virus scan powers down computer!

[deeker]

In the last few days Avast has caught 3 or 4 viruses but my outlook started acting really weird today and was placing new mails directly into the deleted items folder in spite of the fact that there were no rules set up to do this (verified).  So i ran avast virus scan, 4 times in the last 3 hours and every time the whole computer powers down in the middle!  Is this a virus' intention, one that slipped thru avast's sensors?  Is this an avast incompatibility?  Is anyone else having similar issues this week?

please help!!  I even tried to restore my Win XP system to a week ago and it still powered down the computer...

John

[galooma]

Hi and welcome,
When you say "powers down" ,do you mean a crash as in a BSOD or blue screen of death as its called. or logging you off ? or maybe just instant reboot?

[deeker]

no freeze, no blue screen, literally, turns off, shuts down, night night... the only other thing today that happened computer wise was that i installed firefox 1.5 but i have since uninstalled it and still have the problem...

[galooma]

is it possible for you to download hyjack this http://www.majorgeeks.com/download3155.html and generate a log with it , paste the log here and maybe someone here can spot something bad.
 
Also you could try an online scan here http://www.kaspersky.com/remoteviruschk.html and see if it crashes your system as well. Remember to de-activate Avast while it is in progress.

If you do get a BSOD crash it would be really helpful if you could have your system generate a minidump file.
see attached pic to set your system to do this, I am assuming you have windows xp.If and when you can get this minidump file send it to vlk@avast.com with a brief explanation and he will be able to investigate whats crashing your system.

[igor]

Sounds like an overheating problem. I'd suggest to check the fans in your case...

[polonus]

Hi deeker,

It is like igor says. Not a lot of people know that dust inside a comp can be a worse enemy than a virus even. Your are well advised to open up your computer and clean the dust out every year, turn your keyboard over and pat the dust out. I lost a motherboard through dust, dust can kill computers!!!

greets.

polonus

[deeker]

gents, thanks for all your help.  i am going to try all that you say but here is some new and interesting info perhaps:  When i right click and select scan of every folder in the C drive it does not have the same issue, i was able to scan everything one by one (hidden files too) with no issues?!?!

by the way, how do i de-dustify a laptop?  toshiba satellite a75...?

[deeker]

sorry, also, what is BSOD?

[Lisandro]

sorry, also, what is BSOD?

Blue Screen of Death.
When Windows crashes it appears with an error message (numbers and text) and start memory dump.

[deeker]

oh, no it is not the BSOD i am getting, the laptop is simply turning off, completely, shut down...

[deeker]

is it possible for you to download hyjack this http://www.majorgeeks.com/download3155.html and generate a log with it , paste the log here and maybe someone here can spot something bad.

"Logfile of HijackThis v1.99.1
Scan saved at 4:40:44 PM, on 12/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\JOHNSH~1\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://toshibadirect.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Notebook Maximizer] C:\Program Files\Notebook Maximizer\maximizer_startup.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: eFax DllCmd 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GDllCmd.exe
O4 - Global Startup: eFax Tray Menu 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GTray.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\Toshiba\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

"
 
Also you could try an online scan here http://www.kaspersky.com/remoteviruschk.html and see if it crashes your system as well. Remember to de-activate Avast while it is in progress.

If you do get a BSOD crash it would be really helpful if you could have your system generate a minidump file.
see attached pic to set your system to do this, I am assuming you have windows xp.If and when you can get this minidump file send it to vlk@avast.com with a brief explanation and he will be able to investigate whats crashing your system.

[deeker]

Also you could try an online scan here http://www.kaspersky.com/remoteviruschk.html and see if it crashes your system as well. Remember to de-activate Avast while it is in progress.

If you do get a BSOD crash it would be really helpful if you could have your system generate a minidump file.
see attached pic to set your system to do this, I am assuming you have windows xp.If and when you can get this minidump file send it to vlk@avast.com with a brief explanation and he will be able to investigate whats crashing your system.

the above online scan can only handles 1mb at a time and I have NO CLUE which sectors to begin with since i don't know where avast was when the system crashed/shut down - the c drive has 45G on it so selecting 1mb pieces is not practical...

[Lisandro]

oh, no it is not the BSOD i am getting, the laptop is simply turning off, completely, shut down...

There should (could) have a possibility of disabling automatic restart (the just reboots again behavior).
By disabling the automatically restart on system failure feature, you are able to read what messages appear on the blue screen and can, if necessary, pass the information on to your technical support person or post here.
It's important the error numbers and the error message there.

Disable Automatic Restart:
System Properties > Advanced > [Startup and Recovery]Settings
Remove the checkmark from "Automatically Restart" in the System Failure section.

Anyway, you should check Windows Events and avast! logs to see if anything strange is happening.

[DavidR]

Re your HJT log contents, there a couple of entries marked Nasty, however, I believe they are legit as they refers to Toshiba.com search and I presume that was set that way when you got the system.

There are a number of unknown or unnecessary entries one of which should be fixed in HJT:
      O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
Lastly this one which Should possible be causing conflict depending on what elements of Symantec Security Centre you still have installed?
If you have tried to uninstall all Symantec products you should also fix this in HJT.
       O23 - Service: SymWMI Service (SymWSC) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (file missing)

For a detailed on-line analysis of your log check this link http://hijackthis.de/logfiles/1007410c4e81660492c565cad4134174.html.