PC Auto restart

[Have you installed Linux on your computer?]

Have you installed Linux on your computer?
Yes, but uninstalled
	12 (31%)
Yes, still installed
	10 (26%)
No
	16 (42%)
Total Voters: 38

[showstopper]

tried to search but i can't find any related topic to my problem. there's a pop up window and my pc will automatically restart (sorry, i can't provide the screenshot; i tried but it can't be done). anyway, there's a message like "this shutdown was initiated by NT Authority\System" and "windows\system32\services.exe"

i already installed Security Update for Windows XP (KB921883), had my PC reformatted twice but to no avail.

my OS is windows XP, SP2.

---------------------------

i tried to use hijackthis. below is the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:18:32 PM, on 2/14/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\QosServM.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\r_server.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Mozilla Firefox\firefox.exe
Documents\Downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://hronline/harry
F2 - REG:system.ini: UserInit=userinit.exe,
O1 - Hosts: 149.122.26.104 RZPSAAP500-5J
O1 - Hosts: 149.122.26.114 MHRZUSATRN110
O1 - Hosts: 149.122.26.115 MHRZUSATRN111
O1 - Hosts: 190.80.11.239
O1 - Hosts: 190.80.11.224
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://hronline/harry
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265741644500
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://192.168.106.54/tsweb/msrdp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56510FCC-E3E7-403C-9A22-AA7778B99BB4}: NameServer = 172.16.51.253,192.168.15.131,202.138.128.50
O17 - HKLM\System\CCS\Services\Tcpip\..\{B4D1F8E1-8E4C-4FCF-9B0F-D23A0DB8F2B3}: NameServer = 192.168.15.131,172.16.51.253
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\CWBRXD.EXE
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iClarityQoSService - AVAYA Communication - C:\WINDOWS\system32\\QosServM.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe

--
End of file - 4462 bytes

hope this helps

[pcruztemp]

scan with an antivirus in safe mode

[SwordFish]

Boot PC. After Post press F8 key (this will trigger safe mode). Scroll down & select safe mode. Access your administrator account & scan from there. If antivirus scan fails, repeat the procedure by restarting your PC (press F8 after post), scroll down & select "disable automatic restart on system failure". This recreates the BSOD w/o restarting, giving you ample time to jot down the error code. Post it here or you can use the search engines for solutions in the web. HTH   

[Justin]

Hello showstopper, good morning.

Tell us the scenario or complete information that we need to know:
1. Have you installed any software before the problem occurred? What's the name and version of the software?
2. What was the last thing you did before the problem occurred?
3. What troubleshooting have you done so far?

Take care and God bless.

[showstopper]

Hi Justin!

No, i did not install anything. The first problem i encountered is that my PC automatically shuts down. I had it reformatted however the problem still persist. So i had it reformatted again for the second time. After which, i encountered this problem already. A thorough scan has been performed as well but the AV is not detecting any virus.

I don't have any P2P applications installed in my PC, i am just using the internet for browsing. 

[Justin]

Hello showstopper, good evening.

I think you're infected with Blast Worm. Try this --> Click HERE

You may want to read this --> Here and Virus alert about the Blaster worm and its variants

Update us here.

Take care and God bless.

[SwordFish]

If antivirus scan fails, repeat the procedure by restarting your PC (press F8 after post), scroll down & select "disable automatic restart on system failure". This recreates the BSOD w/o restarting, giving you ample time to jot down the error code.

Or if  you can access safe mode w/o restarting go to event viewer under administrative tools (control panel). Click on custom views > administrative events & look for the error pertaining to system shutdown..

It could be a hardware problem.. Jot down the error code..

If it is a software problem (particularly by infection) try bro justin's post. Scan all your partitions (assuming you can boot to windows in normal mode or in safe mode). The infection could be hiding in an another partition.

HTH

[pcruztemp]

go to the bios setup screen and wait. if it still happens there, we're 100% sure its a hardware problem like overheating or generic psu

[darkangel]

go to the bios setup screen and wait. if it still happens there, we're 100% sure its a hardware problem like overheating or generic psu

nice idea!

alternatively, you can check temperature in the bios. its usually on the health section (if your bios does support temperature monitoring). High CPU temp triggers restarts.

[showstopper]

Hello showstopper, good evening.

I think you're infected with Blast Worm. Try this --> Click HERE

You may want to read this --> Here and Virus alert about the Blaster worm and its variants

Update us here.

Take care and God bless.

here's the result

PC Auto restart