Creepy Freeze-ups & Restarts

Hi,

I'm at my daughter's house and tending to this XP Pro system. I was here yesterday and was reinstalling some printer software. Yesterday, the PC went nuts and I cannot find the problem.

It loads the desktop and then the Windows Task Manager shows resources being hogged down to 100 %. Then, either the screen freezes up or the PC will restart itself.

I can only use this thing, like now, in Safe Mode with Networking. It works okay like this. I had the latest Norton definitions and did a scan and no problems indicated at all. No RPC warning box comes up like the one worm caused a while back now. All I get is a hogged down PC and then a freeze or restart.

HELP ME???????

I'm only here for the next couple of hours or so and feel so bad that I was on this thing when the hiccup or whatever happened. I have removed the printers, removed the AV......desperately trying anything.

Some help, as always, is more appreciated than you know and I thank you all in advance for your consideration.

Randy

P.S. Restore points are no longer an option as I turned Restore off trying to fix this thing.


EDIT
....out of curiousity........
what is this startup item I have in my Control Panel startup applet? It reads:

KernelFaultCheck %systemroot%\system32\dumprep 0 -k

Is this a good thing or something suspicious??????

 

That surely sounds like virus-caused behavior and specifically the timing is right for one of the Zotob varients that was/is making the rounds this week. If your Norton pattern files aren't the very latest and if the PC isn't patched up to at least MS05-039 the critter can hit and take over the PC with no warning from your AV. One of the first things it does is modify your hosts file so you can no longer reach most of the sites that could help fight it.

If you can get the cleaner utility from the link in post #5 Here the download and run it.

 

dumprep 0 -k (Dumprep.exe = Windows Error Reporting Dump Reporting Tool )
Used in connection with memory dumps - you can customize or disable these by - right clicking on My Computer, selecting Properties and then the Advanced tab. Click on the Settings button in 'Startup and Recovery'. In the bottom pane named "system failure "- under 'Write debugging information' - you can modify this.

Mine personally is set to:
*write an event (checked)
*send admin alert (checked)
automatically restart (definitely unchecked) members here always recommend this. If not unchecked xp will reboot when it chokes on an error rather than give you an warning error. (Effect is random reboots).
*small memory dump (selected from drop down)

NOTE: "Windows Error Reporting" can also be enabled or disabled, depending upon whether you find this useful or not. This is done using the same getto instructions but it is customized by a button labeled "Error reporting" seen at the bottom of the "advanced tab ".

===========
As Newt so wisely pointed out, one of the two newest outbreaks of virus could be and should be suspected and eliminated, particularly if you have not updated lately. Your also on the right track by suspecting and eliminating possible startup confliction. Either something you have running does not get along with the printer or some process your printer has opted to have as a startup or running process does not get along. Some printers install and run processes that are known to be a problem when it comes to getting along with others.

===additional comments====
I hope you followed the install instructions and installed this exactly as instructed by the howtos. These installs can be fussy. The uninstalls and reinstalls can be a nightmare. Did you visit the support site for this product and see if there are known problems or updated drivers for XP?

Hi Newt...
It is good to see your familiar face and expert advice being posted again. I was wondering where you went. You were missed.

edit note from Newt: Thanks Ann. Things around my place went a little nuts for a while (not really anything bad - just too much of too much) and I didn't feel like I could visit regularly enough to follow up on threads I was helping with. Hindsight, I shoulda dropped a note on the forum to that effect though. Anyhow - all better now.

 

Newt,

I ran the utility by MS that you provided the link to. It reports nothing malicious is in here. I also ran the Zotob removal tool which reported that all is well from Symantec found here:

http://securityresponse.symantec.com/avcenter/venc/data/w32.zotob.removal.tool.html

Ann,

Thank you for all the cool info and I will surely act on it just as soon as I can pull this thing out of the ditch it's in.

I'm taking some time now and will run a very long scan from Housecall. I ran it earlier and it found one infection. When it went to scan my other physical drives, I cancelled and ended up not being told what it was. This time I will scan drive C only. I will run it again and post back.

Anyone have any more ideas for me?????

Thanx a whole lot, folks
Randy

 

Okay.....

I ran Housecall and all there was were two pesty adwares. It removed them. No virus...no worms

Now what should I try????

Randy

NEW DEVELOPMENT!
Now, when I go for the desktop without Safe Mode, I get a message that Windows recovered from a serious error. When I go to read what it is, two things are listed but the computer restarts itself way before I can hardly read them.....let alone write them down.

It does say that a log was created to the fact of the error. My big question to you now is where can I find the aforementioned log file so that I could copy/paste it in here and then you will probably be able to pin it right down as to what's happening.

Where do I find the log file of the latest error?????

Forgive me if I don't post back tonight as I have to go home soon and come back here tomorrow night.

HELP???????

Randy

 

Sorry to hear you didn't find any critters that would be easy to fix.

You can see the error logs by clicking on start, on run, keying in eventvwr.msc, and clicking OK. To post an event here, double click it open then click on the icon below the up/down arrows to send a text copy to your clipboard. You can then paste the results in a reply.

As to the rest, you need to make a change in the settings so the PC will crash to an informational screen and stay there until you reboot rather than just booting back up before you can see the problem.

Right-click on the My Computer icon, left-click on Properties, click on the Advanced tab, then follow the pictures.

 

Okay....I'm back here now. Thanks for the help while I was away.

I tried to set the PC so that it doesn't restart itself but it seems that my Alerter service is not running and, for the world of me, I cannot turn it on like the message tells me to.

Here is a copy/paste of what the error seems to always be. Does this make any sense to anyone and how do I fix it??? Error is as below:

Event Type: Error
Event Source: DCOM
Event Category: None
Event ID: 10003
Date: 8/19/2005
Time: 5:11:01 PM
User: N/A
Computer: SECOND
Description:
Access denied attempting to launch a DCOM Server using DefaultLaunchPermssion. The server is:
{00020906-0000-0000-C000-000000000046}
The user is Unavailable/Unavailable, SID=Unavailable.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

EDIT:

I've gone & tried the advice here:
http://support.microsoft.com/?id=290398

...trouble is (and I hope I know what I'm looking for) is that it seems like I have to run the command mdm.exe /regserver
When I try this, it says that it cannot find mdm.exe

.....just two bits from me here but maybe I'm not looking for Machine Debug the right way???????

Randy

 

Newt,

You wrote: Right-click on the My Computer icon, left-click on Properties, click on the Advanced tab, then follow the pictures.

I finally managed to do this once when the desktop was there, even though resources were hogged right down to 100%.

Now, if I try do anything in normal mode, I eventually get a blue screen. It's odd.....the PC will load and run quickly for a little while now and then something hits it hard and it hogs right down. No more error messages or restarts.

I'm pulling my hair out here already, people.

If I haven't followed instructions well or something, let me know and I'll try again. Just PLEASE......keep on posting to me, okay????

Randy
(signing off for tonight quite soon now and will resume again tomorrow)

 

Fixed it!

I fixed the problem!

After days of being left alone to think about this problem and trying to repair it, I've solved it.

To make a very long story, short, I rippped out every instance of anything to do with the Epson printer out of Windows and the registry.

I had installed a second printer here (my Lexmark) and then I went and installed all the goodies that came with my daughter's Epson disc, including some wonky software like Arcsoft or something. The printer worked well enough with just the drivers prior to my trying to improve something. From day one, some 2 years ago, she never installed "the works" with this printer.

I imagine I can get it all to be okay, two printers and all, if I only use the drivers but, to be quite honest, I'm a bit too shell-shot to venture there right about now. I'll leave sleeping dogs lie.

Thanks to Newt and Ann for their posts.......(big time thanks!)

Thanks to all who dared to ponder this one......

Live long and prosper.....and beware some printer software,

Randy

NEW DEVELOPMENT:

I have now been brave and reinstalled the Epson with its minimal amount to run. Drivers and a color monitoring utility are installed. I had a chronic failure of this PC again as soon as I did this. I have to run only the Lexmark. It would seem that these two printers will not share or play well with each other. Any ideas or thoughts on this matter are more than welcome.

 

Giving this a bump....

Hi again Randy,
Since you choose to update your last thread, in this post, with an edited addition of your new snafu as opposed to adding a new thread, many members may not see the new quest and problems your having. I wouldn't have noticed this myself had I not opened your post with the intentions of thanking you for your update on the final outcome. Looks like that would have been a bit premature. Editing your post does not flag this as an unread or new thread and will not send it to the top of list red flagged. Red Flag notifies members that this is a post with new info that should be read (if one is monitoring it for developments).

Sorry. I just don't have the energy right now to address the new issue. I have been up all night and was on my way to bed. Your "thank you" was going to be my last, before doing so. I will try to get back to your post after I catch up on some sleep. I hope that by bumping this back up to the top for further review by members, somebody will add additional ideas. Hang in there.