In-depth scan goes to Windows XP Login Screen

[aaronb1232]

Hi there,

Recently, I've been running some scans on my Windows XP machine using NOD32 Antivirus v3. Usually, since they take about 2 hours, I leave the scan running and turn the monitor off while I go about my daily business. It's been working great since I got it last year.

However, recently, twice I've had this issue: when I get back to my computer and turn my monitor on again, I'm surprised to find that Windows XP is now at the user login screen, when I'd left it on the desktop to leave the scan going. I can't think of any reason why this is happening, since I've completed a full scan successfully yesterday morning. The scans I did last night and earlier today have given me this login screen when I return.

Since I'm away from the computer during the scan, its hard to tell if the scan's actually completing, or it reaches some error in the middle and crashes and the OS reboots. I think something's going on with the OS, because when I login to my desktop again, my Steam icon is at the bottom of my icon grid on my desktop, something that always happens when my OS crashes. Checking the event log, there are no errors, but about a half hour after the scan was started, it shows the event log as well as the other bootup programs all starting up, meaning somewhere during the scan it ran into a problem and caused the OS to crash and reboot I'm presuming.

Finally, if I go to my log files in NOD32, it shows the scan I'd initiated as "Scanning in progress" when there's nothing going on in the scan menu.

Any ideas? I get the feeling I'll have to actually watch a scan in progress to see what's going on, but I'd appreciate it if anyone could help otherwise.

[Rmuffler]

Hello aaronb1232,

You can try unchecking scan all files.

Thank you,
Richard

[aaronb1232]

Hi there, this is a follow-up. I've still been having this problem, and I'm wondering what disabling "scan all files" will actually do? Doesn't this defeat the purpose of a file scanner?

Either way, I'll disable it and run a scan now.

Edit: I've also found that the culprit is a BSOD that occurs in the middle of a scan with the message IRQL LESS THAN OR EQUAL. Unfortunately the thing goes by so fast I can't get the hex code down.

[aaronb1232]

Well, scan just finished and everything's clean. However, I'm a little unsure whether I should re-check these multiple "Scan All Files" boxes I've unchecked in the menus. Am I more vulnerable if these are unchecked?

[ccomputertek]

At first it sounded like you had a screensaver password set.You can uncheck " automatically restart " under your advanced system properties of start up and recovery options.Then download debugging tools for windows and analyze your crash.Also set your computer to never go into sleep mode and set for allways on for all, mabe a hardware driver is crashing when the computer tries to go into sleep mode during a long scan, if you in fact have it set to do so.

[The Chez]

Are you sure your PC is not going into 'Hibernate' mode while your away & the monitor is off? This would cause your PC to log you off & return to the welcome screen.

Check your power options. Go to control panel > power options and make sure all the settings are set to never. And under hibernate, make sure the box is not checked.

These settings will kick in after a certain time if you don't make sure they're set how you want them.

If I were you I'd run the scan when you have the time to watch whats going on, that way you'll have a better idea of what fix is needed.

[aaronb1232]

All of the components were already set to never turn off. I'm positive it's a BSOD.

Looking at the event viewer, it shows that the crashes were probably caused by errors in a source called IPNATHLP. I'm doing some research on it now but if anyone knows anything I'd love to hear it.

[ccomputertek]

you have to download " debugging tools for windows " and do file open, crash dump and point to your mini dump folder in windows or do a search on your computer of *.dmp files and open and look at the bottom of the results page, will tell you " probably caused by " program name ". you should set your dump files to small 64K size.in startup and recovery under advanced properties of my computer.the event viewer telling you about IPNATHLP won't help.

[aaronb1232]

Dump says it's caused by cmdguard.sys, which I'm guessing means my Comodo Firewall is the problem. What can I do about this? Is there some conflict between this firewall and NOD32? And if so, are there alternative free firewalls?

Thanks.

[ccomputertek]

search for firewalls on majorgeeks.com, windbg is usually very accurate at finding the culprit.you can also see / try make sure your using the latest version of your selected firewall.My friends kept crashing vsdatant.sys, which is a driver for zone alarm, all versions did this to him except when i had him try the latest as a last resort, he has no problems now.

you click the firewalls to the left of majorgeeks front page and sort by popularity at the top to see what others are using and highly recommend, pc tools and zone alarm seem to be towards the top.I never had a problem with any version of zone alarm crashing it's drivers, every system / config is different though and will yield different results for different people.

I would uninstall commodo in safe mode if it doesn't use windows installer files for it's setup, if it uses windows installer it obviously won't let you uninstall from safe mode.

try zone alarm free starting from the latest build of version 7, and if that doesn't crash your good, if it does then just use the latest build of version 8.Your pc depends on which version will play well with the rest of your system.

you can do google search " zonealarm previous versions " and get them all from that page.

zonealarm uses it's own installer and will let you uninstall from safe mode no problem, which is a good thing.

also with zone alarm there is a switch to put at the uninstall from the start menu shortcut /clean will make sure everything gets uninstalled.