WHAT HAPPENED??

[subratam]

dont know what happened..!!!
i was just using my computer surfing sites (kaspersky, and mainly in opera...) when suddenly my computer restarted :-\
checked with TDS, Trojan Hunter SpyBot and have kerio2X
nothing wrong came out...
nothing wrong i am seeing also... what could have happened??

[subratam]

i was waiting for a reply but cant wait anymore... this time i was with wildersecurity site and downloading PC-Cillin 2004 internet security through DAP
then i just wrote google and pressed enter
and.... my computer again restarted :'(
WHAT IS HAPPENING??

[Jooske]

First question, did you check all your plugs and the wires for being ok?

[subratam]

nothing wrong in my plugs and wires....

[LowWaterMark]

It's almost impossible for us to say what's happening subratam since the things you describe would not normally cause a problem (they are just standard functions as I know you are also aware).

The problem is that you've been doing a real lot on your system lately, as is seen by your posts here the last few days. There could be conflicts with software installed, or problems because of the patches you've recently installed, or many other things.

My best recommendation at this point is to first make sure you have no physical problem: check all cables and power to make sure everything is plugged securely. You may want to check the CPU box to see if the fans are running okay and keeping the processor cool enough (hear problems can cause system issues).

For non-physical causes... You either need to find a recreatable circumstance that always causes the problem, which may point us to the root cause, or you may have to start stepping backwards in the things you be installing and updating on your system. What was the last install or configuration tweak you made prior to the problem starting? If you reverse that and the problem stops, then that was probably the root. Or, you may need to reverse a few of the last things you've done until you reach a stable point.

[subratam]

lemme tell you what i hav done today...
i checked the IE securities... and did modifications in my IE settings as was adviced through my IE 6 service pack 1 post... i had browser helpers like NAV and google toolbar in my toolbar
i had to go out so i hibernated my win2k and when i came back i accessed internet to see the google and NAV helpers not thr.. when i went to reinstall google toolbar it said i hav disabled browser helpers... anyway nothing wrong
i mostly was doin my job in opera after that... i hav made activex as prompt and other active x disabled so whenever any page asks for activeX i disallowed except for yahoo.com, about.com etc trusted sites...
then suddenly machine restarted
my trojan remover checked on start up, so did spybot i ran TDS and trojan hunter... AVG and NAV are present with their resident shields... nothing wrong no where...
i hav p4 2.4 GHz and 256 DDR ram and 40 Gb hard disk of which i dont have junk softwares as you might know i have said before...... i just have more than one security softwares.... thats it... now do u say i have to uninstall security softwares??
i did not keep my computer on for atleast 6-7 hours .... and then again for 2 hours..

[Pilli]

Have you checked your event log?
Control panel - Administative tools - event viewer, If you right click on the events and check the properties this may help you diagnose your problem:

HTH Pilli

[LowWaterMark]

Yes, check the event log as Pilli says.

Also, what exactly do you see when this happens? Does Windows just disappear and the boot process shows? Does it show some kind of shutdown sequence? Any clues at all?

-{ Quote: "i just have more than one security softwares.... thats it... now do u say i have to uninstall security softwares??" }-

Maybe. The problem is you have to find the root cause manually, probably through trial and error, eliminating one possible cause after another. You take just one step at a time until you reach the exact point where the problem no longer occurs. Then you start moving forward again to see what causes the problem, and then you'll know.

Unless someone comes along who has seen this exact circumstance before and has a specific recommendation, all you can do is try to isolate the problem yourself.

It could be anything. One of the recent patches conflicting with the settings you've changed and the programs you are running...

You need to look at every install / update / config / tweak you've made and start reversing them - last one first, working your way backwards... These kinds of problems are extremely hard to find because there are no errors showing.

[subratam]

its not happening (the restart) for long time now... let me see... for some more time...
about event log.. nothing that wrong i could see, one thing i do see is.. Microsoft (R) Windows 2000 (R) 5.0 2195 Service Pack 4 Uniprocessor free..
one thing i should mention here a error it shows not of now but around 7 hours back my GFI lan guard security scanner terminated unexpectedly....i ran now and it says null session established. (4/6) error (1,5)access is denied connection to IPC$ has been refused.. dont know whether its related or not...
what had happened was that the screen went black and boot process started and restarted ... by god's grace.. its been sometime now that theres nothing wrong

[Jooske]

If it is not the plugs and wires and cards all ok and connected properly...........
once looking in the event log maybe good old DrWatson can tell more?
or if there are conflicts which should show up there.....
For your own ease it's good to look first at the physical parts.
Did it all start today all of a sudden or has it happened incidently before?
No noices or other new happenings, if all that is ok then up to the software........
after having looked in the events log i guess.
Does your autostartviewer or hijackthis log show something new or missing?
Step by step, not all at the same time.

[subratam]

i just checked TDS again if there would have been any change it instantly says there has been a change in autostart registry.. its almost 2 hrs nou... nothings wrong till now....
this kind it happened today only... maybe some power failure or like that
anyway i will give my hijacklog if anything doz go wrong anywhere
Logfile of HijackThis v1.97.6
Scan saved at 3:59:23 AM, on 11/20/2003
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\GFI\System Integrity Monitor 3\cfservice.exe
C:\Program Files\GFI\LANguard Network Security Scanner 3\sscansvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\Norton CrashGuard\CGMenu.EXE
C:\PROGRA~1\DAP\DAP.EXE
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
C:\Program Files\Tray Wizard\TWizard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Desktop Architect\datray.exe
C:\Program Files\FreeMem Professional\fmempro.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\mdm.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\Avp32.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Happy Surfing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O1 - Hosts: 203.161.127.141 www.dcsresearch.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINNT\Downloaded Program Files\ycomp5_2_3_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINNT\Downloaded Program Files\ycomp5_2_3_0.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [Norton CrashGuard Monitor] "C:\Program Files\Norton CrashGuard\CGMenu.EXE"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe
O4 - HKLM\..\Run: [Tray Wizard] C:\Program Files\Tray Wizard\TWizard.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.7\THGuard.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OfficeGuard RegChecker] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\ogrc.exe"
O4 - HKLM\..\Run: [AVPCC] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\avpcc.exe" /wait
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Desktop Architect] "C:\Program Files\Desktop Architect\datray.exe" -S
O4 - HKCU\..\Run: [FreeMem Pro] "C:\Program Files\FreeMem Professional\fmempro.exe" autostart
O4 - HKCU\..\Run: [iolo Task Agent] C:\Program Files\iolo\Common\Task Agent\Task_Agent.exe
O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~1\INSTAL~1\{7F5E2~1\Setup.exe -rebootC:\PROGRA~1\INSTAL~1\{7F5E2~1\reboot.ini -l0x9
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinstc.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37929.4057986111
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Companion) - http://us.dl1.yimg.com/download.companion.yahoo.com/dl/toolbar/yiebio5_2_3_0.cab

to say again.. its all normal for a long time now...

[Jooske]

The change in the autostart, had that to do with settings or new installs, a windows update or that kind of thing?
Not anything unexpected?
It can happen if you had no Quicktime key in autostart and used the QT, it immediately (annoying!!!) adds itself to the autostart again, causing an autostart change alert.
Can be such little things.

I see you have the mdm debugger on in the autostart and the msn messenger qm which are not the cause of the problem but you can do without.
I have in the IE settings (advanced tab) it is not looking for script errors and not telling me about them in web pages as those are not my problems as a visitor so i don't need the debugger up all time. It could give problems with other programs like Port Explorer if it is active --never tried if it does-- so it could with others.
The qmload you can just delete from the autostart as it's just the promotional part of MSN messenger unless you like that advertisement.
None of the items mentioned i would see responsible for the reboot, but it could be you have so much stuff running the system doesn't know anymore what to do in certain conditions and just reboots.
It happened with scans, so did you have all the scanners / protection active at the time of the online scans?
I'll tell you i have several scanners on my system, but not all of them in the sutostart: i start TDS manually after reboot and that is up after that all time, WormGuard is always up in the background and Port Explorer i start manually after the reboot so i can see immediately if there are suspicious connections. The other scanners i would choose only one to run resident so i'm looking forward to the TDS Active Guard for that and there can be another antivirus solution running constantly. But i start them manually, the one today, the other another time, not all of that stuff together.
I got myself rid of all those extra system protections and monitors and anti-crash tools and the whole lot and my system runs much better and stable without all that.
Frees lots of resources, no more sudden reboots nor frequent blue screens, etc.

If all the wiring, plugs, other hardware are not the problem you could look into what you did exactly just before the rebooting started, or in the msconfig uncheck all those extra's and try again and you can try putting one by one back which you really need to see after which it starts again.
There is no need to have all the guards up and all the scanners active all time: just one at the time and start others manually at wish for a scan.

[root]

FWIW, Nortons CrashGuard is likely to cause more problems than it will fix. I have never found a crashguard type program that worked well.
I would suspect that as a possible cause.

[Hyperion]

Check your CPU temperature and check your power supply.I had similar problems when the power supply was slowly dying.
Unexpected restarts with no regularity and without precise events.

[subratam]

nou nou... you all are going to know what happened since then.... i did download KAV and the KAV IMON whenever i was enabling it the machine was standing still until i disable it... nou one last time i tried to enable it.. the machine hanged and... i tried to log off it did not and i restarted....
what did i face??
the machine comes to welcome screen no taskbars nothing... hmm it happened another time with me before.. himem.sys was corrupted.. i dont know what happened this time...
i tried last good config .. safe mode was happening well but anyways.. later i installed LINUX and also formatted my boot drive
all went well till i started updating my computer again....
this time as i was adviced... was keeping only required security softwares... namely EZarmor AV, AVG all latest updates and licensed... kerio2X firewall and TDS-3 running...
i updated IE 6 restarted and... there came one window with question application IEXPLORER.EXE with some md5 change it with a same name... i for a moment thought what i dont know i accepted....
all was going well and again another request came after rebooting the same type i denied and IE was not working so i had to accept..
then i was updating windows and that was it
i rebooted for the installation to take place and lo.. its gone...
the machine comes to "windows 2000 is starting up" and reboots oh 1 thing i got one physical dump message and as was adviced by jooske other day i did go to my comp properties advance and dump-none i dont think its for that but as one of my friend said... its something malicious that is comin with request of changing iexplorer.exe...
now i am getting ready to format my computer again... this sucks really...
what the hell is going on.... i started windows in debugging mode it gave a stop 17 error and adviced to run system diagonistic... since cleaning and formatting windows i did just open symantec site and wilders and windows.... after running spybot and adaware " alexa and some other windows spyware was present"
:-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[ :-[
can someone give me a step by step way towards secured life... after i format again...
(OH BY THE WAY I AM WORKING IN SAFE MODE WITH NETWORKING NOW.... CAUSE I HAD TO INFORM YALL ABOUT MY LATEST POSITION I AM USING OPERA AND KERIO IS WORKING AND HAVE ONLY ONW WINDOW THAT OF WILDERS OPEN :-\ ???)

[subratam]

ANYONE !!!!!!!!!!!!!! PLZZZZZZZZ HELPPPPP :'( :'(
where r yallllll
man i need genuine help....

[root]

It is possible you have a hardware problem such as the Power Supply, harddrive or as mentioned, temperature problems with the CPU.
If I were in your shoes, here is what I would do. Take it for what its worth.
I would make sure I have all my important files, bookmarks, program keys, passwords, etc backed up.
I would then make sure I have Win2k and SP3, or SP4 if you want it, Kaspersky, SSM, and a firewall handy, I prefer Outpost, but Kerio, ZA, LNS, Tiny, or Sygate will work for the time being. If you have Symantecs firewall, ok, but do not install anything else from Symantec if you start with Kaspersky. With Kaspersky, you can hold off on an AT for the time being while you try to sort this out.
So I would Format and then do a clean install of Win2k and SP3 or four, WHILE DISCONNECTED FROM THE NET.
Install your fireall and set it up making sure ports 135-139 and 445 are BLOCKED. Install SSM and make sure it is set to monitor applications. Install KAV and then you can connect to the net and update it.
You have a LOT of stuff installed and running resident at bootup. Much of that can probably be eliminated and you would never know the difference.
Go easy on installing more software, while you try to determine if you still have a problem.
I will tell you what I do for secure, safe and fun surfing. It is not so complicated.
First, the only MS software I use is WIN2k. I use Opera for my browser, and Poco for email. Just using those two apps eliminates the majority of exploits that float around on a daily basis.
I use KAV and update at least twice a day. SSM always runs. I use Outpost Firewall and have my computer locked up tight as a drum with it. I run Spybot every once in a while, but never find much with it.
I don't do chat, irc, download form newsgroups, nor do I use any filesharing applications. I do go to sites that host viruses and trojans and download the same for testing from time to time.
Security is not about paranoia, it is about using your head and a safe email client and safe browser. And watch what you click.
Try some setup like this for a bit and see if you still have problems. If you do, then you need to suspect hardware.
Hope this helps some, if not let us know. Someone here will be able to help.
I'm tired and may have missed some things. This is not meant to be a step by step approach to be taken literally, rather it is something like I would do in such a case.

[Primrose]

Hi sub,
You are loading up the win2000 with too much security software and you can not run them all at the same time..and you have to fully unistall those you are not going to use.

Too many conflicts.


also you made this statement...

GFI lan guard security scanner terminated unexpectedly....i ran now and it says null session


I know all their products...are you talking about this..


http://www.trojanscan.com/lansim/

or some of their other free product ???


http://www.trojanscan.com/


GFI LANguard Network Security Scanner (N.S.S.)
http://www.trojanscan.com/pages/prodinfo.htm

tell me which one???


You should not be downloading and using that stuff for a single win2000 PC..

Good luck ;) and slow down with all the security goodies.

[subratam]

thx again :) but one thing i got very well now how may secured it can be nothing is best than LINUX.. as i said i installed LINUX and now i am using LINUX to go to cyber space.. i have formatted Win2K and already updated to s.pack 4... i hav done IE6 and thats it.. i had first installed Kerio with default firewall rules and made some enhancement like blocking file sharing.. though i am now limiting my net usage from windows... i am using LINUX.. and hope it will be better
to say about "root" thanx and thaanx and thanx a looooooot i will keep the post in my notebook... its a great tips for anyone to lie secured... :)

[illukka]

yeah, like John said, you have, if i saw right, three antivirus monitors loading at startup... it's a wonder that the machine even starts...keep the av's but make only one monitor to load at startup.. you have so much security software, can you do someting with your pc besides running security apps?

[subratam]

hahha illukka,
ya i have got rid of all and started afresh.. you might not hav seen my last post ... i hav just finished formatting my boot drive and configured firewall and thats it.. i am going to limit using internet from windows and right now i am using LINUX and am not seeing any reason to switch to BLindows ;) .. its safe here from ALMOST all dangers out there in cyber space...
about three AV monitors and too much security softwares i admit it was gettin a lill too many.. this time i am going to install only NAV internet security, kerio is done as firewall and spybot and spywareblaster and TDS-3
thats it with AVG with resident shield whenever i am in windows (ofcourse as less i can and mostly offline)

[illukka]

we were probably posting at the same time ;D