REstarts Unexpectedly...No BSOD or Stop Error 2

[Cutty201]

I have a windows XP pro machine here that has me completely bewildered. it just ... restarts like someone presses the reset button...now it isn't TOTALLY unexpected... It will DEFINATELY happened then I try to run SFC (it happens at teh very beginning) and it also happens when I try do a Virus Scan. This problem just happened today and the user of the workstation doesn't recall anythingthat she did that was out of the ordinary or if the machine did anything. All I can think of was I changed the power setting so the monitro goes to sleep after an hour. They said my boss...no IT i mean my employer boss...said AVG7Pro picked up a virus and he removed them. Any Ideas guys... OOh and I also already shut off "Automatically Restart" but like I said windows is not recieving any error. Any Ideas I really am out in left field on this one.

 

[aznluvsmc]

It's probably infected with a virus? Did you try booting into Safe mode and running a virus scan?

Steven S.
MCSA
A+, Network+, Server+, i-Net+, Security+

 

[kjv1611]

One option would be to just try rebooting, hitting F8, and choosing Boot with last know good working configuration, or however the option is worded... it will boot into Windows XP Pro normally, but if there were any recent changes that messed things up, it will kind of "undo" the changes causing the problem.

Stephen
"Jesus saith unto him, I am the way, the truth, and the life:
no man cometh unto the Father, but by me." John 14:6 KJV

 

[linney]

A few guesses for you to try if you like.

See if System Restore will get you back to a restore point before your problem with Windows.

Try Safe Mode (Do you have this problem in Safe Mode?).

Try running ChkDsk to check your drive for errors. Right click your Drive icon/ Properties/ Tools/ Error Checking. (If it wont run from Windows, use the Recover Console and use ChkDsk /r).

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

To get further information about any error look in your Event viewer.
Check any "Information" line that mentions "savedump" and you should find reference to "recovered from a bug check". This is the Stop Error that caused your problem.

Check all Services (Virus Scan related especially) and see if the Recovery option for any failing service is set to "Restart the computer".

Removing adware & spyware
faq608-4650

If they don't work you could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

 

[Cutty201]

Yes it has the proiblem in ALL the safe modes... errr if I do SFC /ScanOnce it reboots almost right after it starts. As for System Restore...errr ya... That's where the virus was... so um... i had to turn it off to get rid of it... but it's gone now

 

[linney]

The problem is finding out what it took with it. I always set my scanners to report (only) any virus so in the event I ever got one (touch wood that I don't), I can make sure I know what is going to be "cleaned" or removed.

That is also why it is handy to have System Restore functioning until the virus is safely removed. Then you can deal with System Restore. Anything in System Restore is not going to re-infect your machine unless you actually restore from it. And in your type of case restoring the virus (and a functioning machine) then removing the virus (again) surgically might (with hindsight) have been a better option.

Still, have a go with the remaining suggestions. Best of luck.

 

[Cutty201]

no ya see the Virus was IN the system restore files (the one you cant even look at), in fact such a situation happeend to me in the past and i wasn't even able to restore it would report an error.

 

[bcastner]

Since you can start in Safe Mode, right-click My Computer, Properties, Advanced, Startup and Recovery - Settings, and under System Failure uncheck "Automaticly restart".

Next, Start, Administrative Tools, Event Viewer. Is there a specific error message with a red icon?

If so, report it here.

 

[Cutty201]

I already did that I don't get any blue screen or error it just...restarts.. i has me totally confused..is there some tool that'll log everything continually or atlease files being accessed?

 

[bcastner]

I would then use this first:

http://oca.microsoft.com/en/windiag.asp

As a dircect answer to your question, yes there is a tool:

http://support.microsoft.com/default.aspx?scid=kb;en-us;823398

 

[linney]

The only way a virus should end up in System Restore would be if something containing the virus was deleted or modified and therefore saved by System Restore. Or a Restore Point was created when a virus was on your machine. This may imply that the virus is still active elsewhere on your machine, if as you say you only found it in System Restore and nowhere else. Where are your SFC files are they on the CD or have you a copy of them on the hard drive?

831829 - How antivirus software and System Restore work together

http://support.microsoft.com/default.aspx?scid=kb;en-us;831829&FR=1&PA=1&SD=HSCH

309531 - How to Gain Access to the System Volume Information Folder

http://support.microsoft.com/default.aspx?scid=kb;en-us;309531&FR=1&PA=1&SD=HSCH

Not every virus is detected by one single scanner that is why a second opinion is valuable. What do the AVG7Pro logs tell you about this virus it found, and where it found it, and what action was taken?

 

[Cutty201]

SFC Files are on the CD
Well the most recent virus, the one found today, was in The person's SysUpd.exe that ws in the persons temporary files, It then moved it to the Virus Vault, I BELIEVE this is when the problems started. I tried to restore it (even if it was still infected ) but this did not affect teh situation either way. So I deleted it (rest assured taht this wasn't the real System Updater). Anywho I am pretty sure I can rule out hardware. I think I am gonna just format and reinstall. I have another question however, is there anyway I can save all the Printer Drivers, Mapped network drives, etc. type of settings. The persons My Documents are kept safely on a remote server so that isn't a problem.

 

[Cutty201]

Also I would like to thhank you guys for helping out, actually this is really the first thread I have posted that I really have recieved help sad to say. I was beginning to stop posting here (not that I post all that much but).

 

[bcastner]

The only way a virus should end up in System Restore would be if something containing the virus was deleted or modified and therefore saved by System Restore.

Not to pick on linney, but this is just not true. If you leave your machine on 24/7, a restore point will be created roughly every 24 hours. If you turn off the machine, on average you should have a new restore point every three days.

linney has a strong point: any new device driver, Hotfix (usually), Service Pack (always) will trigger a new restore point.

And, you can force a new retore point manually through Help and Support.

 

[linney]

SysUpd.exe (info.).

http://www.google.com/search?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=SysUpd.exe

http://groups.google.com/groups?sourceid=navclient&ie=UTF-8&oe=UTF-8&q=SysUpd.exe

Drivers.

http://www.driverguidetoolkit.com

The purchased version might be better than the freeware.

Settings.

306186 - HOW TO: Use the Files and Settings Transfer Wizard By Using the Windows XP CD-ROM

http://support.microsoft.com/default.aspx?scid=kb;en-us;306186

306187 - HOW TO: Use the Files and Settings Transfer Wizard with a Wizard Disk in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;306187

293118 - HOW TO: Use Files and Settings Transfer Wizard in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;293118&FR=1&PA=1&SD=HSCH#2

You may have to re-enter some passwords afterwards for any ISP.

 

[Cutty201]

Hey guys I didn't even think of Event Viewer... I got a a couple of errors. 3 are for the CDrom having a bad block but that doesnt have anything to do with anything then I have these. Anything useful.
These 2 Errors happened...in sequuence twice... I think these are teh tiems it reset too..well one of the times
--
Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040206.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

--

The COM+ Event System detected a bad return code during its internal processing. HRESULT was 8007043C from line 44 of d:\nt\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.
--

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

--

 

[Cutty201]

As I scroll down, that happened (both in sequence "VSS" first then "EventSystem") 3 times... and this machine restarted more 3x's then this happenen 2x's today, these were warnings... I don't thnk this has anything to do with anything tho.

-------------
A provider, OffProv11, has been registered in the WMI namespace, Root\MSAPPS11, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

-------------

Also I downloaded that MSUS reporteing tool but I do not think I am using it properly. I am gonna continue to messaround with that.

 

[Cutty201]

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

(1337 BB code)

But yes I am gonna do that I think. Last calls. And please feel free to post any solutions that youthink of so i can kick myself later OR in case the reinstall doesn't actually work

 

[bcastner]

. I want you to check that your BIOS is up to date
. Download the setup/diagnostic utlity from the hard disk OEM manufacturer.

Run the non-destructive diagnostic tools. I strongly suspect a hardd disk error.

. linney suggested abvoe, but let me recommend again that if the hard drive passes the diagnostic testing you the under Windows, Start, Run, sfc /Scannow

Have you XP CD handy, as it likely will ask for it.

 

[jthiessen]

Check your processor temperature. If your fan has crapped out, this may cause restarts...

Josh

MCSE, CCNA, MCT, MCP