XP System just restarting

ThreadKiller

Guys,

My home system here just keeps restarting once logged in on XP (currently using different install). If you don't log in (i.e. just leave it there) it does nothing, no reboot, just waits.

I've run a symantec virus scan & adaware scan on the system & it came up clean.

Any ideas ?

Is there any nasties that may not turn up in a virus scan ?

I've checked the registery & system.ini etc & they're all clean, also nothing in the startup group.

Jammer

have u got the latest virus deffenitions?

Mr. Fancypants

sounds like the blaster worm or one of its varients a virus scan would not show if you are guarded against it

get the latest security patches from microsoft

ThreadKiller

Have the latest definitions, system is patched to within an inch of it's life with security patches.

Mr. Fancypants

anything in the eventviewer after the restart to indict where the problem is?

ThreadKiller

Can't get in to check it. Log-in, system reboots. Can only get in on this drive (different one) or safe mode.

Mr. Fancypants

If you can get in on safe mode and the startup group is clean it is most likely a driver issue.
You will still be able to check the event viewer in safe mode by going start -> run -> eventvwr and hitting ok.
Have a look through the system and application logs to see if anything obvious is going on.

ThreadKiller

Just tried the blaster fix on it & still no difference

PhoenixRising

An almost identical thing happened to my computer about a month ago. Running XP Home and it would boot to the log in screen fine and then once I log in, my desktop would display momentarily and then would immediately reboot with no warning. Like you, my machine was firewalled, with all the latest patches and running Norton AV 2004 with latest definitions, so it definitely wasn't the blaster virus, as that gives you a 30 second RPC warning message before it reboots.

And like you, I could log in in safe mode with no problems. Anyway, I gave up trying to figure out what was wrong and tried to restore windows using the CD, but that wouldn't work either so I ended up having to reformat and reinstall windows again from scratch.

Vuk

This is a long shot, but do you have Zonealarm installed? My dad's computer had similar problems last week, I ran virus scans, adaware and even tried the blaster removal tool, just in case. I've noticed on other occasions Zonealarm being the offending application and this time was no different.

Tivoli

where i work we have a lot of problems with one type of motherboard

what happens is the capicators near the cpu on the motherboard pop,
they look like lille batteries and kinda are, but there is a cross cut in the top of them incase there is a build up of pressure, these pop open and have to be replaced

when they go, i get called very soon after because the pc keeps rebooting

ThreadKiller

Vuk - not zonealarm

Mukki - I hope it's not that. New MB I suppose ?

I got to see the veent viewer & it's reporting reboot after debug. No ideas.

Polonious

TK - log on and ver quickly click "Start -> Run" type "shutdown -a" (without the quote marks) and click "ok". This should stop it from shutting down. It will give you a bit of time to troubleshoot...

ThreadKiller

Will try that later Polonious, but I think the shutdown is quicker than that....

Sleipnir

What happens when you boot to safe mode?

It could be that one of the services is set to "restart the system" upon failure.

ThreadKiller

It's perfectly stable in safe mode, a quick check of the event viewer reports a restart due to debug, but as far as I can see there's nothing due to start on login.

Sleipnir

can you post the entire message from Event viewer including source and event ID?

ThreadKiller

Will do, but system at home & me at work so will have to be tonight or tomorrow.

Sleipnir

ah.
Well, the source should tell you which program or service is doing this. You may have to search your system if you don't recognise it.
Then, go to Control Panel, Admin tools and services. Find the program the service that's failing in that list and then go to the properties of it.
Then check the "Recovery" tab and see if any of "failure" settings are set to restart the computer upon failure.

Garz

You will need to run shutdown -a from the comand prompt and then visit this page to download the fix http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx
When you do that, go to http://www.microsoft.com/security/incident/sasser.mspx and run the "Check My PC for Infection" tool, which will try to remove any traces of the worm from your PC.
That should sort you out.
Garz

ThreadKiller

would the AV on the system not pick up Sasser ?

Sleipnir

it's not Sasser.

Garz

AV does not always pick up sasser. I'm telling you, apply that fix and your system will stop rebooting.

Sleipnir

Garz wrote:

AV does not always pick up sasser. I'm telling you, apply that fix and your system will stop rebooting.

Sasser stops the RPC service. When that shuts down you get a warning on the screen that says
"Your computer will shutdown in one minute. Please save your work....."

Threadkiller's machine is just rebooting when he logs on with no warning.


What the hell, if you haven't patched your machine in the past six months you might as well do it now but I'm telling you, it's ain't sasser.

ThreadKiller

Here's the error messages from Event Viewer:

---

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7016
Date: 10/08/2004
Time: 21:04:11
User: N/A
Computer: TEN
Description:
The SmartLinkService service has reported an invalid current state 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7024
Date: 10/08/2004
Time: 21:03:56
User: N/A
Computer: TEN
Description:
The Computer Browser service terminated with service-specific error 2550
(0x9F6).

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



Event Type: Error
Event Source: System Error
Event Category: (102)
Event ID: 1003
Date: 10/08/2004
Time: 21:04:47
User: N/A
Computer: TEN
Description:
Error code 1000008e, parameter1 c0000005, parameter2 b9a58e21, parameter3
b622d2c0, parameter4 00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 53 79 73 74 65 6d 20 45 System E
0008: 72 72 6f 72 20 20 45 72 rror Er
0010: 72 6f 72 20 63 6f 64 65 ror code
0018: 20 31 30 30 30 30 30 38 1000008
0020: 65 20 20 50 61 72 61 6d e Param
0028: 65 74 65 72 73 20 63 30 eters c0
0030: 30 30 30 30 30 35 2c 20 000005,
0038: 62 39 61 35 38 65 32 31 b9a58e21
0040: 2c 20 62 36 32 32 64 32 , b622d2
0048: 63 30 2c 20 30 30 30 30 c0, 0000
0050: 30 30 30 30 0000

---

As it happens by selecting last known good configuration, I was able to get in (it's not sasser BTW), I then installed XPSP2 & it seems stable (in that I was able to restart several times last night.

finnpark

Just a suggestion. I had the same problem. It seems to be the Sasser vius or Wormblaster or a variant. Allthough you must be connected to internet. Dissconnect Internet and see what happens.

I suggest you go online and download the appropriate software for cleaning your index.dat files. Just enter "delete index.dat" into google and you should get a few different types of appropriate software to download and clean your HD of any bad stuff. Also make sure you have all the servie packs and anti-virus stuff and patches. Its good practise anyway to clean your index.dat.

Everything you ever viewed on internet always remains in index.dat unless you clean it. Deleting temp internet files and cookies does not erase your tracks. To clean your HD use the index.dat cleaner(index.suite is one i think). It will at least free up some HD space and speed up your machine maybe.