Help!! Computers Keep Rebooting

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by LUCKY48, Dec 20, 2004.

  1. LUCKY48

    LUCKY48 Private E-2

    I Need Help. We Started With One Computer That Just Started Randomly Rebooting Throughout The Day. Now, It Has Spread To Three Doing The Exact Same Thing Which Leads Me To Believe That It's Spyware Or A Virus Throughout The Network. Spyware Searches Have Come Out Clean And I Don't Know Why They Are Rebooting. I Need Help Because This Is Starting To Stump Me. It Is Not A Hardware Or Power Issue Because I Can Boot In Safe Mode Just Fine.
     
  2. Kodo

    Kodo SNATCHSQUATCH

    are there any message boxes that pop up before they reboot?
     
  3. LUCKY48

    LUCKY48 Private E-2

    No... Nothing pops up before it reboots. However, the screen changes to a blue DOS screen before it shuts off... However, it does it so quickly that I can't read what is displayed before the computer reboots.
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    First, please follow ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal
    If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

    NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.


    After doing ALL of the above if you still have a problem:

    Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

    To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     
  5. LUCKY48

    LUCKY48 Private E-2

    These are two logs from the computer that reboots as soon as windows is loaded normally. I can't run the program unless the computer is in safe mode so hopefully these help.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well I really need to see a log from normal boot mode.
    Are you saying you cannot boot normal mode and before running anything else get a HijackThis log?

    Are you also saying you cannot run any of the scanning/cleaning tools?

    I would uninstall SpyKiller and possibly BestPopUpKiller if from the same company. SpyKiller is on a list or rogue/suspect spyware removal tools in is not of much use. See this link: http://www.spywarewarrior.com/rogue_anti-spyware.htm

    I'm suspicious of this line in your startup list:
    C:\CCHLOGIN\logexp.exe
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  8. LUCKY48

    LUCKY48 Private E-2

    I can boot into windows normally for about 5 seconds, then it shuts down and reboots. It does this every time that the computer boots. I can only run programs in safe mode. I followed the procedures listed in the sticky thread, but nothing shows up on any of the scans while in safe mode. I don't know if it is any coincidence, but all the computers that are currently rebooting like this or randomly, are Gateways.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    And what about: I'm suspicious of this line in your startup list:
    C:\CCHLOGIN\logexp.exe

    Run the Symantec tool I gave the link to below.
     
  10. LUCKY48

    LUCKY48 Private E-2

    I'm suspicious of this line in your startup list:
    C:\CCHLOGIN\logexp.exe

    Chaslang:
    This is a valid entry.
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Is it: Login Express for Tax Research products ?

    While I don't think they are the cause of your reboots, what are you doing with SpyKiller and BestPopUpKiller?

    See if you can run a HJT scan and save a log in safe mode. Run it immediately after reboot. Perhaps even put it into your Startup folder as a temporary suggestions. Then it will run at startup and all you hvae to do is click the scan and save log button.
     
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You may all want to try running a memory tester on the PC. Memtest86+

    You could also have a problem in your system BIOS. Maybe an Autostart setting. Also check with Gateway to see if there is a BIOS upgrade or patch.
     
  13. LUCKY48

    LUCKY48 Private E-2

    Okay! Is it: Login Express for Tax Research products ? YES

    While I don't think they are the cause of your reboots, what are you doing with SpyKiller and BestPopUpKiller? I HAVE UNINSTALLED THEM LIKE YOU ADVISED.

    See if you can run a HJT scan and save a log in safe mode. DO YOU WANT ME TO TRY AND REBOOT THE COMPUTER IN NORMAL MODE AND RUN A SCAN? THE LOG THAT I POSTED WAS FROM SAFE MODE.
     
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes! I was hoping you could do it fast enough to get one.

    But I'm suspecting a hardware problem like memory or a BIOS problem. That is the reason for my other suggestions.
     
  15. LUCKY48

    LUCKY48 Private E-2

    Here are two new log files from windows in normal mode. I was able to stop it from rebooting by disabling the network connection completely. It reboots when it has internet access
     

    Attached Files:

  16. LUCKY48

    LUCKY48 Private E-2

    How do I run the memtest download? After I unzip it, it is a strange filetype that my computer doesn't recognize.
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Now that's interesting.

    I don't see anything in you HJT log that looks like a problem.
    You could try uninstalling the network card, rebooting and reinstalling from your original disks. Or look for a possible upgrade to the drivers.

    I also wonder whether there is a problem with the network card.
     
  18. LUCKY48

    LUCKY48 Private E-2

    Computer is spending a night with a friend to see if he can catch something that I'm missing. Will try replacing network card when I get it back.
     
  19. Matacumbie

    Matacumbie Rocky Top

    LUCKY,

    Have you installed any new software or updated any existing programs on the computers?

    The random reboots may be coming from accessing a certain program or function that all the systems have installed. What are you / they doing right before the reboot happens?

    Steve
     
  20. rmStar-R

    rmStar-R Private E-2

    is your box Win XP? i think there is a virus that tries reboot the system within 10 seconds after it has bootedup. we were not able to heal the problem and ended up with installing a fresh system.
     
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I wonder if it is a WinXP OS error? In Windows XP you specify how critical errors are handled by the OS.

    Click Start , Control Panel , Settings , System. Then click the Advanced tab , now in the System And Recovery area click on Settings. In the System Failure section, clear the Automatically Restart check box and then click OK.

    I'm not sure if changing this requires a reboot or not.

    Now when Windows XP encounters a Stop Error, it will simply display a message on the screen and won't automatically reboot. This is not a fix (if it works). It is merely a workaround. You need to find out what piece of hardware is causing the errors. This is why I was mentioning earlier "suspecting a hardware problem like memory or a BIOS problem." It could also be a software problem.

    Have you run that Memtest yet? You should!
     
    Last edited: Dec 22, 2004
  22. LUCKY48

    LUCKY48 Private E-2

    Well, I think we have finally nailed the root of the problem. For info purposes, all computers that rebooted were running windows 2000 professional.

    Here's my solution:
    Quickbooks 2005 was causing the problem. For some reason, the data agent/update manager that it adds to the windows startup folder was causing the computer to reboot everytime it tried to connect to the internet. We removed all references to Quickbooks from the startup folder and so far, we haven't had any more problems.
     
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Ineteresting! Thanks for the info. I mentioned that it "could be a software issue".
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds