• This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn more.
  • Welcome to Free PC Help, a free PC Help forum to get help with your computer problems.

    Free PC Help is a community that offers free computer help and support for all users, all ages, worldwide.

    In order to start asking questions or contribute on someone else's post you will first need to register. Don't worry - it's quick and easy and once you have registered you will have instant access to the entire forum.

    If you do decide to join the forums you will not have the option to send Private Messages [ PMs ] or add a Signature until you have made 5 posts or more. This is an attempt to try to stop Spammers using the PM system or adding links to their Signature.

Computer keeps re-booting

Joined
Apr 27, 2008
Messages
7
#1
Hi

Recently, my PC has decided to start re-booting itself. I have 2 accounts but never get the chance to press on any icon before it re-boots. I can start the computer up through F8 and using 'last known good configuration' and it works fine. I am running on Windows Vista, I have installed Hijack This and below is a log report, any help would be greatly appreciated:-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:43:19, on 27/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\vsnpstd.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = BBC - Homepage
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Yahoo! UK & Ireland
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Yahoo! UK & Ireland
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Yahoo! UK & Ireland
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [snpstd] C:\Windows\vsnpstd.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: STK017 PNP Monitor.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AdwareAlert Scanning Engine (AdwareAlertSrv) - Unknown owner - C:\Program Files\AdwareAlert\AdwareAlert.srv.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: iWinGamesInstaller - iWin Inc. - C:\Program Files\iWin Games\iWinGamesInstaller.exe
--
End of file - 5604 bytes
 
W

Wolfeymole

#2
Hello Paranoid

Welcome to Free PC Help

Please bear with us until our Malware experts get online and ***ist you.
 
Joined
Apr 27, 2008
Messages
7
#4
Followed your instructions but no error code was generated :( Would it come on automatically when the computer was restarted? If not, where would I find it?

Again, thanks for your help :)

Note: I tried running 'chkdsk' but even that wouldn't start!
 
Last edited:

Seth

FPCH Long Term Member
Joined
Dec 17, 2007
Messages
2,268
Location
Canada
Operating System
Windows Vista - Home Premium
#5
I doubt the chkdsk will help anyway, as if it were hard drive errors, you wouldn't likely get into Safe Mode.

When the auto restart is disabled, instead of the computer restarting, you would see a blue screen with white text that shows why the computer restarted.

I'm suspecting the issue is being caused by a driver or a farkled Vista update. I suggest the easiest fix would be to use Vista's "Startup Repair". The start up repair utility may already be installed on your computer as the link mentions, so try that first. If not use the other method that requires the Vista DVD.

If the repair doesn't work, we can try a System Restore.
 
Joined
Apr 27, 2008
Messages
7
#6
Where would I find the 'Startup Repair' if it has been pre-installed as I cannot recall receiving a Vista DVD when this computer was purchased?


Note: Have found the 'Startup Repair' utility and it found no problems and my earliest system restore point is a day after the pc started having problems. I downloaded the first service pack for vista after the problems and it worked fine for that night but was back to it's old self in the morning!

Is it anything to do with the 'msconfig' startup/service items?

Thanks
 
Last edited:

AdvancedSetup

FPCH Long Term Member
Joined
Jan 9, 2008
Messages
819
Location
34° 12' 35" N, 118° 29' 21" W
#7
Please look in your EVENT VIEWER and it should log errors that the system is having.

Click on Start - Run - then type in eventvwr or look under the Administrator tools section for it.

Look at some of the errors and report back what it says.

So can you logon without issue in SAFE MODE ?
 
Joined
Apr 27, 2008
Messages
7
#8
Sorry for the delay! Cannot start with 'Safe Mode', only method of logging on is through 'Last known good configuration'

What am I looking for in the 'eventvwr'? Which part of it is relevant to the problem? Is it in the 'Summary of Administrative Events'? :confused:

Apologies for being a bit of a novice and thanks again for the perserverance and ***istance.
 

Seth

FPCH Long Term Member
Joined
Dec 17, 2007
Messages
2,268
Location
Canada
Operating System
Windows Vista - Home Premium
#9
You're welcome.

I forgot to give you the link for the startup repair. Here it is:

Windows Vista Help: Startup Repair: frequently asked questions

I'd try a System Restore first though. Restore to a date about a week before the problem occurred.



•Open System Restore by clicking the Start button http://windowshelp.microsoft.com/QueryWS/GetOpenContent.aspx?***etID=4f6cbd09-148c-4dd8-b1f2-48f232a2fd33&DocumentSet=en-US&RenderKey=XML, clicking All Programs, clicking Accessories, clicking System Tools, and then clicking System Restore.* http://windowshelp.microsoft.com/QueryWS/GetOpenContent.aspx?***etID=18abb370-ac1e-4b6b-b663-e028a75bf05b&DocumentSet=en-US&RenderKey=XML If you are prompted for an administrator password or confirmation, type the password or provide confirmation.

Note: Before you start System Restore, save any open files and close all programs. System Restore will restart your computer.
 
Joined
Apr 27, 2008
Messages
7
#10
I have already tried that but the earliest system restore is a day after the problem began :( I installed the first service pack the day after the problem thinking it might remedy the situation, alas, to no avail.

The startup repair found no problems too :confused:
 

Seth

FPCH Long Term Member
Joined
Dec 17, 2007
Messages
2,268
Location
Canada
Operating System
Windows Vista - Home Premium
#11
At this point I'd run some good scans on it:

Your computer could be infected with Malware.
  • Malware is software designed to infiltrate or damage a computer system without the owner's informed consent.
    It is a combination of the words malicious and software.
    The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.
  • Required Cleanup Steps
    1. Run a Temporary files cleaner
    2. Disable the Spybot Search & Destroy TEA TIMER if enabled
    3. Run 2 Anti-Malware scanners
    4. Run an Online Anti-Virus / Anti-Malware Scanner
    5. Clear out old System Restore points
    6. If continued Malware type activity is present you may be asked to post a TrendMicro™ HijackThis™ Log file
The reason to run multiple scanners is to ensure that no single scanner is missing something.
The time it takes will vary depending on your system and your internet connection speed.
Typically the SUPERAntiSpyware and Malwarebytes scanners will take between 10 to 90 minutes.
The ESET online scan should take between 1 to 3 hours.
In most cases, these scans will suffice to clean and disinfect your computer.
Heavily infected systems or slower PCs can take much longer to scan and clean.

For best results print the following instructions and bookmark this Web page
To keep this guide printer-friendly, use your cursor to highlight the contents below.
From your browser select File - Print and in the printer dialog box under "Print range"
click the Selection choice to print out these instructions for removal of malware.​
__________________________________________________​

STEP 1
  • Disable Spybot Search & Destroys' TEA TIMER: (if installed)
    1. Run Spybot-S&D in Advanced Mode.
    2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
    3. On the left hand side, Click on Tools
    4. Then click on the Resident Icon in the List
    5. Uncheck "Resident TeaTimer" and OK any prompts.
    6. Restart your computer.
__________________________________________________​

STEP 2
  • Follow these instructions carefully.
  • Download ATF-Cleaner from Snapfiles.com to remove un-needed temporary files from your computer that may contain malware.
  • You can also download it from Majorgeeks.com
  • When you run ATF-Cleaner, check the items as shown below for Main.
  • For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
  • NOTE: If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
  • Then click on "Empty Selected".
.
__________________________________________________​

STEP 3
  • Install and run the free version (not the Professional version) of SUPERAntiSpyware from SUPERAntiSpyware.com
    • Accept any prompts to allow SUPERAntiSpyware to install the latest rules and infection definition files.
    • You do not have to send them your e-mail address, just click next.
    • You can leave the automated check for updates on.
    • You can uncheck "Send a diagnostic report to research center" if you don't want to send the information.
    • DO NOT allow SUPERAntiSpyware to protect your Home Page settings.
    • On the Top Left select the Scan your computer button.
    • Make sure there is a CHECK MARK on all Fixed Drives.
    • Click "Perform a Complete Scan". Click "Next" to Repair issues found and reboot the computer when prompted to do so.
__________________________________________________​

STEP 4
  • Install and run Malwarebytes' Anti-Malware from Malwarebytes - (direct download)
    • Accept all defaults for the installer
    • Allow the program to update the definitions
    • Click on the Quick Scan and click Next.
    • If any items are found allow it to clean them and then Reboot your computer.
__________________________________________________​

STEP 5
  • Run an online scan with ESET from Free Virus Scan: Use ESET's Online Antivirus Scanner
    • You must use Internet Explorer for this online scan. FireFox, Opera, etc will not work for this scan.
    • Accept the terms and click "Start".
    • Once the scanner is ready, check "Remove found threats" AND "Scan unwanted applications".
    • Click "Start" to begin the scan.
    • When completed restart your computer
__________________________________________________​
Make sure your internet firewall security is enabled, and then please return to Free PC Help and tell us how the computer seems to be operating.
At that time, you will receive instructions to ***ist you in removing malicious programs from your Add/Remove program list if warranted.

If required this is the download link for TrendMicro™ HijackThis™
Unless instructed to by the Technician helping you then do not download this tool.

Once you and the Technician agree that your system appears to be clean then you should delete all your System Restore points and recreate a new one.
Please follow the instructions here
How to turn off and turn on System Restore in Windows XP
How to turn off and turn on System Restore in Windows Vista