screen goes black and system froze

[beginerone]

Hi
My XP, SP 3, windows crashes. Screen goes black for some seconds and then it froze and I have to restart it. The required restarts increased over time.
I just noticed that system's events don't log after December 21st.
I didn't have a hardware upgrade recently and all drivers work fine.
BTW, I've scanned the system with an updated ESS and it didn't find anything.
Google didn't help me, may you do!?
Thanks

-----
List of installed softwares:

Adobe Reader 9
ESET Smart Security
K-Lite Mega Codec Pack 4.1.0
Microsoft Office Enterprise 2007
Mozilla Firefox 12.0
Nitro PDF
Orbit Downloader
Realtek AC'97 Audio
The KMPlayer
Virtual CD v5
WebM Project Directshow Filters
WinRAR archiver

 

[blues_harp28]

Hi, is this a desktop or a laptop?
Check and post
TSG System Information Utility - found here.
http://library.techguy.org/wiki/TSG_Valuable_links
-----
Download Security Check by screen317
http://screen317.spywareinfoforum.org/
Save it to your Desktop.

Double click the install icon.
A command Prompt window will open.
Let it scan the Pc - press any key when asked.
It should now open in Notepad - and will save a log called checkup.txt.
Post the result of the scan here.
------
Post a Hjt log - to see what is running on your system.
Hijack this 2.04

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
• DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

 

[beginerone]

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Intel(R) Pentium(R) 4 CPU 2.66GHz, x86 Family 15 Model 2 Stepping 9
Processor Count: 1
RAM: 511 Mb
Graphics Card: NVIDIA GeForce4 MX 440 with AGP8X (Microsoft Corporation), 64 Mb
Hard Drives: C: Total - 6675 MB, Free - 414 MB; D: Total - 9538 MB, Free - 5608 MB; E: Total - 20504 MB, Free - 959 MB; F: Total - 20504 MB, Free - 4124 MB; G: Total - 20936 MB, Free - 406 MB;
Motherboard: MICRO-STAR INC., MS-6580
Antivirus: ESET Smart Security 5.2, Updated: Yes, On-Demand Scanner: Enabled
--
The "screen317" output was "ESET Smart Security 5.2" as I told And "HiJackThis" didn't install.

 

[blues_harp28]

The Security Check by screen317 - will show other installed programs, security programs and possible needed updates.
It would help us if you posted it.

HiJackThis log.
What happens when your click on the install icon?
Hijack this 2.04

Is this a desktop or a laptop?

Click Start - Run - Type
msconfig
Click on the Start Up Tab.

Write down carefully what is listed and post the list here.
Or post a screenshot
http://library.techguy.org/wiki/TSG_Posting_a_Screenshot

 

[beginerone]

Thanks dear blues_harp for your attention.
It's a desktop.
I could install it after a restart.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:05:33, on 2012/12/25
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\csrss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\ESET\ESET Smart Security\ekrn.exe
D:\Program Files\HHVcdV5Sys\VC5SecS.exe
D:\WINDOWS\System32\alg.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\ESET\ESET Smart Security\egui.exe
D:\WINDOWS\system32\ctfmon.exe
E:\ne\calendar.exe
C:\Program Files\The KMPlayer\KMPlayer.exe
D:\WINDOWS\system32\msiexec.exe
D:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
D:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.orbitdownloader.com
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [egui] "D:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [MSPY2002] D:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: calendar.exe.lnk = E:\ne\calendar.exe
O8 - Extra context menu item: &Download by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://D:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: ESET Service (ekrn) - ESET - D:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - D:\Program Files\HHVcdV5Sys\VC5SecS.exe

--
End of file - 3988 bytes


+++

Security Check output:
Results of screen317's Security Check version 0.99.56
Windows XP Service Pack 3 x86
Internet Explorer 6 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Disabled!
ESET Smart Security 5.2
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
ESET NOD32 Antivirus egui.exe
ESET NOD32 Antivirus ekrn.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive D:: 8%
````````````````````End of Log``````````````````````

 

[blues_harp28]

Xp has been installed in D:\WINDOWS and not C:\ WINDOWS which is the better location.

Internet Explorer 6 Out of date!
Antivirus out of date!

Update your ESET anti-virus program and scan your Pc.

Install IE 7
http://www.microsoft.com/en-us/download/details.aspx?id=2
------

Download MalwareBytes and SuperAntiSpyware to your desktop.
Download the Free versions of both programs.

MalwareBytes

SuperAntiSpyware

Once they are downloaded to your desktop.
Close all open browser windows.

MalwareBytes
Click on the Install icon - allow it to update during the install process.
Start Malwarebytes Anti-Malware.
Click on Scanner > then quick scan > then Scan.
Any infections or problems will be highlighted in red.
After the scan is finished - Click - Show Results.
Check that all entries are selected.
Click - Remove Selected.
You may be prompted to restart to finish the removal process.
If Yes - restart your Pc.

Start Malwarebytes again.
Click on the Logs Tab.
Highlight the scan log entry.
Click - Open.
The scan log will appear in Notepad.
Copy and paste it in your next post.

SuperAntiSpyware
Click on the install icon - allow it to update during the install process.
Select the Quick Scan option.
Click Scan your Computer.
Any infections or problems will be highlighted in red.
After the scan is finished.
Click Continue.
Check that everything is listed.
Click Remove Threats.
Click OK - then click Finish
You may be prompted to restart to finish the removal process.
If Yes - restart your Pc.

Start SuperAntiSpyware again.
Click View Scan Logs.
Highlight the scan log entry.
Click - View Selected Log.
The scan log will appear in Notepad.
Copy and paste in your next post.
------
Also Please post the uninstall log from Hjt log
Start HiJackThis.
At the bottom right - Other Stuff
Click on Config > Misc Tools.
Click > Open Uninstall Manager.
Click > Save List.
Save the uninstall list file on your desktop.
It will then open in Notepad.
Click Edit > Select All > Edit > Copy-and-Paste the uninstall list in the reply box.

 

[beginerone]

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/27/2012 at 12:17 PM

Application Version : 5.6.1014

Core Rules Database Version : 9792
Trace Rules Database Version: 7604

Scan type : Quick Scan
Total Scan Time : 00:06:34

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 368
Memory threats detected : 1
Registry items scanned : 31091
Registry threats detected : 0
File items scanned : 6679
File threats detected : 3

Trojan.Agent/Gen-Autorun[Swisyn]
E:\NE\CALENDARLIB.DLL
E:\NE\CALENDARLIB.DLL

Adware.Tracking Cookie
D:\DOCUMENTS AND SETTINGS\USER\Cookies\[email protected][1].txt [ Cookie:[email protected]/ ]
D:\DOCUMENTS AND SETTINGS\USER\Cookies\[email protected][2].txt [ Cookie:[email protected]/ ]

----
Malwarebytes Anti-Malware (Trial) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.09.29.05

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
User :: XXXXXXXXX [administrator]

Protection: Disabled

2012/12/27 12:17:45 P.M
mbam-log-2012-12-27 (12-17-45).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197151
Time elapsed: 3 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
----

"E:\NE\CALENDARLIB.DLL" is my calendar and it's a long time that I'm using it.
I scanned the PC with an updated ESET, it didn't find anything!
I don't use IE.
HiJackThis won't install once more! The error is "The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2755.".

 

[blues_harp28]

You need to install IE 7 - IE is an integral part of Windows and needs to be updated.
Run System File Checker.
Start - Run - Type.
sfc /scannow
[Note space after sfc]
You will be asked for the install Cd.
http://www.updatexp.com/scannow-sfc.html
------
Hjt log should still be on your system.
Also post the uninstall log from Hjt log
Start HiJackThis.
At the bottom right - Other Stuff
Click on Config > Misc Tools.
Click > Open Uninstall Manager.
Click > Save List.
Save the uninstall list file on your desktop.
It will then open in Notepad.
Click Edit > Select All > Edit > Copy-and-Paste the uninstall list in the reply box.
------
RAM: 511 Mb - used to be enough to run Xp - no longer true.
More Ram would help your Pc run better.
An online scan will tell you what type is installed and how much can be added.
http://www.crucial.com/uk/systemscanner/index.aspx

 

[blues_harp28]

'screen goes black and system froze'
Could relate to faulty Ram.
Run a Mem Test.
http://www.memtest86.com/download.html

Download the ISO file from one of the links above to your desktop.
Then burn the ISO to a Cd.
Start the Pc using the Cd and run the memory test overnight or for at least 8 passes.

It is best to run a full scan on individual Ram sticks if you can.
Or run the test but if any errors are shown - then remove all sticks of Ram and test each Ram stick one at a time.
-----
You can also run the Mem test from a USB stick
http://www.memtest.org/#downiso
Scroll down to Download (Pre-built & ISOs)
Download -Auto-installer for USB Key (Win 9x/2k/xp/7) *NEW!*

Download to your desktop - unzip it there.
Put the USB stick into your Pc USB slot.
Click on the Install icon on your desktop - it will then have a box appear asking you to name the USB drive letter.
Put the drive letter in the box and click on install.

But first check that you are using the correct drive letter - with the USB stick in the USB slot of your PC - right click My Computer > click on Open.
Your USB stick will be listed with the drive letter.

How to Test your RAM
http://www.bleepingcomputer.com/forums/topic207910.html

 

[dai]

what is it like in safe mode

what power supply is in it and how old is it

make
model
wattage

 

[beginerone]

I tried sfc and it didn't help.
@dai
It works fine in safe mode and the PSU is "Delta Electronics 300W Watt Netzteil * DPS-300MB C" and system is almost 8 years old.

 

[dai]

see if you can borrow a larger wattage psu to try in it

 

[beginerone]

I can't borrow it, but it's a very old PC and I didn't have this problem before, so it shouldn't be from PSU, should it?
@kingjameo
What do I have to tell!?

 

[dai]

they don't last forever a friend may have one lying around

 

[beginerone]

Thanks blues_harp28, dai.