Resolved-running Spybot Causes System To Turn Off

[Torin_Darkflight]

Ok, earlier this evening I got back from a rather curious computer call. Whenever the user runs Spybot, it'll get to about halfway done in the scan, then the computer will suddenly turn off. No error messages, no beeps, just *poof*, it's off. Then, it'll refuse to turn back on unless you let it sit for about 10 minutes (The lights and fans will turn on, but the system won't POST).

The fact that it won't POST afterwards obviously points to a hardware problem instead of a software problem. Just to be sure though, I scanned for viruses (Came up clean), and I was able to run Ad-Aware all the way through (All it found were a few insignificant cookies). I then tried to run Spybot using a BartPE boot CD (This helped guarantee that no potentially-bad programs on the harddrive were loading), and it still did the same thing, shut off and refused to turn back on afterwards.

After waiting for 10 minutes, I got it to turn on again. I ran Windows Memory Diagnostics to check the RAM. No errors, so bad RAM is not the cause.

Ok, time to start fiddling around inside. My first thought was perhaps it was overheating. But, it's not overheating. The CPU fan is working correctly, the temps shown in the BIOS are all normal (30s for the system, 40s for the CPU), and touching the HSF immediately after it shuts off yields a relatively cool-feeling HSF.

Then I thought maybe the old 300W PSU was going bad. So, I swapped it out with a spare, known-good 350W PSU I had on hand. Nope, still did the same thing.

During the downtime immediately after one of the shutdowns, I did the following:

-Removed, swapped around and reseated the RAM (Two sticks of 128MB each). Still wouldn't POST

-Disconnected the harddrive to see if perhaps a problem with it was causing the trouble. Still wouldn't POST

-Removed the video card then turned it on. It still didn't POST, because it didn't give any beeps to indicate a missing video card

After doing all of these tests and steps, I have two potential causes for this whole mess in my head right now: either the CPU or motherboard is going bad. I have a spare CPU on hand that should fit in their system (The CPU they have is an AMD Athlon 1GHz, the spare CPU I have is an AMD Duron 1GHz), and as of the last time I used it several months ago, it still works. I'm gonna try swapping that out when I return tomorrow. If it still shuts down while running Spybot, then my opinions would point towards the motherboard going bad.

But, before I jump on any one specific decision, I thought I should ask here...what else, if anything, could be causing the problem described?

I realize this was a long post, and I apologize for that. So, to keep you from having to re-read it all, I'll briefly sum it all up here.

=============================

PROBLEM: While running Spybot, the system shuts off, and will not POST unless allowed to sit for around 10 minutes afterwards.

WHAT HAS BEEN DONE/CHECKED FOR:

-Virus scan (Came up clean)

-Spyware scan with Ad-Aware (Only things found were cookies)

-Possible overheating (Not the cause, temperatures are normal, fans are working)

-Possibly bad PSU (Swapped with a known-good PSU, didn't help)

-Possibly bad RAM (Ran Windows Memory Diagnostics, no errors found)

-Moved and reseated the RAM during the downtime following a shutdown (Still wouldn't POST)

-Disconnected the harddrive during the downtime following a shutdown (Still wouldn't POST)

-Removed the video card during the downtime following a shutdown (Still wouldn't POST because there were no beeps indicating a missing video card)

YET TO BE CHECKED:

-Possibly bad CPU (Plan on swapping with a known-good one tomorrow)

-Possibly bad motherboard (I am unable to test that at this time)

WHAT I WANT TO KNOW: If there is anything else beyond what is listed above that I should check or try.

=============================

And finally, here are the specs of the system in question that I am aware of (These are all original specs, not of any of the known-good swaps I did):

-Systemax Tiger (Exact model unknown)

-300W PSU

-MSI Motherboard (Exact model unknown, but I think it started with "K2T")

-AMD Athlon 1GHz CPU

-256MB RAM (Unknown if it is PC100 or PC133)

-TNT2 16MB AGP video card (I think it's nVidia)

-IDE harddrive (Unknown brand or capacity)

-52x CD-ROM

-8x4x32x CD-RW

-Windows XP Professional with SP1 (I plan on upgrading it to SP2 when/if I get the current issue fixed)

I appreciate any help on this perplexing issue.

Edited September 30, 2005 by Torin_Darkflight

[JSKY]

Have you tried in safe mode?

Does the PC just shut off, or does it go into a shutdown?

Try this. R-Click on MY Computer and click on properties.

This opens up System Properties Window. Then to "Advanced">"Startup and Recovery"and click on "Settings". In the Startup and Recovery Window, place a check in "Send an Administative Alert", and uncheck "Automaticly Restart".

The next time the PC shuts down it will stop and list that is causing the problem. Copy and list back here what it gives as an error. (it could be a long list).

[thesidekickcat]

Have you tried uninstalling Spybot and checking system out, then reinstalling it and running it again after updates?

Oh check to see if the customer had anything quarantined by Spybot before uninstalling it.

Which version of Spybot? updated?

Pat.

God bless everyone.

[shanenin]

Try this. R-Click on MY Computer and click on properties.

This opens up System Properties Window. Then to "Advanced">"Startup and Recovery"and click on "Settings". In the Startup and Recovery Window, place a check in "Send an Administative Alert", and uncheck "Automaticly Restart".

The next time the PC shuts down it will stop and list that is causing the problem. Copy and list back here what it gives as an error. (it could be a long list).

<{POST_SNAPBACK}>

That is a neat little trick, I will not for get that :-)

[blim]

Now, Torin, I am a total noob, but it doesn't make sense that your VS and Adaware works fine, but Spybot doesn't.....Which makes me think Spybot might be the culprit.

All I can do is tell you what made us reformat our Possessed Gateway....Spybot or something it picked up killed our Internet Explorer--Adaware and Mcaffe VS worked fine on it. (now, the PG has been possessed since "day one", has worked good since reformatting, BUT we've been busy and lazy and haven't installed internet access on it yet. But I have to admit, I am scared to run Spybot on that machine!). The PG has a 350 gigawatt processor, which makes me wonder if Spybot might be "too powerful of a program" for old processors???

Another solution would be to post a Hijack log.

I'm keeping an eye on this thread!!! If you don't find an answer here, please post what worked for you, so I can use your solutions for the PG!

Thanks,

Liz

[Torin_Darkflight]

Have you tried in safe mode?

Not yet, I'll try that tomorrow. However, given the fact that immediately after it shuts down the system won't POST for around 10 minutes, most likely it is hardware-related, in which case Safe Mode might not help. I'll try it anyway.

Does the PC just shut off, or does it go into a shutdown?

It just turns off. No error messages, no "Windows is shutting down", nothing. It's sudden, like flipping off a light switch.

R-Click on MY Computer and click on properties...Then to "Advanced">"Startup and Recovery" and click on "Settings"...place a check in "Send an Administative Alert", and uncheck "Automaticly Restart".

I tried unchecking Automatically Restart, but it didn't work (I forgot to put that in my original post). All it does is turn off, no warning, no explanation. I didn't try the Administrative Alert function, but since unchecking Automatically Restart didn't work, I'm tempted to believe Administrative Alert won't either. I'll try it anyway.

Have you tried uninstalling Spybot and checking system out, then reinstalling it and running it again after updates?

I didn't try reinstalling Spybot on the customer's computer, but the install of Spybot I ran on BartPE was clean and brand new. This leads me to believe a reinstall of Spybot won't help, but I'll try anyway.

Which version of Spybot? updated?

The current version of Spybot (1.4) is installed on both the customer's computer and the copy of BartPE I used. They are both up-to-date as of noon today.

...makes me wonder if Spybot might be "too powerful of a program" for old processors???

I've successfully run Spybot on old AMD K6 systems with pathetic 100W power supplies. Most likely in this particular situation Spybot is doing something that the other programs aren't doing which somehow interacts with whatever the problem is to cause the system to shut down and not POST afterwards. Exactly what, I do not know. As for whether Spybot is the only program that triggers this shutdown, I'm not sure. I'll ask the customer if any other programs cause it tomorrow and report back when I get a chance.

Another solution would be to post a Hijack log.

I'll try running HijackThis tomorrow. Although, given the fact that AVG came up clean, Ad-Aware found only cookies and Spybot doesn't find anything at all up to the point the system shuts off, most likely there might not be anything to find (From the sounds of it, the customer was very good at regularly updating and running the AVG/Ad-Aware/Spybot trio).

Edited September 30, 2005 by Torin_Darkflight

[Torin_Darkflight]

Ok, I'm back on the ailing computer right now. Of the things recommended to me last night, here is what I have tried so far:

-Running Spybot in Safe Mode (Didn't help, it still turned off)

-Disable Tea Timer in Spybot (Recommended on the G4 forums. Tea Timer was already disabled, thus this isn't working)

-Enabling Administrative Alert (It was already enabled, thus it's not helping)

-Uninstalling then reinstalling Spybot (Didn't help)

-Run HijackThis (See log below)

Now, while I was running Spybot in Safe mode, it did manage to find a couple things before the system turned off. They were "Spyware Stormer" and "RealDownload Express". These are not being detected when Windows is running in normal mode. Could this be a clue as to the possible cause?

Something else I am trying is swapping out the CPU with a known-good spare I have on hand. I just a few minutes ago installed the spare, but I have yet to run Spybot to see if it works or not (I wanted to post some updates before I dove into another potential 10 minutes of valueless downtime).

Ok, as promised, here is the HJT log. I realize there is a forum designed specifically for HJT logs, but I wanted to try to keep everything relating to this issue in a single thread.

Logfile of HijackThis v1.99.1

Scan saved at 11:06:36 AM, on 9/30/2005

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Iomega\System32\AppServices.exe

C:\PROGRAM FILES\MICROSOFT SQL SERVER\MSSQL\Binn\sqlservr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\System32\RUNDLL32.EXE

C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\MICROSOFT SQL SERVER\80\Tools\Binn\sqlmangr.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Iomega\AutoDisk\ADService.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\WINDOWS\System32\wuauclt.exe

F:\Utils\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emsnetwork.org/artman/publish/index.shtml

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit

O4 - Global Startup: Service Manager.lnk = C:\Program Files\MICROSOFT SQL SERVER\80\Tools\Binn\sqlmangr.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://bin.mcafee.com/molbin/Shared/ComCtl...22/ComCtl32.cab

O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...s/yinst0401.cab

O16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) - http://scpwjc.ops.placeware.com/etc/place/...quicksilver.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsc...84/mcinsctl.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/1630ea0d04ee8eea8306/...ip/RdxIE601.cab

O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion.../ICSScanner.cab

O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://12.10.40.4/ts/msrdp.cab

O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmg...,21/mcgdmgr.cab

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Edited September 30, 2005 by Torin_Darkflight

[blim]

Hi Torin!

What you might want to do is post your hijack log in the hijack section, too, with a link to this thread. That way, you'll be sure the hijack experts will see your log

Good luck! I'll be reading!

Liz

[Dragon]

...makes me wonder if Spybot might be "too powerful of a program" for old processors???

I've successfully run Spybot on old AMD K6 systems with pathetic 100W power supplies. Most likely in this particular situation Spybot is doing something that the other programs aren't doing which somehow interacts with whatever the problem is to cause the system to shut down and not POST afterwards. Exactly what, I do not know. As for whether Spybot is the only program that triggers this shutdown, I'm not sure. I'll ask the customer if any other programs cause it tomorrow and report back when I get a chance.

after doing this for 2 years, I can attest that this problem is not directly related to Spybot or its programming. From what I am seeing in your discriptions it sounds a lot like its actually a BIOS issue. You might want to check and see if the BIOS was recently flashed, providing this MOBO is able to have that done. If it can't then there is a possibility that the BIOS chip is dying, or even the battery. those are just some places I would look into.

I can also point out that your HJT log is clean, so its definately not software related.

[Torin_Darkflight]

Ok, I just returned back from the computer job. I did everything I could think of and was able to do given the tools and parts I had available to me. After exhausting every other option available to me, I ended up replacing the motherboard and reinstalling Windows. One of the capacitors on the old motherboard was leaking when I removed it, which leads me to believe that it was most likely the culprit. The system is working perfectly now, and all is well.

Thanks for all the help.

[JSKY]

Glad you got it. Would have been one of the last but least things I would have checked.

Have a PC at work with exploded caps, and it does the same thing, Tho it never crossed my mind. You always hope it's the last thing you need to look at is the board.