BleepingComputer.com: Computer shuts down

Hi. For the past week or so, my computer has randomly shut itself down (3 times today). In the Events Log, the same error message appears each time: 'The Microsoft Antimalware Service service failed to start due to the following error:
The system cannot find the file specified'. The error ID is 7000. I'm running Windows XP Home edition with SP3. Avast anti-virus has detected nothing on a full system scan, and neither has Malwarebytes. Any ideas anyone?

Take a look, http://answers.microsoft.com/en-us/protect/forum/protect_updating/microsoft-antimalware-service/6d66ecbf-7846-4a39-bb7d-0811f6906fdc

FWIW: http://support.microsoft.com/kb/314357

Louis

Hi and thank you for your response. I've tried the links, which seem to sugggest removing Microsoft security essentials, but it doesn't appear in the list of programmes to remove (via the control panel), and using the method involving regedit, the subkey doesn't appear as listed in the instructions. The fan is working OK, so it's not overheating, but it is now shutting down after a maximum of around 20 minutes use. It's now not even long enough to run a full virus scan. I can't run in safe mode, because the keyboard needed to select the safe mode doesn't kick-in until the computer has started in normal mode! I've wasted the whole day in trying to resolve this! Any suggestions very welcome.....

Download/install BlueScreenView, http://www.nirsoft.net/utils/blue_screen_view.html .

Double-click BlueScreenView.exe file.

When auto-scan completes (screen comes up), click Edit/Select All...then File/Save Selected Items.

Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content and paste it into your next reply.

FWIW: System shutdowns may be a symptom of overheating...or of malware, among other possible issues.

Louis

Hi and thanks again. I tried the BlueScreenView, which reports no crashes. When the computer switches off, it's exactly like a power-cut (which it isn't), the screen simply goes black and everything is switched off. As I mentioned, the fans are working, and I've even removed the side panel of the computer just in case it was overheating. Everytime, in the eventviewer, it's the same message:
The Microsoft Antimalware Service service failed to start due to the following error:
The system cannot find the file specified.
I can't find a way of removing the microsoft antimalware service, and I tried re-installing security essentials, but each time an error message appears to say that it cannot complete the install. I've tried the stop and disable msmpsvc commands, but it doesn't make any difference...

Not much to work with, IMO.

Can you access Windows Update?

Do you have Avast and MSE installed together?

System manufacturer and model?

Louis

In my experience, overheating is usually the primary culprit for sudden shutdowns. I know your fan it running fine, but have you checked the internal temperature sensors? If not, try downloading SpeedFan and let it run until your system shuts down.

Hi and thank you for your replies. I realised last night that I could use msconfig to get it to start in safe mode. I ran two simultaneous scans, Malwarebytes and Avast. They took over 3 hours (nothing found) and the computer ran perfectly throughout that time with no shutdowns. So it seems that overheating is definitely not the cause. The computer itself is non branded. All I can tell you is that it has windows home sp3, AMD Athlon 64x2 dual core processor 4200+, 2.9 GB RAM, NVIDIA GeForce 6150. I do have MSE and Avast installed together and I do have access to windows update. I'm sure if I could get rid of MSE it would probably solve the problem.

Please...go to Add/Remove Programs...uninstall both MSE and Avast.

Run the chkdsk /r command. Start/Run...type chkdsk /r and hit Enter. Type Y in new screen and hit Enter. Reboot...the command will run and then boot into Windows when command has completed.

Then download/install the latest version of either (but only one), update it and then run a full scan of your system.

Louis

Hi. The problem is that MSE does not appear in the list of programmes to remove. In the original link that you kindly sent, there was an instruction to remove the MSE run key. It said, 'locate the following subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run' then click to delete MSE in the right hand details pane. I've attached a screenshot of the pane, and MSE doesn't appear anywhere. In fact, I can't find any registry reference to it anywhere, but it must be on there somewhere to be causing the error message 7000!

Well...you could do a aearch of both your registry (using regedit)...and your files (using the Search function)...if you really want to see if MSE components remain.

You could also take a look at services (Start/Run...type services.msc and hit Enter) and see if quoted service exists.

There doesn't have to be a mystery as to what exists on your system.

Louis

This post has been edited by hamluis: 18 August 2011 - 11:14 AM

Hi. I know next to nothing when it comes to computers, so everything is a mystery to me. I tracked down the MSE antimalware, and I've attached a screenshot of the registry location. I don't know what I should do to delete it though...

Hi. So doesn't anyone know how I can remove these entries from the registry? If I right click them, I simply get a message to say 'Cannot delete all specific values'. Re-installing MSE doesn't work, using the Microsoft 'fix this for me' download doesn't work, and I can't find a way to uninstall the damn thing! It seems that every time the Microsoft anti-malware (which I think is the only component of MSE left on this computer) kicks in, in order to check something out, it cannot locate whatever other files it needs to operate, and just shuts down the computer. I suspect that Ccleaner probably messed up the registry entries at some point. I did a system restore to way before I began having this problem, but it hasn't made any difference.

<<I suspect that Ccleaner probably messed up the registry entries...>>

That would have been useful information...to put in your initial post.

Bleeping Computer DOES NOT recommend the use of registry cleaners/optimizers for several reasons:

• Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.
  
  The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.
  
  
• Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.
  
  
• Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.
  
  
• Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.
  
  
• The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.

• Ed Bott's Webog: Why I don't use registry cleaners
  
• Do I need a Registry Cleaner?

My suggestion would be to either run the sfc /scannow command...or do a repair install of XP...to negate the possibility of damaged system files.

How To Use Sfc.exe To Repair System Files - http://www.bleepingcomputer.com/forums/topic43051.html

How to Perform a Windows XP Repair Install - http://www.michaelstevenstech.com/XPrepairinstall.htm

Louis

Hi and thanks for the info. I'll run the scannow and see what happens. Meanwhile, I'll stick a health warning on the Ccleaner. Thanks for all your help (and patience).