XP randomly shuts down and restarts

June 7, 2009 at 15:21:21
Specs: Windows XP
Not sure if this is the correct forum for this or not. Not sure it's an XP problem. For over a month now my machine will just randomly shut down with no error message, no blue screen, nothing then automatically restart. I always check the Event Viewer. Originally gusvc, QBCF Monitor and avg8emc along with Intuit Update Service, Security Center and ATI Smart always show up. I turned off the Google update and the Quickbooks CF. I uninstalled and reinstalled AVG. Those 3 do not show up any longer in the Event Viewer. But Intuit Update (I turned off automatic updates on both Quickbooks and Turbo Tax so don't know what is Intuit that's set to update), ATI Smart and Security Center still show up in viewer. I've run MemTest86+ and it says memory is fine. I ran SeaTools for Windows (couldn't get the DOS version to work) and it said Long DST fail. All the others passed. I've updated my ATI drivers. My system will sometimes run for days without shutting down. Today, it's shut down 3 times already. I've blown out my CPU well! Numerous times. lol. I've checked all cords/plugs and everything is in tight. There is no consistency on the programs I'm running at the time of shut down. Usually I have my mail open (Thunderbird), Firefox, etc. but sometimes it does it in the middle of the night when I'm not even on it. Any suggestions? I'm about to pull all my hair out here!!!
Lynn

See More: XP randomly shuts down and restarts

Report •


#1
June 7, 2009 at 16:10:10
Don't pull out your hair, you need your hair. Instead right click on my computer, left click on properties, go to advanced, startup & recovery, settings & uncheck automatically restart.

How do you know when a politician is lying? His mouth is moving.


Report •

#2
June 7, 2009 at 16:23:13
I did that yesterday...and guess what? It still restarts. lol
Lynn

Report •

#3
June 7, 2009 at 17:50:54
LOL Then look at the event viewer for errors.

How do you know when a politician is lying? His mouth is moving.


Report •

Related Solutions

#4
June 7, 2009 at 18:17:58
I go there every time it shuts down on me. There are no actual errors. It's always the same 3 things on Information: ATI Smart, Intuit Update (which I've turned off but still shows up?) and Security Center. I did update the ATI a few weeks ago. Well after this started.
Lynn

Report •

#5
June 7, 2009 at 18:25:16
Try Hijack This. Post the log if you don't understand it.

How do you know when a politician is lying? His mouth is moving.


Report •

#6
June 7, 2009 at 18:38:02
Okay. I'll run it right now. And no, I never understand the log.
Lynn

Report •

#7
June 7, 2009 at 18:48:35
Here it is:
Logfile of HijackThis v1.99.1
Scan saved at 8:45:25 PM, on 6/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\PayPal Payment Request Wizard\Outlook Wizard\OEHook.exe
C:\Program Files\CNN.com Desktop Alerter\CNNAlerter.exe
C:\Program Files\Karen's Power Tools\Replicator\PTReplicator.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netscape.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: TwcToolbarBhoApp Class - {AA1F9DDB-E605-4ba6-81D4-E427DEE012AD} - C:\WINDOWS\system32\TwcToolbarBho.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\WINDOWS\system32\TwcToolbarIe7.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: CNNAlerter.lnk = C:\Program Files\CNN.com Desktop Alerter\CNNAlerter.exe
O4 - Startup: Karen's Replicator.lnk = C:\Program Files\Karen's Power Tools\Replicator\PTReplicator.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Outlook Plugin.lnk = C:\Program Files\PayPal Payment Request Wizard\Outlook Wizard\OEHook.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra 'Tools' menuitem: The Weather Channel - {2E5E800E-6AC0-411E-940A-369530A35E43} - (no file)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re...
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe


Report •

#8
June 8, 2009 at 05:53:56
The log looks clean. However, I would uninstall all toolbars, the weather channel & yahoo, at least for now.

Also, there are a lot of missing dll files. Install the latest service pack if you don't have it.

If none of that helps, run msconfig, go to the startup tab, disable all, click apply, reboot, click ok & try to d/l anti malware from malwarebytes.org

How do you know when a politician is lying? His mouth is moving.


Report •

#9
June 8, 2009 at 06:35:11
I already have SP3 downloaded. I also already have Anti-Malware from malwarebytes. It never finds anything. Here's a question.....I booted into Safe Mode last night and my mouse (neither one. Tried my USB and a PS2) will work. Wondering if this is part of the problem? If so, what should I do? Uninstall and reinstall? Will uninstall the toolbars right now.
Lynn

Report •

#10
June 8, 2009 at 09:57:34
Just finished Malwarebytes. It found Trojan.Downloader. It removed it. What should I do next?
Lynn

Report •

#11
June 8, 2009 at 15:16:42
Your PC should be clean of malware now. Do any of the original problems still exist? If so, what are they?

How do you know when a politician is lying? His mouth is moving.


Report •

#12
June 8, 2009 at 16:15:47
Well, I won't know for a couple days at least. The shutdowns are very erratic. Any idea why my mouse won't work in Safe Mode? I have USB Legacy enabled. Just wondering if there might be a problem with it also.
Lynn

Report •

#13
June 8, 2009 at 17:26:25
I would say that the driver isn't loading in safe mode.

How do you know when a politician is lying? His mouth is moving.


Report •

#14
June 8, 2009 at 17:49:08
Do you think Trojan.Downloader was causing my shutdowns?
Lynn

Report •

#15
June 8, 2009 at 19:40:24
There is certainly a good chance that it was the cause.

How do you know when a politician is lying? His mouth is moving.


Report •

#16
June 10, 2009 at 05:57:08
2 more shutdowns last night. :-(
Lynn

Report •

#17
June 10, 2009 at 06:18:21
Update anti malware & scan again.

How do you know when a politician is lying? His mouth is moving.


Report •

#18
June 10, 2009 at 06:37:11
Am doing that right now. Also checked the Event Viewer. Error message: The following boot-start or system-start drivers failed to load: i8042prt. My wireless mouse?
Lynn

Report •

#19
June 10, 2009 at 07:49:17
Was Event ID 7026 in the error?

How do you know when a politician is lying? His mouth is moving.


Report •

#20
June 10, 2009 at 08:32:32
Yes Event 7026
Malware Bytes found Malware.Trace. It's been removed.

Report •

#21
June 10, 2009 at 10:54:39
If there are any more shutdowns, there is a registry key that can be edited.

How do you know when a politician is lying? His mouth is moving.


Report •

#22
June 10, 2009 at 12:39:35
To stop the shutdowns?

Report •

#23
June 10, 2009 at 15:32:15
http://74.125.95.132/search?q=cache...

Read the problem at the top, then go almost all the way to the bottom of the page to the solution section.

How do you know when a politician is lying? His mouth is moving.


Report •

#24
June 10, 2009 at 15:45:02
Oh Lordie. I sure hope I don't have to do that. I've never done anything in my registry. :-(

Report •

#25
June 11, 2009 at 07:35:27
Another shutdown. Same error message. Ran Malware Bytes...nothing.
Lynn

Report •

#26
June 11, 2009 at 15:00:33
Here are a number of things that others have done to solve the problem.

Device: IMOUFLTR - Found it to be associated with the Logitech mouse driver. Removed and reinstalled software and the error went away.

Oyvind Johansen (Last update 10/22/2007):
- Device: i8042prt - In my case deleting the registry key: [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt] solved this issue.

- Device: i8042prt - In my case, there was an issue with Hotplugging of the USB keyboard. I solved this problem by opening the registry, going to [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters] and changing the value Headless data to 0x1 (Allow Hotplugging).

Device: i8042prt - it could be because you have an USB-connected keyboard but PS/2 keyboard support is still enabled in BIOS.

How do you know when a politician is lying? His mouth is moving.


Report •

#27
June 11, 2009 at 17:16:02
Well, obviously I'll start with the easiest option....the drivers. :-)
Lynn

Report •

#28
June 11, 2009 at 18:47:11
Good thinking. Always start with the easiest & when money is involved, start with the cheapest.

How do you know when a politician is lying? His mouth is moving.


Report •


Ask Question