Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Computer Shuts Off


  • Please log in to reply
13 replies to this topic

#1 JohnBB

JohnBB

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 17 March 2010 - 10:36 AM

Hi,

I got my repaired computer back from the shop with a new Intel Desktop board DQ965GF w. Core2 Duo CPU and 4GB DRAM, plus an nVidia GeForce 9600 video board w. 1GB.

XP PRO Service Pack 3 was installed w. Norton Internet Security and Norton Ghost, plus one reformatted Western Digital drive and one blank reformatted WD drive.

I cloned drive C:\ to the blank drive and rebooted. This seemed to confuse the computer, which had trouble completing boot-up. I disconnected the second drive and proceeded for several weeks, creating Ghost Restore Points every few days, but the PC had trouble completing boot-up, often failing to Blue Screen.

Eventually I went to the Restore Point right after I removed the second drive, but still had trouble booting. During the process, I added four external USB drives and Adobe Lightroom 2.0 and Photoshop CS3.

Several days ago, the boot-up trouble went away, but the computer began turning off from 10 minutes to an hour after being turned on.

Otherwise, everything seems fine.

I will attach a HiJackThis log but first I want to get this message sent before the system shuts off again ... :thumbsup:

BC AdBot (Login to Remove)

 


#2 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 17 March 2010 - 10:42 AM

Here's the HiJackThis log file...

Attached Files



#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:46 PM

Posted 17 March 2010 - 10:47 AM

It would be useful to know the BSOD info.

Download BlueScreenView - http://www.nirsoft.net/utils/blue_screen_view.html.

Double-click BlueScreenView.exe file to run the program.

When scanning is done, Edit/Select All...then File/Save Selected Items. Save the report as BSOD.txt.

Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

You say that the system turns off...it does not reboot automatically? The power is completely lacking?

When did these repairs take place...and have you consulted whomever did such?

Louis

#4 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 17 March 2010 - 04:31 PM

hi,

Here's the BSOD file.

The computer won't restart, but the fan is on and power seems to be going to the computer. But you have to shut the system down and turn it off again to get it to boot up.

The repair shop took four months to fix the unit, and only after a second tech figured out that the motherboard was bad. (Intel eventually agreed and replaced it free, about 15 months after the original purchase.)

...so I'm a bit reluctant to get them involved until I'm pretty sure the problem originated with them and not as the result of me trying to boot with both the C:\ drive and the cloned drive plugged in...or as the result of a virus that slipped in as I was validating Norton Internet Security...or as the result of installing Lightroom, Photoshop, or MS Office 2003...

Thanks for your help!

John B>

==================================================
Dump File : Mini031210-01.dmp
Crash Time : 3/12/2010 3:43:12 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84ef740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini031210-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini031010-01.dmp
Crash Time : 3/10/2010 11:24:03 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84ff740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini031010-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini022110-01.dmp
Crash Time : 2/21/2010 2:38:21 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb8503740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini022110-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini021010-01.dmp
Crash Time : 2/10/2010 4:51:25 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84ff740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini021010-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini020910-01.dmp
Crash Time : 2/9/2010 11:50:50 AM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84f7740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini020910-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini020510-02.dmp
Crash Time : 2/6/2010 12:25:06 AM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84f7740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini020510-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

==================================================
Dump File : Mini020510-01.dmp
Crash Time : 2/5/2010 7:41:18 PM
Bug Check String : KERNEL_MODE_EXCEPTION_NOT_HANDLED
Bug Check Code : 0x1000008e
Parameter 1 : 0xc0000005
Parameter 2 : 0xb7e3d625
Parameter 3 : 0xb84ef740
Parameter 4 : 0x00000000
Caused By Driver : symsnap.sys
Caused By Address : symsnap.sys+8625
File Description : StorageCraft Volume Snap-Shot
Product Name : StorageCraft Volume Snap-Shot Development Edition
Company : StorageCraft
File Version : 7.0.18.31994
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\minidump\Mini020510-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

#5 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:46 PM

Posted 17 March 2010 - 05:17 PM

Seems pretty clear...I would remove Storage Craft Volume Snap-shot from my system.

Your system does not like it as it is presently installed.

Louis

#6 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 17 March 2010 - 11:33 PM

A search of drive C:\ does not find any variation of Snap Shot or Storage Craft

These are not in Add/Remove Programs

In Command Prompt, "sc query symsnap" yields:

SERVICE_NAME: symsnap
TYPE : 2 FILE_SYSTEM_DRIVER
STATE : 4 RUNNING
<NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN>
WIN32_EXIT_CODE : 0 <0X0>
SERVICE_EXIT_CODE : 0 <0X0>
CHECKPOINT : 0X0
WAIT_HINT : 0X0

#7 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 18 March 2010 - 12:11 AM

However, in Command Prompt, "sc delete symsnap" yields:

"[SC] DeleteService SUCCESS"

...so, we'll see.

I'll let you know what happens.


Before I could post this, the system shut down.

On re-boot, I again typed "sc delete symsnap" in Command Prompt, but the message
was that the service was not present.

However, in Task Manager, SymSnapService is running and cannot be ended ("Access is Denied").
Also the Process Tree cannot be ended and the Priority cannot be changed.

So...?

John B>

#8 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:46 PM

Posted 18 March 2010 - 09:17 AM

Well...if a service is running and you cannot find any files for it...my guess would be that there are registry entries which need to be deleted.

Using regedit...do a search for the listed service/filename.

The other alternative to consider is that you have malware of some type which

http://www.file.net/process/symsnap.sys.html

Microsoft says that it's a Symantec file/process (if legitimate), http://support.microsoft.com/kb/959212.

Louis

Edited by hamluis, 18 March 2010 - 09:17 AM.


#9 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 18 March 2010 - 03:30 PM

Hmm...

Could have something to do with Norton Internet Security or Norton Ghost. I'll check with Norton.

I ran the scan at what turned out to be Uniblue Registry Booster. It found errors that threaten
life on Earth...and demanded $29.95 to fix them. I complied. It fixed 181 but that did not change
the situation with the computer shutting off.

If Norton says okay, I'll delete symsnap.sys in the registry.

I'll let your know...
Thanks again, John B>

#10 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 18 March 2010 - 03:32 PM

Oh, another thing. Several times during shut-down, I've received the error:

Instruction 0x0012fb5d @ 0x00000000 cannot be written.

#11 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:46 PM

Posted 18 March 2010 - 04:52 PM

If you have Symantec software installed...simply uninstall it and reinstall the software.

That may solve it, rather than registry-hunting.

I suggested the registry before I read that it's a Symantec file/process.

Louis

#12 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 19 March 2010 - 12:18 AM

Okay,

I updated Norton Internet Security 2010 and ran a Quick Scan, then installed and updated UniBlue Registry Booster and Malwarebytes Anti-Malware.

I disconnected the Ethernet cable to the Internet and Uninstalled Norton Internet Security 2010 and Norton Ghost 14. (The latter stopped and removed processes related to SysSnap, such as symsnap.sys.)

I removed all external drives, leaving C:\ and two other local drives, D:\ and N:\.

I ran Registry Booster, which fixed 181 errors and subsequently showed a clean registry.

I ran Malwarebytes on all three local drives. It found and removed one adware infection on D:\ and one on N:\.

Malwarebytes required a system restart, but the system went dead while attempting the re-boot. The Event Viewer showed: ôSystem Restore encountered unexpected error 0xC0000000 processing file HD vol. 2 and has stopped monitoring the volume. Event ID 1. Otherwise, the system seemed okay on re-start.

The Intel Desktop Utility shows the CPU, motherboard, and all three hard drives to be operating normally and within required temperature ranges.

But still, the system shuts itself off within 5 to 25 minutes. On successful re-start, the Event Viewer shows three errors that occur during start-up:

Event ID 7000: Windows Live ID Sign-In failed to start: Service did not respond to start request in a timely fashion.

Event ID 7009: Timeout (30000 ms) waiting for Windows Live ID Sign-In.

Event ID 7034: Application Layer Gateway Service terminated unexpectedly.

Any suggestions?
John B>

#13 hamluis

hamluis

    Moderator


  • Moderator
  • 55,247 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:46 PM

Posted 19 March 2010 - 09:53 AM

Stop using registry cleaners...and then do a repair install of XP or run the sfc /scannow command.

When a system shuts off, something is seriously wrong on the hardware end (Windows cannot result in the system shutting off, it can only result in reboots and STOP errors onscreen).

You don't seem able to provide any useful clues...the STOP errors are matters relating to the functioning of Windows and I know of no STOP error that results in terminating power to a system.

The logical hardware suspect would be CPU/PSU/motherboard.

Something is amiss with your system and I doubt that it can analyzed/repaired from afar.

Louis

#14 JohnBB

JohnBB
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:11:46 PM

Posted 19 March 2010 - 01:01 PM

Louis,

Thanks for the advice. Unfortunately, the hardware theory sounds compelling.

I'll take the system back to the repair shop and let them have a go.


Best wishes,
John B>




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users