Auto reboot with automatic restart off...

Well, I spoke too soon.

The last couple of days the system (XP Pro SP2, new install, not an update) does a reset, restart, reboot (whatever) almost constantly. It will come after 3-10-?? number of cycles:

SI:
--------------------------------------------------------------------

OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 2 Build 2600
OS Manufacturer Microsoft Corporation
System Manufacturer VIA Technologies, Inc.
System Model VT82C692BX
System Type X86-based PC
Processor x86 Family 6 Model 8 Stepping 6 GenuineIntel ~933 Mhz
BIOS Version/Date Award Software International, Inc. 6.00 PG, 2/8/2002
SMBIOS Version 2.3
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume1
Locale United States
Hardware Abstraction Layer Version = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) "
Total Physical Memory 1,024.00 MB
Available Physical Memory 669.28 MB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 1.65 GB
Page File C:\pagefile.sys
----------------------------------------------------------------------

This system ran fine for a couple three months. I cannot be sure but it seems to me this started a few weeks back after a bunch of auto installed MS updates (which is now turned off). And when this started it was just an occasional time it would reset on startup and would be days even weeks in between. Auto restart was on then.

No problems on shutdown.

About 3-4 days ago it started doing this almost all the time so I turned Auto Restart off with no change. I have searched for some kind of log telling me what causes the reset but have not found anything as yet.

Yesterday I pulled all the hardware out except the mother board (Abit VH6 II), the main hard disk, mouse, key board and the video adapter and it still did it. Then I pulled the adapter out and reseated it and it still does it.

I have even swapped in a different key board, mouse, modem and video adapter with no joy.

I can come up every time I want to in safe mode. So I have less concerns now that hardware is involved. I have run all the tests that CheckIt and Sandra have to offer with no errors.

I have tried it in diagnostic mode using msconfig and it will still reset.

So if it will come up occasionally (1 in 3 to 1 in 10 or so tries) what is going on?

The timing is shortly after the XP splash comes up (anywhere between 3 and 6 passes of the 3 blue squares) the keyboard lights will flash and the screen goes black (expecting to see the cursor at any second) then the reset = Beep (then bleep too!).

Any help will be greatly appreciated!!!!

And please be mindful it may be awhile before I can get back here to read responses, etc.

 

The autorestart setting only really affects behavior if you have a bugcheck style crash where the OS gets confused and just gives up.

Your situation sounds more like the effects of a software malfunction. There have been several virus infections recently that would cause this sort of thing and I wouldn't be surprised if some spyware did the same sort of thing.

start -> run -> eventvwr.msc and take a look at errors and warnings in all three log files. Something may pop out at you.

Quicklinks from my signature and do an online virus scan to look for critters with the assurance that damage to your onboard AV program won't prevent them being found.

Quicklinks again and download the latest version of Hijackthis. Run it to scan and create a log file then post the log file contents here so we can have a look.

 

Newt,

Thanks very much for the help.

I checked the event log and I did not see anything that couldn't be explained, such as a DCOM 10005 error when I go into safe mode telling me "this service cannot be started in safe mode" and the like. No security events at all and an occasional Application Hang here and there plus a userenv 1517 whenever I shut down.

The following is probably more than you asked for but essentially all the scans I did showed nothing of consequence. The virus scans were clean and there were a number of MRU's from Ad-Aware so I posted those just in case.

I did scans using CA eTrust Antivirus Web Scanner, Trend Micro HouseCall, Spybot, Ad-Aware, Microsoft Antispyware, Norton AV and HijackThis. The results from HijackThis are posted at the end.
_______________________________________________________________

Ad-Aware SE Build 1.06r1
Logfile Created on:Saturday, October 29, 2005 12:50:34 AM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R72 26.10.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

10-29-2005 12:50:34 AM - Scan started. (Full System Scan)

MRU List Object Recognized!
Location: : C:\Documents and Settings\Doug\recent
Description : list of recently opened documents

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\direct3d\mo

strecentapplication
Description : most recent application to use microsoft direct3d

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct3d

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\direct3d\mo

strecentapplication
Description : most recent application to use microsoft direct X

MRU List Object Recognized!
Location: : software\microsoft\direct3d\mostrecentapplication
Description : most recent application to use microsoft direct X

MRU List Object Recognized!
Location: : software\microsoft\directdraw\mostrecentapplication
Description : most recent application to use microsoft directdraw

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\directinput\m

ostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\directinput\mostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\directinput\m

ostrecentapplication
Description : most recent application to use microsoft directinput

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\internet

explorer
Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\internet

explorer\main
Description : last save directory used in microsoft internet explorer

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\mediaplayer\

medialibraryui
Description : last selected node in the microsoft windows media player media library

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\mediaplayer\

player\recentfilelist
Description : list of recently used files in microsoft windows media player

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\mediaplayer\

preferences
Description : last cd record path used in microsoft windows media player

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\mediaplayer\

preferences
Description : last playlist index loaded in microsoft windows media player

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\mediaplayer\

preferences
Description : last playlist loaded in microsoft windows media player

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\microsoft

management console\recent file list
Description : list of recent snap-ins used in the microsoft management console

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\ntbackup\log

files
Description : list of recent logfiles in microsoft backup

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\office\8.0\ex

cel\recent file list
Description : list of recent files used by microsoft excel

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\search

assistant\acmru
Description : list of recent search terms used with the search assistant

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\applets\paint\recent file list
Description : list of files recently opened using microsoft paint

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\applets\regedit
Description : last key accessed using the microsoft registry editor

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\applets\wordpad\recent file list
Description : list of recent files opened using wordpad

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\explorer\comdlg32\lastvisitedmru
Description : list of recent programs opened

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\explorer\comdlg32\opensavemru
Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\explorer\recentdocs
Description : list of recent documents opened

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows\cur

rentversion\explorer\runmru
Description : mru list for items opened in start | run

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\nico mak

computing\winzip\filemenu
Description : winzip recently used archives

MRU List Object Recognized!
Location: : .DEFAULT\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: : S-1-5-18\software\microsoft\windows media\wmsdk\general
Description : windows media sdk

MRU List Object Recognized!
Location: :

S-1-5-21-1606980848-2111687655-1957994488-1003\software\microsoft\windows

media\wmsdk\general
Description : windows media sdk


Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:03:45.93
Objects scanned:98111
Objects identified:0
Objects ignored:0
New critical objects:0
----------------------------------------------------------------------------------------------------------------

Norton Antivirus:

Definations; 10-26-05

Scan results:MBRs scannned : 2
Master boot records infected : 0
Master boot records repaired : 0
Boot Records scanned : 7
Boot records infected : 0
Boot records repaired : 0
Files scanned : 76423
Threats detected : 0
Files repaired : 0
Files quarantined : 0
Files deleted : 0
Files excluded : 0
-----------------------------------------------------------------------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 9:56:54 AM, on 10/29/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
F:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
F:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
F:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
F:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\Atiptaxx.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
F:\Program Files\Logitech\MouseWare\system\em_exec.exe
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
F:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Messenger\msmsgs.exe
F:\unzipped\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet

Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} -

F:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Program

Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -

F:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Zone Labs Client] F:\Program Files\Zone

Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]

C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program

Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [gcasServ] "F:\Program Files\Microsoft AntiSpyware\gcasServ.exe "
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe "
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [3c1807pd] C:\WINDOWS\SYSTEM32\3cmlink.exe RunServices

\Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices

\Device\3cpipe-USRpdA
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Norton SystemWorks] "F:\Program Files\Norton

SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A}

/MODE CfgWiz
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &ieSpell Options - res://F:\Program

Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://F:\Program

Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Download with GetRight - F:\Program

Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - F:\Program

Files\GetRight\GRbrowse.htm
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} -

F:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8}

- F:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} -

F:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options -

{1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - F:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -

http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -

https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.c

ab?1123334176657
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) -

http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -

https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Ati HotKey Poller - Unknown owner -

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec

Corporation - F:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec

Corporation - F:\Program Files\Norton SystemWorks\Norton

AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation -

F:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - F:\Program

Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - F:\Program

Files\SiSoftware\SiSoftware Sandra Lite 2005.SR2a\RpcSandraSrv.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Program Files\Norton

SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation -

C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation

- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation -

F:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC -

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
______________________________________________________________

I installed the Recovery Console and I can get into it along with safe mode any time I try but not into XP P. Confounding to say the least.

I read another thread where the author was having some strange boot problems and a responder commented on the battery possibly being weak. Mine is about 3 years old and I will replace it but I do not suppect it is the cause of this prorblem since I can get into safe mode and the Recovery Console.

Is there something else I can/should do before I consider a reinstall?

Doug

 

Something I forgot to mention is I ran the System File Checker too but if it produced a log I have yet to find it. This is the first I have run it under XP P. I am used to the 98SE version.

 

It appears that I have "cured" the original problem by re-running SFC.

Even though I had run it a day or two before threre was no evidence in the event log. IIRC I had run it the first time in the safe mode. Perhaps having run it in safe mode "prevented" it from showing up in the event log. Now I know I ran it before because sfc /scannow was in the run historical entries and I distinctly remember having to find my original XP P CD, loading it and replying a retry.

Now a new problem has cropped up and I will post the issue in the XP forum and return here with the link.

Edit: Here is the link: http://www.windowsbbs.com/editpost.php?do=editpost&p=263638

 

The problem seems to be Zone Alarm. I reinstalled ZA (free) and the auto reboots at win startup came back. I removed ZA (as best it does), ran sfc again and the problem is gone again. No more ZA on this OS for me.

Now I need a different firewall. I have lost confidence in using ZA on XP P. At least the current version of ZA anyway.

 

It does seem like we are reading of XP PCs that have issues with ZA. Shame too since it has been such a solid product for so many years. Ah well. So was Norton.