[sr-suicide]

Ah, that was simple. Thanks. I'll see how it goes... And report back.

[Advertisements]

I still have the problem unfortunately... Any ideas?

I'd rather not reformat since I have abut 10 gig of data to modify / burn before I can do that and with the random crashing... I'd probaly have do it in safemode and I'm not sure if all the programs I need to use would work...

[sr-suicide]

I still have the problem unfortunately... Any ideas?

I'd rather not reformat since I have abut 10 gig of data to modify / burn before I can do that and with the random crashing... I'd probaly have do it in safemode and I'm not sure if all the programs I need to use would work...

[kool808]

if you really want to keep those data safe, make a partition then put all your important data there. Then it would be safe to reformat the other partition.

[kool808]

If you dont want the win xp sp2, then try the win xp sp1a, without this update, you're wide open to re-infection, and you're just wasting your time.
Click here.


Try this Spy Sweeper, its a 30-day trial yet a very great tool just being sure these crashes is not done by lurking malwares. Have you done an online scan recently? I believe you have an AV installed yet, it could be corrupted by the malware so an online scan would be better.

Trend Micro or Panda Scan.

[sr-suicide]

I'm fully updated except for sp2. I tried Spy Sweeper and Panda scan (already tried Trend Micro scan) and I still have the random crash even though they found some spyware...

Hmm... How would I go about the seperate partion thing? I know how to create new partions but I would have no idea where to go from there.

[kool808]

What were the malicious programs detected? Did you take note on them?
For the partition thing you may want to read Partition Magic, or just use a simple fdisk at HERE. Create a startup floppy disk, use this at the boot up just after P.O.S.T. then create a new logical partition.

Partition/Format Your Hard Drive #1, #2, #3

Edited by kool808, 03 June 2005 - 05:30 AM.

[sr-suicide]

Thanks for your help. I won't have time to reformat for another week, so if anyone has any suggestions on what the problem might be, please post. Could it possibly be hardware related? I installed a new graphics card a couple of months ago but this problem has only started occuring very recently...

Spy Sweeper found:
The remaints of 'CWS' that I had removed about 6 months ago.
'MDS Search Booster'
'Rad Light DivX Player', another program I has removed ages ago.
'SaveNow - WhenuSave'
'Search 3 toolbar'
'Secuirty iGuard'
'Trojan-Downloader-DotCom'

Any more help would be greatly appreciated.

[sr-suicide]

Interestingly, the crash occured in safemode (with networking), at least that rules out my graphic card / audio card? (Whew, they cost me to much to die now...) Maybe it could be my RAM?

[kool808]

hello,
sorry for the late response. Based on the results that were logged on your scan results, I suspect that you have a malware, evidence is with the 'Search 3 toolbar' and 'Secuirty iGuard' have left some unwanted programs. Just to verify that this crashes are not caused by these malwares, please download HijackThis, save it to C:\HJT. Please read a short tutorial on it HERE. Then close all windows, disconnect from the internet, open HijackThis then press SCAN. Save the log result and then post it here.

If I have verified that you are infected with these malwares, we need you to post a HijackThis Log result then at Malware Removal Forum.

[sr-suicide]

Thanks for your time. Here's the logfile. It looks prety clean to me, but I'll leave that up to you guys to decide. ^^ One interesting thing is that I have never got the crash whilst playing a game... And I play for 2 or 3 hours a day so I realy have no idea whats going on...

Logfile of HijackThis v1.99.1
Scan saved at 9:52:36 PM, on 6/6/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe
C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Secway\SimpLite-MSN 2.1\SimpLite-MSN.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\warcraft iii\worldedit.exe
C:\New Folder\HijackThis1991.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-au\msntb.dll
O3 - Toolbar: ninemsn - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-au\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-au\msnappau.exe"
O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\System32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VGAUtil] C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Simp] C:\Program Files\Secway\SimpLite-MSN 2.1\SimpLite-MSN.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {FC67B4DF-0BD4-4F6E-9A90-AF7A9196D313} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FC67B4DF-0BD4-4F6E-9A90-AF7A9196D313} - (no file) (HKCU)
O16 - DPF: WebControlDeploy - https://grouper.com/...rouperSetup.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ub...s/GSManager.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg...v45/yacscom.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.co...ad/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1105699691075
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Service Client v.3.4) - http://ccon.futurema...lobal/msc34.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zon...ss.cab31267.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[kool808]

ok, your logs looks clean. lets get back to the chalkboard and try another solution.

[sr-suicide]

Think it could be the RAM? ALthough, my comp doesnt crash while playing games...

[archtech]

I am having quite the same issue, my reboots occur while using the internet (a T1 at work) or sitting idle. I thought it was a memory issue as well and changed the configuration for four 256 MB to two 512 MB. Same issue still occurs. My event viewer references wuaueng.dll and wuauclt after each reboot. I tried the same steps in your previous posts and I am at the same result. I however am on SP2. My browser is and always has been Firefox. I tried their recent patch but same issues. I want to avoid a rebuild do to this issue possibly arising with other users at my company. Im interested in your future posts/solutions.

[ILoveYou]

BUMP! I have the same issue!!!

[archtech]

One thing that I did try today was I went to Computer Management (right click my computer and select Manage) and click on the Services and Applications at the bottom and then highlight Services. I stopped the Automatic Updates service and then switched it to Manual. I have gone 4 hours of no reboots and counting...