computer automatically restarting when shutdown

[seagullpat]

Hi, hope someone out there can advise a complete techno-ignoramus...  I have Windows XP and it's been fine for a couple of years; however, when I shut down the computer now it automatically restarts. I have no idea what to do about this, any ideas? I've run HitmanPro 2 - don't know if that's relevant, but I didn't know what else to do!

Thanks, Seagullpat

[infoseeker]

Hi, hope someone out there can advise a complete techno-ignoramus...  I have Windows XP and it's been fine for a couple of years; however, when I shut down the computer now it automatically restarts. I have no idea what to do about this, any ideas? I've run HitmanPro 2 - don't know if that's relevant, but I didn't know what else to do!

Thanks, Seagullpat

i got same problem before, it really make me crazy
in my case its only the switch, i change a new one then it solves my problem

but according to my searched, there is so many other reason:

worm?
Ram?
check inside you cpu, maibe there is some scattered metal (i.e. screw) that touching some i.c. in the motherboard
CPU FAN?
PSU FAN?

try to check them one by one

[GX1_Man]

If it didn't used to do it and now it is, then something has changed. What are you using for malware protection? Does everything else function normally about this machine?

[seagullpat]

Thanks for the responses, Infoseeker and GX1_Man!

I've got the free edition of AVG and Zone Alarm, and I haven't changed anything to my knowledge (certainly the machine hasn't been physically moved or anything) except that I recently got a pop-up "Antivirenkit" warning when I wanted to open a job application on a website - do you think this is connected, maybe? Otherwise it all seems to be running fine. Sorry to be so lame, but this is all new to me.

[infoseeker]

before that happen [highlight]"automatically shuttingdown"[/highlight] did you installed any programs or application?

[GX1_Man]

Antivirenkit seems to be a German antivirus program.

http://www.amazon.de/gp/product/B0002QYS5A/303-6916365-2932215?v=glance&n=301928

Are you sure the system is clean? It may be a mechanical issue, but let's make sure.

http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1149948530

[seagullpat]

OK - Thanks for the ideas and links, very helpful (and comforting, too). I haven't installed any programmes etc, so I guess it's not that; I checked out Antivirenkit but can't see any obvious problem unless it's a fake of some sort - I haven't knowingly installed/downloaded Antivirenkit at any point, anyway. I'm about to get AVG to do a scan and see if it picks up anything horrible.

The only other new development is that when I booted up just now I got a screen ("AwardBIOS Setup Utility") that said "during the last boot-up your system hung for an improper CPU speed setting" and telling me to make sure the CPU speed conforms to the specs of my CPU. I really hate to admit it, but I haven't got a clue what this means (I meant to come on here and ask infoseeker about CPU, as it was something recommended to look at). Anyway, I'll run the AVG scan and report back. And thanks, once again, for the advice.

Oh, I have one other (no doubt risibly obvious) question - do you think this problem represents a significant danger to information on the computer, like should I not buy stuff online or whatever?

Edited: AVG scan didn't find anything

[GX1_Man]

You need to do two things. First download and run Hijack This and post the logfile it creates here. It will take several posts to include it all, and it is ALL needed.

http://www.majorgeeks.com/download3155.html

Secondly, download and run Everest Home and you can find out ALL the specifics about your machine very easily - processor, RAM, hard drive, video card and so much more. Save a copy of this file and post the important things for us to peruse.

http://www.majorgeeks.com/download4181.html

Let's make sure it is clean before you put personal data in there.  

[seagullpat]

Thanks for the ongoing help. I downloaded Hijackthis but it tells me power archiver is expired - is there a way round this? I hope this isn't driving you mad, but I just don't know anything about computers

[GX1_Man]

You can download a trial version of Winzip to extract it. www.winzip.com

[seagullpat]

OK, here goes:
Logfile of HijackThis v1.99.1
Scan saved at 11:30:48, on 21/06/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\AntiVirusKit\AVKService.exe
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Cherry\KeyMan\KeyMan.exe
C:\Program Files\AntiVirusKit\AVKWCtl.exe
C:\ImageMate CompactFlash USB\SandIcon.Exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Cherry\CDI\CDI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Softissimo\Lexibase Pro Collins\exe\L-Express.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\ntl\broadband medic\bin\mpbtn.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinZip\WINZIP32.EXE
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN

Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} -

c:\windows\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN

Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN

Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -

c:\windows\googletoolbar2.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [CherryKeyman] "C:\Program Files\Cherry\KeyMan\KeyMan.exe"
O4 - HKLM\..\Run: [SandIcon] C:\ImageMate CompactFlash USB\SandIcon.Exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft

Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series"

/O6 "USB002" /M "Stylus CX3600"
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series (Copy 1)]

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P35 "EPSON Stylus CX3600 Series

(Copy 1)" /O6 "USB002" /M "Stylus CX3600"
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\ntl\BROADB~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: broadband medic.lnk = C:\Program Files\ntl\broadband

medic\bin\matcli.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare

software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\KODAK\KODAK Software

Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: L-Express.lnk = C:\Program Files\Softissimo\Lexibase Pro

Collins\exe\L-Express.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft

Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search -

res://c:\windows\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word -

res://c:\windows\GoogleToolbar2.dll/cmwordtrans.html

[seagullpat]

O8 - Extra context menu item: Backward Links - res://c:\windows\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to Keyman - C:\Programme\Cherry\keyman\IEMenuExtKeyman.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\windows\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
O16 - DPF: {ACEFFC26-4628-11D1-B14A-105C01C13001} (WSpell Spelling Checker Control) - file://C:\Program Files\IDM\XML Editor\bin\wspell.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVK Service (AVKService) - Unknown owner - C:\Program Files\AntiVirusKit\AVKService.exe
O23 - Service: AVK Monitor (AVKWCtl) - Unknown owner - C:\Program Files\AntiVirusKit\AVKWCtl.exe
O23 - Service: Cherry Device interface - Cherry Gmbh, Auerbach Germany, www.cherry.de - C:\Program Files\Cherry\CDI\CDI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

[seagullpat]

I've run Everest, not really sure what's important or not, but here's the gist of it - I hope it's useful:


  
    Motherboard:
      CPU Type                                          Intel Celeron, 2000 MHz (20 x 100)
      Motherboard Name                                  Asus P4S533-MX  (3 PCI, 1 AGP, 2 SDR DIMM, 2 DDR DIMM, Audio, Video)
      Motherboard Chipset                               SiS 651
      System Memory                                     224 MB  (PC2700 DDR SDRAM)
      BIOS Type                                         Award Modular (02/25/03)
    
    Processor Properties:
      Version                                           Intel(R) Celeron(R)
      External Clock                                    100 MHz
      Maximum Clock                                     3200 MHz
      Current Clock                                     2000 MHz
      Type                                              Central Processor
      Voltage                                           1.6 V
      Status                                            Enabled
      Upgrade                                           ZIF
      Socket Designation                                PGA 478
 
    Memory Module Properties:
      Socket Designation                                DIMM 1
      Type                                              DIMM, SDRAM
      Installed Size                                    256 MB
      Enabled Size                                      256 MB

    CPU Properties:
      CPU Type                                          Intel Celeron
      CPU Alias                                         Northwood-128
      CPU Stepping                                      D1
      Engineering Sample                                No

Thanks again for the help and patience!

[seagullpat]

Does this info help, or should I being doing something else as well, do you think?

[seagullpat]

Oh well, thanks anyway.