Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer Restarts Itself Continuously After Windows Xp Boot Screen


  • Please log in to reply
7 replies to this topic

#1 kneesock

kneesock

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 05 September 2007 - 10:10 PM

First of all, thank you to anyone who is going to help me with this. I have come to this website before to get help with the same computer about 2 years ago and you guys cleared the problem up very quickly! Sadly to say, I am back, and hopefully for the last time.

Okay, right now I am on my laptop. I am having problems with my other computer. It is a Dell, and runs on Windows XP. I have noticed some strange happenings with it over the last few weeks. I've run multiple virus scans on it when I noticed it was acting funny and deleted anything it came up with. I used Ad-Aware SE Personal, and also Spybot Search and Destroy to remove the potential viruses. The next thing I noticed, was that my homepage was always resetting itself to "http://www.bydou.com/" and everytime I would turn on the internet (I use a wireless broadband card), this would be my homepage. I would then change it, but everytime I turned off my computer and came back to it later to get on the internet it did the same thing.

Today, about 20 minutes ago, I tried to get on the computer. This is the major problem. I pressed the button to turn it on and it acted normally up to the Windows XP boot screen (with the blue loading bar), the screen went black after that was done, and I heard my computer restart! Well, this happened continually, so I turned off the main switch, gave it a rest, turned it on again and it did the same thing! It just keeps restarting itself for no reason. Needless to say, I can't give you a HiJackThis log because I can't even get my computer to turn on. :thumbsup:

Hopefully you guys can help me with this! I really appreciate. Feel free to ask any more questions if need be. Thanks!
"Your luck has been completely changed tobay."
- Fortune Cookie

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:51 AM

Posted 06 September 2007 - 01:02 AM

Hello kneesock and :thumbsup: to Bleeping Computer.

Can you boot your computer into Safe Mode? If so, try running your antivirus and antispyware scans there.

How to start Windows in Safe Mode
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 WinCrazy

WinCrazy

  • Members
  • 265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ambler, PA USA
  • Local time:08:51 PM

Posted 06 September 2007 - 02:21 PM

Hi kneesock.

Crashes, Freezes, Some BSODs, Unexpected Shutdowns & Restarts (oh my)




#4 kneesock

kneesock
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 06 September 2007 - 03:43 PM

Sadly, it's still doing it. :thumbsup: It won't boot up into safe mode either. Here are the things I tried when tapping F8, and after seeing the options on that screen:

- Safe Mode, nothing happened, it went black and restarted itself again.

- Safe Mode with Networking, " "

- Safe Mode with Command Prompt, " "

- Disable Automatic Restart Option on System Failure, Nothing happened, it restarted itself, I got a screen that was blue that stated "STOP: c000021a {fatal system error}. The windows logon process terminated unexpectedly with a status of 0xc0000034 (0x00000000 0x00000000). The system has been shut down."

- Last Known Good Configuration (your most recent settings that worked), nothing happened, it went black and restarted itself again.

- Debugging Mode, again, nothing.

- Directory Services Restore Mode, it did a little check thing and a blue screen came up stating "Check Files on C: The volume is clean." or something like that, it went fast.

Another weird thing I noticed was when it was booting up with a black screen (you know, listing stuff in the beginning when you turn your computer on), it said "Keyboard Failure" underneath all the information of the computer (basic info about Dell, etc.). Not sure if it means anything, but I thought that was kind of weird.
"Your luck has been completely changed tobay."
- Fortune Cookie

#5 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:51 AM

Posted 07 September 2007 - 01:04 AM

A 0xC000021A stop error message can be caused by malware. Since you cannot boot into Normal Mode or Safe Mode I would suggest a repair install of the operating system.

How to Perform a Windows XP Repair Install
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#6 kneesock

kneesock
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 07 September 2007 - 04:54 PM

It worked! My computer turned on and I am able to log onto anyone's account. Thanks so much! :thumbsup:

What steps should I carry on with now in further disinfecting my computer? I will see if I still have HiJackThis installed on the other computer and post it here when I am finished.

Edit: I just ran Spybot Search & Destroy and it detected something called "Alexa Related." I "fixed the problem" as far as my knowledge goes. I am running AdAware SE Personal at the moment. I am also getting a little bubble window saying the service pack I am using is no longer secure. Do I need to install another CD?

Edited by kneesock, 07 September 2007 - 05:16 PM.

"Your luck has been completely changed tobay."
- Fortune Cookie

#7 kneesock

kneesock
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 07 September 2007 - 05:35 PM

Here is the HijackThis log. :thumbsup: I hope it's the right version.

Edit: OH! Now that I see it says I only have SP1... Man, how do you change that? I will look around...

Logfile of HijackThis v1.99.1
Scan saved at 6:33:36 PM, on 9/7/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\WgaTray.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://auto.search.msn.com/response.asp?MT...;prov=&utf8
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R320 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9FA.EXE /P30 "EPSON Stylus Photo R320 Series" /O6 "USB001" /M "Stylus Photo R320"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-110-12-0000137.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Sprint PCS Connection Manager 3.0.LNK = C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCM3.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe

Edited by kneesock, 07 September 2007 - 05:37 PM.

"Your luck has been completely changed tobay."
- Fortune Cookie

#8 kneesock

kneesock
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:51 PM

Posted 07 September 2007 - 09:11 PM

Oh my god! Now my laptop is having the http://www.bydou.com/ homepage problem! When I saw this happened when I just opened IE 7, I almost fainted!

I'm going to run a Spybot Search & Destory scan here and restart my computer and see if my homepage is still that! Do you think I could've brought that virus from my other computer on a USB drive? I used one to get the log over here to be able to post it...
"Your luck has been completely changed tobay."
- Fortune Cookie




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users