PC Random Reboots

Viruses and worms
1

Hi Everyone,

I have assembled a dual system PC with Windows XP and Windows 7 operating systems installed in it over a year ago. However, based on software compatibility most of the time it runs in Win XP.

During the last 2 months or may be longer, it reboots at random time, most of the time it happens at the start up and then within the first 5 or 10 minutes of working, after this rebbot it could be running continuously the whole day with no problems.

For example, I switch it on, when I get into the screen to select operating system, I load Win XP, it starts loading and when all the icons/folders in the desktop appear it switches off and restart. The next reboot happens when I do have a program opened.

Initially, when this started to happen I thought that from a visited website a virus was downloaded and scanned it with Avast and Malwarebytes Anti Malware several times, mainly the first time these scans found some viruses and cleaned it, but the trouble is there, it keeps on rebooting at random times.

These scans were on both systems, Avast full system scan and boot scan as well and then Malwarebytes. Even I scanned Win 7 drive from Win XP and vice versa.

Then, I started thinking on hardware problems such as overheating some parts or poor cooling, so I opened the box and there were some improvements for a couple of days and then the random reboot restarted. I removed and cleaned the RAM stick contacts, but no effect was noticed.

At the end, I think that there must be some line in the PC registry that is making me this problem.

Can anyone help to find it and delete it? If this is not the problem and idea how to solve it?

Thanking you in advance.

Regards,

Carlos

2
Can anyone help to find it and delete it? If this is not the problem and idea how to solve it?
Since you have 50 post i guess you know the drill........ Give us The logs. http://forum.avast.com/index.php?topic=53253.0
3

Hi,

I run the both scans, OTL and aswMBR and files are attached.
For the OTL scan when I run for ‘all users’ the extra file does not come up, so that file is froma ‘general’ scan.
The F drive that appears is where Win XP is installed, I changed from C to F in the section of text to include in the OTL scan.

Thanks for your help,

Carlos

4

Your hosts are “fully” infected according to this :
O1 HOSTS File: ([2012/05/12 10:35:23 | 000,451,300 | R— | M]) - F:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 15417 more lines…

5

Thanks, now the question is how do I clean it, edit or delete those lines…?

6

Please just wait for a certified remover to review your logs. :wink:

7

Hi,

Don’t worry…your HOSTS file does not seem to be infected. That is a common entry that is seen when people are running Spybot which I see that you are. :slight_smile:

I see that you are running both Avast and Comodo Internet Security. Are you running the antivirus program on Comodo along with Avast or are you just utilizing the firewall?

While I am looking over your OTL logs and creating a fix, please do the following…

Download CKScanner by askey127 from Here & save it to your Desktop.
[*] Right-click and Run as Administrator CKScanner.exe then click Search For Files
[*] When the cursor hourglass disappears, click Save List To File
[*] A message box will verify the file saved
[*] Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

8

Downloaded CKScanner, run it in Win XP. The right click does not give me the “run as administrator” as in Win 7.
So I opened and run it, the trouble is that search on C drive but default and Win XP is installed in F drive.
I do not have any option in changing the drive to search. This is the result I have from C drive

CKScanner - Additional Security Risks - These are not necessarily bad
c:\carlos\winrar 3.93 final (32,64bit) [eng] [+keygen].rar
scanner sequence 3.AB.11.PWAANA
----- EOF -----

This report is not s sign of trouble for me.

9

Sorry, I forgot, yes I am running SpyBot.
Avast is my default antivirus fro years by now.
Comodo I use only the Firewall.

10

suggestion… i recomend replacing SpyBot with Malwarebytes as it is much better…
SpyBot releas a small update every wednesday, MBAM release 5 - 10 updates a day

11

I didn,t know.I guess,this is the list of “bad sites” used by Spybot?Blocking sites VIA hosts,such a primitive way ??? .

12

Hi,

Avast is my default antivirus fro years by now. Comodo I use only the Firewall.
Ok thank you for clarifying.
suggestion........ i recomend replacing SpyBot with Malwarebytes as it is much better... SpyBot releas a small update every wednesday, MBAM release 5 - 10 updates a day
I agree with this statement. I used SpyBot for years myself but do not any longer.
I didn,t know.I guess,this is the list of "bad sites" used by Spybot?
Yep...that is just how it works. :)

CKScanner has detected illegal software on your system. Besides being illegal, it’s the number one way of infecting your system as all cracked/keygen software is infected. This forum, as well as all the other malware removal forums, do not support the use of illegal software except for their removal. If I were to continue helping you with illegal software installed, it could be construed in the eyes of the law as aiding and abetting a crime.

This may or may not be related to your computer issues, however, if you wish me to continue helping you, then you must remove both the keygen and crack files as well as the related programs. If you do not agree to this then this thread will be closed and no further help will be offered because I will never be able to tell you your malware logs are clean. Please let me know if you wish to continue.

13

Yes, no problems and sorry for it, the file was downloaded and never actually used (you may believe me or not), since I know the problems with using keygens, which generally means installing a trojan or trojan downloader.

I would like to continue with your assistance.

This is the new CKScanner result:

CKScanner - Additional Security Risks - These are not necessarily bad
scanner sequence 3.RP.11.FVBBXH
----- EOF -----

14

Hi,

Sorry for the delay… :slight_smile:

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.

Run OTL.exe

[*]Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL


:Services

:OTL
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-21-1417001333-1482476501-682003330-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1417001333-1482476501-682003330-1003\..\SearchScopes\{AD41F590-D524-43B5-9ED0-B174A55C7DBC}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
IE - HKU\S-1-5-21-1417001333-1482476501-682003330-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
[2012/05/04 08:03:55 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- F:\Documents and Settings\Carlos\Application Data\Mozilla\Firefox\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - F:\Documents and Settings\Carlos\Application Data\Complitly\AutocompletePro.dll (SimplyGen)
O2 - BHO: (DepositFiles IE BHO) - {9DFE2FE9-CF99-4ADF-A28E-9B5ADB8DC74F} - F:\Program Files\DepositFiles\DF Manager\Deposit_IE_COM.dll ()
O3 - HKLM\..\Toolbar: (Deposit IE Toolbar) - {6AA40521-14E7-4B1D-B1B4-98528C1388C9} - F:\Program Files\DepositFiles\DF Manager\Deposit_IE_COM.dll ()
O3 - HKU\S-1-5-21-1417001333-1482476501-682003330-1003\..\Toolbar\WebBrowser: (Deposit IE Toolbar) - {6AA40521-14E7-4B1D-B1B4-98528C1388C9} - F:\Program Files\DepositFiles\DF Manager\Deposit_IE_COM.dll ()
O32 - AutoRun File - [2011/05/15 20:55:15 | 000,000,000 | ---D | M] - D:\AutoCad 2007 -- [ NTFS ]
O32 - AutoRun File - [2011/07/08 08:00:41 | 000,000,000 | ---D | M] - E:\AutoCAD - Charly Garcia -- [ NTFS ]
O32 - AutoRun File - [2012/01/02 09:42:07 | 000,000,000 | ---D | M] - F:\AutoCad 2007 activation crack FUNCIONA -- [ NTFS ]
[2012/05/04 08:03:05 | 000,000,000 | ---D | C] -- F:\Program Files\Conduit
[12 F:\WINDOWS\*.tmp files -> F:\WINDOWS\*.tmp -> ]
[1 F:\WINDOWS\System32\*.tmp files -> F:\WINDOWS\System32\*.tmp -> ]
[2012/05/22 07:09:57 | 000,050,176 | ---- | M] () -- F:\Documents and Settings\Carlos\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/14 15:46:04 | 000,000,088 | RHS- | C] () -- F:\Documents and Settings\All Users\Application Data\B5D132743D.sys

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot when it is done
[*]Then run a new scan and post a new OTL log ( don’t check the boxes beside LOP Check or Purity this time )

15

Run the fix and the again OTL for All Users, Quick Scan and with the text in the Custom section as to obtain the Log
File is attached, I will write again just to report the results, i.e., how the system operates, in a couple of days.
Thanks

16

Hi,

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

Please run a free online scan with the ESET Online Scanner
[i]Note: You will need to use Internet Explorer for this scan[/i]
[*]Tick the box next to YES, I accept the Terms of Use
[*]Click Start
[*]When asked, allow the ActiveX control to install
[*]Click Start
[*]Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
[*]Click Scan (This scan can take several hours, so please be patient)
[*]Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner[b]log.txt
[*]Copy and paste that log as a reply to this topic

In your next reply please attach the logs made by Malwarebytes and ESET online scanner.

17

Well, it did not take long to write again. I will explain how my PC worked today.
In the morning took over 6 times to reboot once I switched on.
Then, I saw the fix, I runt it and re started once, it was OK.
The PC works for several hours without any trouble.
I switched off at about 4:30PM. Up to here everything was fine.
At about 8:30 PM switched on again, and the trouble came back, it took three reboots to complete the start up and the PC is running.

Sorry to report this, but that is the reality.

Thanks for any advise on this.

18

Have you run ESET and Malwarebyes? If so please attach the logs so that I can see what they were showing. :slight_smile:

19

Sorry I haven’t realise that it was already on page 2.
I just run Malwarebytes and found two registry keys, cleaned them afterwards. Log is attached.

Started with the new scan and got up to where you say that it can take several hours. It is already 10:55PM now. I will make it tomorrow morning and send it.

20

Ok that sounds fine. Could you rerun Malwarebytes as well so that I can get a look at the new log since you cleaned it please? Thanks.