14 replies to this topic

[Bent Club]

friends computer starts then reboots .
Tried to download SIW from MG'S got a pop up from avast of a trogen horse .
Cpu temp is normal . He's doing a memory test tonight .
What other software can i have him run to find the cause ?
Do you need the Gmer [ETC]. logs ?

[Broni]

Quote

Cpu temp is normal

Read from where?

Same issue in safe mode.

How far does it boot?

[Bent Club]

Siw , Sensors . Boots completely .

"We keep this thing on standby at night, so when I fire it up in the morning, it'll run all day or sometimes for an hour before it restarts. Sometimes, it won't do it for a couple days, so randomly would fit best.
No change in hardware in some time now and I do hear the fans".

Didn't think to ask him to try safe mode .

[Broni]

Random shutdowns won't be easy to investigate.

Ask him to provide couple of logs...

1. Download BlueScreenView (in Zip file)
No installation required.
Unzip downloaded file and double click on BlueScreenView.exe file to run the program.
When scanning is done, go Edit>Select All.
Go File>Save Selected Items, and save the report as BSOD.txt.
Open BSOD.txt in Notepad, copy all content, and paste it into your next reply.

2. Please download VEW and save it to your Desktop: http://images.malwar...om/vino/VEW.exe

Double-click VEW.exe then under Select log to query, select:
Application
System

Under Select type to list, select:
Critical (Vista only)
Error

Click the radio button for Number of events
Type 20 in the 1 to 20 box
Then click the Run button.
Notepad will open with the output log.

In Notepad, click Edit > Select all then Edit > Copy
Reply to this post, click in the reply window and press Ctrl+V on your keyboard to paste the log.

[Bent Club]

Thanks , Will do . Mem test was fine .

[Bent Club]

"When I get to the BlueScreenView C:\Windows\MiniDump page, it doesn't do anything. Is it suppose to run automatically"?

[Bent Club]

file:///C:/DOCUME%7E1/ADMINI%7E1/LOCALS%7E1/Temp/moz-screenshot.png Is this what it is suppose to look like ?

[Bent Club]

Is this what it is suppose to look like ?

Attached Images

• 

[Bent Club]

Vino's Event Viewer v01c run on Windows XP in English
Report run at 29/12/2011 7:43:04 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 26/12/2011 7:36:46 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application explorer.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 10/12/2011 8:59:00 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application hpqthb08.exe, version 4.2.0.138, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 10/12/2011 7:44:39 AM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application olympus master.exe, version 2.3.0.2, faulting module mdp_tiff.omdp, version 2.3.0.2, fault address 0x00006fde.

Log: 'Application' Date/Time: 10/12/2011 7:44:18 AM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application olympus master.exe, version 2.3.0.2, faulting module mdp_tiff.omdp, version 2.3.0.2, fault address 0x00006fde.

Log: 'Application' Date/Time: 13/11/2011 10:43:02 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 26/10/2011 6:09:31 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 02/10/2011 2:21:12 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application ATF-Cleaner.exe, version 3.0.0.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 15/09/2011 6:53:43 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 16/08/2011 7:21:55 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application mbam.exe, version 1.51.1.1076, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 15/08/2011 9:12:07 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application RTHDCPL.exe, version 2.1.3.3, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 10/08/2011 7:14:26 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 10/08/2011 7:14:17 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 28/07/2011 3:50:13 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 21/07/2011 5:19:03 PM
Type: error Category: 0
Event: 8 Source: crypt32
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Log: 'Application' Date/Time: 21/07/2011 5:19:01 PM
Type: error Category: 0
Event: 8 Source: crypt32
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Log: 'Application' Date/Time: 21/07/2011 5:19:01 PM
Type: error Category: 0
Event: 8 Source: crypt32
Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

Log: 'Application' Date/Time: 28/05/2011 5:30:01 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 28/05/2011 1:01:57 PM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application hpqthb08.exe, version 4.2.0.138, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 22/04/2011 11:59:46 AM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application hpqanon.exe, version 2.0.0.138, faulting module hpqswiz.dll, version 2.0.0.138, fault address 0x0000b340.

Log: 'Application' Date/Time: 22/04/2011 11:59:31 AM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application hpqanon.exe, version 2.0.0.138, faulting module hpqswiz.dll, version 2.0.0.138, fault address 0x0000b340.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 29/12/2011 6:55:15 AM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.100 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 28/12/2011 7:57:41 PM
Type: error Category: 0
Event: 10000 Source: DCOM
Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "%3" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.65\GoogleUpdateOnDemand .exe" -Embedding

Log: 'System' Date/Time: 28/12/2011 11:39:55 AM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.100 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 28/12/2011 6:27:06 AM
Type: error Category: 0
Event: 10000 Source: DCOM
Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "%3" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.65\GoogleUpdateOnDemand .exe" -Embedding

Log: 'System' Date/Time: 27/12/2011 8:24:29 PM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 27/12/2011 8:24:29 PM
Type: error Category: 0
Event: 7009 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.

Log: 'System' Date/Time: 27/12/2011 5:06:33 PM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 27/12/2011 5:06:33 PM
Type: error Category: 0
Event: 7009 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.

Log: 'System' Date/Time: 27/12/2011 7:58:58 AM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.102 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 27/12/2011 7:36:02 AM
Type: error Category: 0
Event: 10000 Source: DCOM
Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "%3" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.65\GoogleUpdateOnDemand .exe" -Embedding

Log: 'System' Date/Time: 26/12/2011 7:59:41 PM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 26/12/2011 7:59:41 PM
Type: error Category: 0
Event: 7009 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.

Log: 'System' Date/Time: 26/12/2011 5:31:37 PM
Type: error Category: 0
Event: 9 Source: atapi
The device, \Device\Ide\IdePort0, did not respond within the timeout period.

Log: 'System' Date/Time: 26/12/2011 9:34:22 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.

Log: 'System' Date/Time: 26/12/2011 9:34:22 AM
Type: error Category: 0
Event: 7009 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for the Google Update Service (gupdate) service to connect.

Log: 'System' Date/Time: 26/12/2011 9:31:17 AM
Type: error Category: 0
Event: 10000 Source: DCOM
Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "%3" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.65\GoogleUpdateOnDemand .exe" -Embedding

Log: 'System' Date/Time: 26/12/2011 9:30:33 AM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.100 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 25/12/2011 8:21:34 PM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.100 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 25/12/2011 2:36:47 PM
Type: error Category: 0
Event: 10000 Source: DCOM
Unable to start a DCOM Server: {ABC01078-F197-4B0B-ADBC-CFE684B39C82}. The error: "%3" Happened while starting this command: "C:\Program Files\Google\Update\1.3.21.65\GoogleUpdateOnDemand .exe" -Embedding

Log: 'System' Date/Time: 25/12/2011 8:21:21 AM
Type: error Category: 0
Event: 1002 Source: Dhcp
The IP address lease 192.168.1.100 for the Network Card with network address 001AA094A4B3 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

[Broni]

Possibly there were no BSODs while the shutdown happens, but check if you have correct settings.

1. Click Start, point to Settings, and then click Control Panel (Start>Control Panel in Vista).
2. Double-click System.
3. Click (Advanced system settings link in Vista, then --->)the Advanced tab, and then click Settings under Startup and Recovery.
4. Make sure, there is a checkmark in Write an event to the system log.
5. In the Write debugging information list, click Small memory dump (64k) (128K in Windows 7).

I can see a lot of network related errors.

[Bent Club]

Thanks will pass it on .

[Bent Club]

Did the memory dump, is there anything else that has to be run or does that fix the issue ?
Thanks.

[Broni]

From now on some dump files will be created when computer shuts down.

When it happens 3-4 times re-run BlueScreenView, post its log and we may see something.

[Bent Club]

Thanks Broni , You have a Happy New Year .

[Broni]

Very same to you :)