|
Author
|
Topic: reboots every time after logging on
|
sweetsue Member
|
posted June 26, 2005 08:45 AM
The "DerBiz" virus will do what you explaining. Sorry, what hotstuff is posting....Sue.
[This message has been edited by sweetsue (edited June 26, 2005).] IP: Logged |
Josh1 Administrator
|
posted June 21, 2005 02:14 PM
Okay in safe mode bring up msconfig, by going to start-run then type msconfig, and then go to the last tab, uncheck all the items then hit apply and ok, reboot the computer. If you can boot normally repeat this process by checking only one item in msconfig at a time then rebooting each time until you find the offending program. However if you can get into safe mode, most applications that start up will not start up so that might not be the problem, make sure you tired to do what Wedor advised. ------------------ Powered by Intelligent Computing Solutions. ------------------------ www.footslog.com www.compsol.8k.com For every problem, there is a solution.
IP: Logged |
wedor Moderator
|
posted June 21, 2005 07:00 AM
Here is one bad file, gdklke.exeRight click "My Computer", left click "Properties", left click the "Advanced" tab, left click the "Settings" button under "Start up and Recovery", uncheck the box that says "Automatically restart". IP: Logged |
hotstuff Junior Member
|
posted June 21, 2005 02:50 AM
I haven't had time to run the event viewer, I will try later. When you suggested load one program at a time after running msconfig can you be more precise about how I actually do this. Do I run under normal startup or selection startup. It doesn't allow me to tick diagnostic start up. In the system.ini folder there is one 'application'. Under services there are about 50 items and about 20 under startup. Here is the HJL. Logfile of HijackThis v1.99.1 Scan saved at 19:58:54, on 19/10/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\system32\svchost.exe C:\windows\Explorer.EXE C:\windows\System32\ctfmon.exe C:\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiny.com O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [TkBellExe] C:\windows\realsched.exe /i O4 - HKLM\..\Run: [SupaDial] C:\Program Files\SupaDial\SupaDial.exe /A O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Microsoft Features] ms32cfg.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [BIOS XP Loader] gdklke.exe O4 - HKLM\..\Run: [BBDial] C:\Program Files\BT Voyager 105 ADSL Modem\BT Broadband.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\System32\ctfmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.tiny.com O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096741291140 O21 - SSODL: F0ACGEGE - {7CF05202-3031-6123-00BC-0BD5694D5F4D} - C:\windows\System32\Ohplbjna.dll O21 - SSODL: mtklefa - {311D3110-4F6D-4551-A298-5DD7C43F7829} - C:\windows\System32\yvsb32.dll (file missing) O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\windows\system32\drivers\KodakCCS.exe O23 - Service: Windows Update Service (muamgrd) - Unknown owner - C:\WINDOWS\System32\muamgrd.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\System32\nvsvc32.exe O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE Thanks again for your help. IP: Logged |
Josh1 Administrator
|
posted June 20, 2005 10:21 AM
You are welcome also try the event viewer and let us know what happens------------------ Powered by Intelligent Computing Solutions. ------------------------ www.footslog.com www.compsol.8k.com For every problem, there is a solution.
IP: Logged |
hotstuff Junior Member
|
posted June 20, 2005 10:13 AM
I will load it to a floppy disk and post tomorrow. Thanks IP: Logged |
Josh1 Administrator
|
posted June 20, 2005 10:05 AM
No problem, you could try safe mode and then go into msconfig, disable every program then one by one try to load windows until you find the offending program. Can you save the HJT log to a floppy disk then upload that disk to another computer that has internet access?------------------ Powered by Intelligent Computing Solutions. ------------------------ www.footslog.com www.compsol.8k.com For every problem, there is a solution.
IP: Logged |
hotstuff Junior Member
|
posted June 20, 2005 10:00 AM
Firstly thanks for replying I dont get any error messages The machine reboots after I selected my user id and goes into the desktop. It then creates the shortcuts on the desktop and then immediately reboots without giving me the chance to do anything else.I will try your suggestions. I can't post the HJL as I dont have internet access in safe mode. I presume this is normal? Is there another option I could use to gain internet access without a normal startup? IP: Logged |
Josh1 Administrator
|
posted June 20, 2005 09:49 AM
Do you get any error massages? Where does your machine reboot at? Try this in safe mode, go to control panel then administrative tools-services- log or event viewer, then go under system log and look for the date and time that your machine reboots at, and see what the error message is and the description of the error, also go to system (in control panel) then advanced and look for automatically reboot when a major error occurs, uncheck that and hit apply and ok. Also post a HJT this log in your reply.------------------ Powered by Intelligent Computing Solutions. ------------------------ www.footslog.com www.compsol.8k.com For every problem, there is a solution.
IP: Logged |
hotstuff Junior Member
|
posted June 20, 2005 07:23 AM
I have basically been cleaning my machine with a lot of spyware via the hijack log. However now when I go in to the desktop the machine reboots and takes me back to the log on screen.I can boot up in safe mode but dont therefore have internet access. I guess there is a problem with something in the startup menu?? Any help would be most appreciated as I am getting very frustrated. IP: Logged |