For information on how to deal with, and protect your computer, please go down to the bottom of the help desk to the archive section (main page). From there select how to combat Spyware, in this archive there are many tools, which will help you combat this problem. Problems concerning the Windows XP Operating System should go in this forum.


Email This Page to Someone
  Footslog's Web Boards
  Windows XP
  reboots every time after logging on

Post New Topic  Post A Reply
profile | register | preferences | faq | search

next newest topic | next oldest topic
Author Topic:   reboots every time after logging on
sweetsue
Member
posted June 26, 2005 08:45 AM     Click Here to See the Profile for sweetsue     Edit/Delete Message
The "DerBiz" virus will do what you explaining.
Sorry, what hotstuff is posting....

Sue.

[This message has been edited by sweetsue (edited June 26, 2005).]

IP: Logged

Josh1
Administrator
posted June 21, 2005 02:14 PM     Click Here to See the Profile for Josh1     Edit/Delete Message
Okay in safe mode bring up msconfig, by going to start-run then type msconfig, and then go to the last tab, uncheck all the items then hit apply and ok, reboot the computer. If you can boot normally repeat this process by checking only one item in msconfig at a time then rebooting each time until you find the offending program. However if you can get into safe mode, most applications that start up will not start up so that might not be the problem, make sure you tired to do what Wedor advised.

------------------
Powered by Intelligent Computing Solutions.
------------------------
www.footslog.com

www.compsol.8k.com


For every problem, there is a solution.


IP: Logged

wedor
Moderator
posted June 21, 2005 07:00 AM     Click Here to See the Profile for wedor     Edit/Delete Message
Here is one bad file, gdklke.exe

Right click "My Computer", left click "Properties", left click the "Advanced" tab, left click the "Settings" button under "Start up and Recovery", uncheck the box that says "Automatically restart".

IP: Logged

hotstuff
Junior Member
posted June 21, 2005 02:50 AM     Click Here to See the Profile for hotstuff     Edit/Delete Message
I haven't had time to run the event viewer, I will try later. When you suggested load one program at a time after running msconfig can you be more precise about how I actually do this.

Do I run under normal startup or selection startup. It doesn't allow me to tick diagnostic start up.

In the system.ini folder there is one 'application'. Under services there are about 50 items and about 20 under startup.

Here is the HJL.
Logfile of HijackThis v1.99.1
Scan saved at 19:58:54, on 19/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\windows\System32\ctfmon.exe
C:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiny.com
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] C:\windows\realsched.exe /i
O4 - HKLM\..\Run: [SupaDial] C:\Program Files\SupaDial\SupaDial.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Microsoft Features] ms32cfg.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [BIOS XP Loader] gdklke.exe
O4 - HKLM\..\Run: [BBDial] C:\Program Files\BT Voyager 105 ADSL Modem\BT Broadband.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://www.tiny.com
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096741291140
O21 - SSODL: F0ACGEGE - {7CF05202-3031-6123-00BC-0BD5694D5F4D} - C:\windows\System32\Ohplbjna.dll
O21 - SSODL: mtklefa - {311D3110-4F6D-4551-A298-5DD7C43F7829} - C:\windows\System32\yvsb32.dll (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\windows\system32\drivers\KodakCCS.exe
O23 - Service: Windows Update Service (muamgrd) - Unknown owner - C:\WINDOWS\System32\muamgrd.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE

Thanks again for your help.

IP: Logged

Josh1
Administrator
posted June 20, 2005 10:21 AM     Click Here to See the Profile for Josh1     Edit/Delete Message
You are welcome also try the event viewer and let us know what happens

------------------
Powered by Intelligent Computing Solutions.
------------------------
www.footslog.com

www.compsol.8k.com


For every problem, there is a solution.


IP: Logged

hotstuff
Junior Member
posted June 20, 2005 10:13 AM     Click Here to See the Profile for hotstuff     Edit/Delete Message
I will load it to a floppy disk and post tomorrow.

Thanks

IP: Logged

Josh1
Administrator
posted June 20, 2005 10:05 AM     Click Here to See the Profile for Josh1     Edit/Delete Message
No problem, you could try safe mode and then go into msconfig, disable every program then one by one try to load windows until you find the offending program. Can you save the HJT log to a floppy disk then upload that disk to another computer that has internet access?

------------------
Powered by Intelligent Computing Solutions.
------------------------
www.footslog.com

www.compsol.8k.com


For every problem, there is a solution.


IP: Logged

hotstuff
Junior Member
posted June 20, 2005 10:00 AM     Click Here to See the Profile for hotstuff     Edit/Delete Message
Firstly thanks for replying
I dont get any error messages
The machine reboots after I selected my user id and goes into the desktop. It then creates the shortcuts on the desktop and then immediately reboots without giving me the chance to do anything else.

I will try your suggestions. I can't post the HJL as I dont have internet access in safe mode. I presume this is normal? Is there another option I could use to gain internet access without a normal startup?

IP: Logged

Josh1
Administrator
posted June 20, 2005 09:49 AM     Click Here to See the Profile for Josh1     Edit/Delete Message
Do you get any error massages? Where does your machine reboot at? Try this in safe mode, go to control panel then administrative tools-services- log or event viewer, then go under system log and look for the date and time that your machine reboots at, and see what the error message is and the description of the error, also go to system (in control panel) then advanced and look for automatically reboot when a major error occurs, uncheck that and hit apply and ok. Also post a HJT this log in your reply.

------------------
Powered by Intelligent Computing Solutions.
------------------------
www.footslog.com

www.compsol.8k.com


For every problem, there is a solution.


IP: Logged

hotstuff
Junior Member
posted June 20, 2005 07:23 AM     Click Here to See the Profile for hotstuff     Edit/Delete Message
I have basically been cleaning my machine with a lot of spyware via the hijack log. However now when I go in to the desktop the machine reboots and takes me back to the log on screen.

I can boot up in safe mode but dont therefore have internet access. I guess there is a problem with something in the startup menu??

Any help would be most appreciated as I am getting very frustrated.

IP: Logged

All times are CT (US)

next newest topic | next oldest topic

Administrative Options: Close Topic | Archive/Move | Delete Topic
Post New Topic  Post A Reply
Hop to:

Contact Us | Footslog Home



Ad

The information presented on FootsloG.com is copyrighted as a collective work. FootsloG.com is free for personal use (non-commercial). Any other use FootsloG.com, including copying or reproducing any portion of this web site is strictly prohibited without the express written consent of FootsloG.com. If you have any questions about the usage term please contact us via email: webmaster@footslog.com.



Problems, Knowledge, and Power, powered by intelligent Computing Solutions