of system works...and finds no virus.....XP Home with service pack 2 installed..I ran sfc /scannow and it replaced several dll files....but later I had the same problem and ran it again and it replaced some dll files again.......I have 1 gig of ram..tested a few months ago by removing one and booting up.....nothing conclusive......80gig hard drive about 70 gig open........

hijack log follows....any help appreciated....

Logfile of HijackThis v1.99.1
Scan saved at 8:04:40 AM, on 4/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\ggviewer67-55.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\ups.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\RICHAR~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.news.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v...86/client/wuweb_site.cab?1098454916000
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.com/cab/ImageViewer/MFImgVwr.cab
O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.com/MFInstall/MFInstall.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - http://www.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?323
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

 

[meltdown75]

Hi & welcome.

Do you use any Adware / spyware apps? I suggest Adaware + Spybot S&D + Webroot Spysweeper (all of them).

I personally don't favour NAV - I doubt you have a virus, but I'd use a freeware scanner such as AVG in addition to Norton just to be sure.

In some cases, a reinstall is the best solution though...

 

[richardhollis]

I have used spybot and liked it.....but seemed to stop working with my XP....gave me some kind of german words error and would quit in the middle.....then tried Microsoft's beta spyware.....which didn't seem to be much help...so uninstalled....am presently using my SBCYAHOO anti spyware.....

I have reinstalled xp a couple of times before......in addition to the random reboots the screen will sometimes freeze...oftentimes while I am moving the mouse cursor around......I have thought before maybe video card but have checked driver update and seems to be working fine....

 

[richardhollis]

one clarification on the video card.....I had similar problem last year and replaced the video card in addition to reinstalling XP....now with the problem back, it must not have been the video card....smile....unless it something to do with nvidea drivers....because both were nvidea....

 

[richardhollis]

tried Spybot again.....gets an error C2.lop (Zugriffsverletzung bei Adresse FFFFFFF but otherwise says no immediate threats were found

 

[meltdown75]

I highly suggest using all 3 apps listed...

 

[Harvey]

Check the actual date of the last virus definitions in Norton. Some viruses allow the program to appear to be working, but they block actual updates. If so, you may need to uninstall and reinstall your System Works.

If you do, you should also run SymClean. It's a Norton program that confirms that the last reminants of old Norton installations have been removed before reinstalling or updating to a newer version.

You may also want to try the free version of Ad-Aware. Many have reported that it sometimes catches spyware that Spybot misses, and vice-versa. Running both can't hurt.

 

[richardhollis]

I did install the trial version of Spy Sweeper.....on first download attempt screen froze, had to reboot.....second attempt installed ok.....asked if I wanted to update definitions, said yes....system rebooted on it's on while downloading....after coming back up....I installed spy sweeper again....ran it with just deifinitions that come with it 35, 000 or so defintions....found several cookies.....removed them.....tried updating again the definitions, succeeded, ran it again, found some more cookies.....removed them......

tried runnning Spybot again.....rebooted in the middle of the scan on it's own......

 

[richardhollis]

norton definition date is 4/22/05

 

[amdskip]

Install Microsoft AntiSpyware (http://www.microsoft.com/downloads/deta...62eda9671&displaylang=en&Hash=8M337Q5)

 

[FlyingPenguin]

Spyware scans need to be performed from Safe Mode. You also need to disable all malicious BHO Objects otherwise you'll re-infect yourself the first time you open an Explorer or IE window.

Please refer to my detailed spyware removal instructions here: http://theflyingpenguin.com/spyware-removal.shtml

 

[richardhollis]

read your instructions, am going to give them a try.....I have already tried in safe mode with network support the following,

Trend Micro's online Virus scan.......result.....computer rebooted in middle of scan.
McAfee Avert Stinger......result.....computer rebooted in middle of scan.
Symantec Security Check Virus scan......result.......screen froze in the middle of scan.....

 

[drd55]

try Kapersky AV trial

also disable system restore
boot into safe mode
try Kapersky Trial
try all you spyware/adware programs run micorsoft antispyware incase of browser jacker

 

[richardhollis]

update......in safe mode, no network support....did the following

ran BHODEMON......result only three files listed....
Acroiehelper assoc. with Adobe
Spybot
Navshext.dll associated with Norton AV

Ran CWShredder....result....negative scan.

scanned with Webroot spysweeper.....screen froze during scan.

rebooted in normal mode, scanned with norton av, full scan......screen froze on
c:\windows\system32\dllcache\firewall.cpl.....or at least while showing that file on screen.

 

[richardhollis]

did a NAV live update.....noticed something odd....

Processing update list
Downloading catalog file (25 of 26), product up-to-date.
Downloading catalog file (26 of 26), product up-to-date.

The following updates have been aborted:
> Norton AntiVirus Internet Worm Protection Signature Updates has 1 aborted update(s).
Reason:
LU1845: This update was aborted during its preprocessing step


All of the Symantec products installed on your computer are currently up-to-date. Remember to check for new updates frequently.
LiveUpdate session is complete.


did some looking online, was suggested I download and run an update file from NAV....did and error message is still there.....

 

[richardhollis]

did a search at Symantec.....did the Automated Support Assistant.....ran live update again after and still have the message....it tells me I should reconfigure my third party firewall.....

Operating System Windows XP
Operating System Version 2600
Service Pack Service Pack 2.2.0
OS Language en-us;English (United States)
Available Memory 696332
Available Disk Space 102236
CPU Type 586
Internet Explorer Version 6.0.2900.2180
Product Name Norton AntiVirus
Product Version 11.0.9
Software Vendor Symantec
LiveUpdate Version 2.6.14.0
Virus Definition Date 20050425
SCSS false
Norton WMI Present true
Product Activation Status 1
Subscription Software Version 3.0.0.27
Product Installation Error
Missing Product Processes
Missing Product Keys
Missing Product Files
Third-Party Firewall Internet Connection Firewall
Windows Event Log Disabled false
ConfigWiz Status
Common Client Status
Audit Mode false
Compatibility Mode false

 

[HeddaLora]

Some other things that might help:

-- Delete all temp files (c:\windows\temp\*.tmp, or on XP C:\Documents and Settings\username\Local Settings\Temp)

-- Delete temporary internet files (c:\windows\temporary internet files\*.*, or on XP C:\Documents and Settings\username\Local Settings\Temporary Internet Files)

-- If you use I.E., click on Tools, Internet Options, Delete Files, select "delete all off-line content", click OK

-- Click on Start, Programs, Accessories, Systems Tools, Disk Cleanup

-- Download AdAware ( http://www.lavasoft.de ), check for updates, run it and remove whatever it finds

-- Periodically empty the browser cache and the java plug-in cache

-- Download Diskeeper ( http://www.executive.com ) and defrag

-- Scan for Spyware (which you've already done).