Automatic restart to login screen/bsod

Well., this thing has been happening on my desktop for a couple of months and i've been trying to fix it on my own but in vain... now the problem is getting worser.. hence decided to post on the ever helpful forum ... so let me explain the issue...

My broadband connection offers free download from 2AM to 8AM and hence i leave my computer and modem ON when asleep while having torrent downloads (with utorrent) scheduled to start at 2AM using the scheduler option in windows. This has been happening fine for past several years until now!

Few weeks ago, i was surprised by what i saw when putting the monitor ON the next day morning at about 6AM that i usually do to check on the download status. But what i saw was the logon prompt screen on windows!!
This thing repeated itself 'every day' that i would use the scheduled downloading..

The 1st thing i suspected was that someone was trying to hack my pc externally since i had port forwarding and something called as NAT-dmz host enabled in my router as per friend's suggestion -> refer screenshots (either of these were enabled when this kind of strange behaviour happened since my torrents wont download without them)

Run spybot but nothing big found except for couple of tracking cookies, scanned entire pc with norton and nothing found. Left the very idea of downloading torrents! 2 days back,

resumed it This time i had the dmz host disabled since i read somewhere it would keep all the ports or something on my computer open to the world.. port forwarding was still there..

however, only few of the torrent file would download and others wont work once this dmz thing is disabled. dont know why but that problem is secondary i guess..

Also, i thought i had fixed the restart option by following wat is told in this page: (Not reading what the 1st few lines said!)

Automatic Restart XP - How to Disable the Automatic Restart on System Failure in Windows XP

With the above setting on, the next day i switched on my PC expecting the same login screen at the least but he comes the 'blue screen of death!" I was totally perplexed and thought my PC and all files are gone forever. The message was as follows:

"problem has been detected and windows has been shut down to prevent to damage to your computer. kernel data inpage error. "

after this a couple of hexa-numeric codes such as 0b0b0000i etc etc were there and at the end was the file name: "ftdisk.sys"

When i searched for this error online, some websites stated the 'data inpage' had something to do with the RAM module which may have gone faulty but i dont think that is the case as both these problem of the blue screen and the automatic rebooting to the login screen occured only when i left the PC unattended at night with the downloads going on... nothing of this sort would happen when i worked on the PC all day long...

any help would be greatly appreciated! since i would love to see my torrents back to normal again!

PS: Just a few things that i thought i could add in,although i have no idea if they are relevant.

1. My pc's BIOS battery is dead meaning my system never keeps the correct time on the taskbar and i manually keep changing it everytime i boot it up.

2. A few days before this bsod showed up, my windows profile got corrupted with this error:

"Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile. If this problem persists, contact your network administrator."

Thanks for the assistance

 

Let me give you the hard truth here. If you keep using torrents you are going to eventually get burned. I fully understand why you may want to keep this practice up but while it may have entertainment value it is killing your computer.

We do not make moral judgments here and if the torrenting programs have nothing to do with your problem we are prepared to ignore it. However in your case it is clearly the prime suspect. You are going to have to remove the program and agree to keep it off at least while we are trying to help you or it will just be a waste of time. If that is acceptable to you I suggest you do the removal and post a HJT log "HiJack This" log in your next post.

If you do not know how to do this just let us know after the uninstall is complete and we will guide you through it.

 

Hi...i appreciate your reply...

Is it absolutely necessary to have the program uninstalled or is it alright if it is disabled or not being run when the hijack program is being run?

 

Here is the log file without uninstalling the utorrent program but it is not being run..

 

And here is the log after the un-install..

 

Hi karthik316_1999.
Techies should be back shortly to assist you.

I would suggest in the meantime to post your Logs, directly in your reply Post.
No one, I would guess would download a file from your Computer,when it's most likely infected.

 

Hello cindy, good to see you people again

Here is the log (post the uninstallation of the torrent program)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:43:42 PM, on 9/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alarm Clock\Alarm Tray.exe
C:\Program Files\Common Files\VideoMate\ComproRemote.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\VideoMate\ComproScheduler.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\Installer\MSI16.tmp
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alarm Clock\AlarmMonitor.exe
C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SBCONVERT - {31B27F2D-6BC6-451B-B3D2-4EAB36B2FC3B} - C:\Program Files\SpeedBit Video Downloader\Toolbar\tbcore3.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\SPEEDB~1\Toolbar\grabber.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: SpeedBit Video Downloader - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\Toolbar\tbcore3.dll
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Show missed alarms] C:\Program Files\Alarm Clock\Alarm.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Global Startup: ComproRemote.lnk = C:\Program Files\Common Files\VideoMate\ComproRemote.exe
O4 - Global Startup: ComproScheduler.lnk = C:\Program Files\Common Files\VideoMate\ComproScheduler.exe
O4 - Global Startup: TweakYC.lnk = ?
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1247418270125
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll
O23 - Service: Talking Alarm Clock user logon monitor (AlarmClockMonitor) - Cinnamon Software Inc. - C:\Program Files\Alarm Clock\AlarmMonitor.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SolidConverterPDFReadSpool (SCPDFReadSpool) - Solid Documents, LLC - C:\WINDOWS\Installer\MSI16.tmp
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 8219 bytes

 

Also replace your BIOS battery.

You clearly need the infections cleaned up.

 

Hi, sounds like there is pretty much of a security issue over here.. Out of the entire post, im concerned much on these lines more cuz the remaining of the problem is secondary for me. My skills in networking are pathetic and am not able to understand the explanation

Can we please elaborate on this part and also suggest as to what would make this problem alright and get me running the torrents up please.....:cryz:

So, you mean to say all these errors are due to the profile corruption only? I feel thats conflicting cuz i had these errors even before the profile corruption...... (not the bsod but the logon prompt indicating a system restart due to a serious system error -->as good as the bsod that did not appear because i had the "restart system during serious error" option enabled at that time)

Moreover, why does the error occur only during the torrent download time or maybe we could say (although not tested yet) when i leave the PC unattended at night?

Thanks for the clarification!

 

It is against forum rules to help with Torrents.

However the forum can help with the infections you have.

 

Hi.,could you tell me what are the harms involved in running a PC with a failed CMOS battery, however adjusting the right time during every boot?

Would you please be able to pinpoint to me what are the infections actually found?

 

So, are we 100% sure that this issue is due to the utorrent application?

 

Dead BIOS battery your computer will loose its BIOS settings and possibly stop booting up.

Bios corruption.

uTorrents has infected your computer proberly by the illegal files downloaded using it.

Your issues stem from BIOS battery and infections.

 

We are 100% sure that we cannot help you with utorrents and that it is not so much as that it caused a specific infection but the way you are using it and how it is set is going to continue to give you problems. These problems remain even with utorrents uninstalled. The way your ports are set is going to be a major problem regardless of what you do.

It is not suggested that you are doing anything illegal but often what you feel you are getting has been illegally obtained and you wind up paying the price.

 

fine.. so could someone suggest me what is the resolution please?

 

Sure, back in her previous post, Allheart gave a list of instruction to help with your corrupt profile problem.
The link to the post is here:
http://computerhelpforums.net/windows-xp/46502-automatic-restart-to-login-screen-bsod.html#post213926

 

The corrupt profile is not my chief problem.............
the bsod is.........

 

I understand that. Maybe you missed it because there was so much writing and it was only slightly referenced to. I've put the linking statements in quotes for you:

Hope this clears it up that we are actually working towards fixing your BSOD and profile corruption in one