Windows close on their own, computer restarts

[innosin]

Weird stuff going on lately. I've run Hijack This, SpyBot, and Panda anti-virus, all of which have found nothing.

I first noticed that windows would close on their own. After some trial-and-error, this seems to occur when Yahoo Messenger or Trillian are open. Notepad, Calculator, MSPaint, and a few other things like some software installers just show up briefly and then close whenever I move my mouse. Command Prompt works fine.

When playing Team Fortress 2, Windows XP (5.1, Service Pack 3) would just restart randomly. It happened once when I chose to exit the game and once when the next map was loading.

Is this just possibly a corrupt Windows install, or something more malicious?

[JJ 3000]

Sounds like it could be a problem with your keyboard. You could try another one, just to rule it out as a possible culprit.

[innosin]

I was thinking that, but why would the automatic closing only occur with certain windows (usually apps packaged in Windows like the ones I mentioned), and only when certain other programs (trillian, ymessenger) are running?

[Carbon Dudeoxide]

I've run Hijack This, .......... all of which have found nothing.

How are you checking?

I first noticed that windows would close on their own.

Do you mean the computer shuts off/restarts?

[innosin]

I checked the processes listed and referenced any suspect ones via Google to see if they were malicious or just a normal process.

As for 'windows closing' i should say programs. When I'm running Trillian or Yahoo Messenger (maybe other programs), I'm unable to load things like Notepad, Paint, or Calculator. They flash on screen and disappear when I move my mouse. Same goes for trying to run installs or a few other programs.

[Carbon Dudeoxide]

I suggest posting the HijackThis log here so we can have a look at it.

[innosin]

Here's the HijackThis log

Code: [Select]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:21:11 PM, on 8/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\RTHDCPL.EXE
F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE
F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
f:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
F:\Program Files\Viewpoint\Common\ViewpointService.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe
F:\Program Files\Mozilla Firefox\firefox.exe
E:\setup.exe
F:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
C:\sdfsd\HiJackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "F:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] F:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [APVXDWIN] "F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKCU\..\Run: [igndlm.exe] F:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - F:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Panda Software Controller - Panda Software International - F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - F:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - f:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
O23 - Service: TiVo Beacon (TivoBeacon2) - TiVo Inc. - F:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - F:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - F:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5982 bytes


[evilfantasy]

I don't see any malware but there are a few things to take care of.

Download ViewpointKiller.zip

• Unzip the program and all of the contents of ViewpointKiller.zip to a location such as your desktop.
  
• Double click the ViewpointKiller icon to run ViewpointKiller.exe.
  
• Select the File menu, and select Check to see if you have Viewpoint installed.
  
• If ViewpointKiller indicates that any of the Viewpoint variants are installed, select the proper Kill option in the File menu.

• Follow the prompts and instructions very carefully, answering Yes or No depending on which option you are most comfortable with.
  
• The MsConfig instructions are very important, so be sure to read them carefully.

• Note: When done with ViewpointKiller right click and delete all files that were unzipped.

.
----------

Your Java is out of date.

Older versions have vulnerabilities that malicious sites can use to infect your system.

First install the new Sun Java Runtime Environment

Be sure to close all browser windows before beginning the install.

Remove the old version(s)

• Download JavaRa.zip and unzip the file to your Desktop.
  
• Open JavaRA.exe and choose Remove Older Versions
  
• Once complete exit JavaRA and delete the program.
• Run CCleaner.

.
----------

Use the Secunia Software Inspector

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and check for updates.

[innosin]

Installed all updates to Windows. Tried to update Java and ran into a few problems, ended up with me now running Java 5....

I try installing Java 6 in a variety of ways: online installer and offline installer, with Java 5 installed and with Java cleaned from the computer. Nothing works, I just keep getting what is apparently an infamous "Error 1722".

[evilfantasy]

Do a system restore to get the Java back.

[innosin]

I managed to fix it, although I'm not sure what did the trick, exactly. I closed my anti-virus program while installing Java, and I also cleaned up the stray files I had in my root directory by throwing them into another folder. Java installed without a hitch and my window-closing problem appears to be solved as well.

Thanks!

[evilfantasy]

Updates do wonders.... It's a good habit to get into

[innosin]

I spoke too soon. I'm still getting the windows closing when I have Yahoo or Trillian open.

I also got a blue-screen last night stating a "pfn_list_corrupt"

[innosin]

I also got an "IRQL_NOT_LESS_OR_EQUAL" error. I read that this could be due to bad RAM or a failing hard drive. I ran MemTest and it showed no errors, and I plan on running some hard drive checks tonight.

However, I read that this error and the PFN_LIST_CORRUPT one have to do with Pagefiles. I have Windows installed on my F: drive, but use my C: for the pagefile. Does this mean that it's my C: that is most likely to be the culprit if it's a hard drive error?

[Carbon Dudeoxide]

Try switching the Page File to the other drive or increasing it.

How much space have you allowed for it?