Sudden Reboot followed by unability to run any programs

[rhub]

Hello SF!

I just ran into a problem that seem to be very simular to the one described in this thread: http://www.sevenforums.com/general-discussion/143881-no-programs-open-start.html

Difference is I havnt had any virusproblems, havnt tamperd with any drivers recently and havnt installed any new software or hardware for several months. I was just doing nothing in particular when my Dell Laptop suddenly rebooted. When it then started up, I noticed a very long delay just before the windows 7 startup logo appears with just the "windows starting" text being presented (In safe mode the same delay appears just after loading hal.dll). The reboot in total took about 60 seconds more than the 15-20 seconds it usually need. I directly noticed that none of my autostarting applications (nothing fancy, dropbox, mIRC and winamp-agent) had started. *aha, virus!* I thought and directly went for avast! to do a scan, avast didnt start. I tried Lavasofts ad-aware with the same reponse, and same with Total Commander. I checked taskmgr and saw no new processes and then promtly turned of internet and went to safe mode to scan.

In safemode I have the same problem, no applications run, when I run one it eventually pops up in taskmgr for a few seconds before dissapering. The only applications that run are microsoft ones like calculator, regedit, paint (yay!), notepad, Internet Explorer and other stuff integrated in windows 7, Mediaplayer will for example not run. Another difference is that if ending the explorer.exe process, explorer dont automaticly self-restart and when trying to start it manually from run, it still won't.
I have tried windows clean boot without success, system restore wount work giving me the msg that whatever restore point I choose, it tries for about 10 minutes and then reboots and says the restore point was deleted during the restoring (!).

As I said, no strange new processes around. Hard Drive checks in fine. System is fairly new (about a year). last windows update was 3 days ago installiling some critical update. The cpu aint overheated. I also tried to see if the same problem apears when I create a new user wich is the case.

So please SF, any clues?

TY very much

 

[rhub]

I just wanted to clairify, the sudden reboot wasnt a BSOD. Screen just went black for 2-3 secs and computer then rebooted to bios. I did though get a sudden BSOD in safe mode calling for an IRQ issue when troubleshooting but it can also come from me removing some usb devices during reboot as a memory stick.

 

[johnnya]

Hi Rhub and welcome to the Forum. It looks as though you have done a number of proper things to find you problem. Good work. Have you scanned for malware?
A product many of here at the Forum use is called Malwarebyes and is a free download. See link below. Download and install, use the Update tab to make sure use have the latest database and then do a Full Scan. If it finds anything just follow the prompts. Get back and let us know.

Download Malwarebytes Anti-Malware 1.50.1 - FileHippo.com

Cheers
JohnnyA

 

[rhub]

Hello Johnny and thanks for your very fast reply. I have several antivirus and malware scanners (lavasoft ad-aware notably) but as I stated in my first post. No applications not integrated in windows 7 will run, not even in safemode. I will try malwarebytes though, but I think it will give the same result. Ill get back to you right away with an answer

 

[rhub]

yep negative reply, it didnt run, not even in safe mode.

 

[johnnya]

Wow that is strange. While I am by no means an expert, the fact the you cannot run any of your Virus/Malware programs, and System Restore failes oddly, still makes me think of Malware. I have seen this behavour before. Have you tried any of the on-line Virus Scanners available? There are several such as TrendMicro Housecall, Bitdefender, Kaspersky etc. Also, boot to safe mode, find the Malwarebytes .exe file and rename the extension to .com and then try to run that renamed program by double clicking on it.
Get back to us. We have many much more experienced members at the Forum and I am sure they will jump in with wise advice.
JohnnyA

 

[rhub]

TY again for your reponse. I'll try the .com method right away (didnt know about that one!) Ill get back asap

 

[rhub]

Trendmicro housecall gave me the following reponse: An error has prevented trend micro from running on your computer: (E:1082066538:0)

 

[rhub]

renaming the malwarebytes to .com (with the DOS commandprompt rename command) worked, running it still gave the same result (not launching). I did though get a bluescreen when booting to safe mode and this is the bluescreen:

BCCode: 1e
BCP1: FFFFFFFFC0000005
BCP2: FFFFF80001E628EF
BCP3: 0000000000000000
BCP4: 000007FFFFFA0000
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

 

[johnnya]

Wow, with my limited knowledge, I am running out of ideas. Again a program "Trendmicro" is not being allowed to scan your hd???? Malware???
By the way, did you create a set of Recovery DVD's that as a last resort you can restore your system back to Factory, or directly from the Restore Partition?

Any chance your Hard Drive could be virus/malware scanned on another system?

JohnnyA

 

[rhub]

I could re-install my system but I would very much like to avoid this option. I could scan my harddrive on another system but there is a big evil "breaking waranty" sticker over the screw that lets me access the harddrive. Dell ¤%&/()="¤#("/¤

I al also thinking malware but I never seen such an efficiant malware that works in safemode without any process running.

 

[johnnya]

I agree the restoring to Factory is the last step I would want to take also. Long process reloading all your other programs, restoring your data, re-tweeking things the way you want them. But? Is the system still under warranty? If not, I would still consider an external scan of the HD. By the way, it is not unusual for Malware to act like we are seeing - even in safe mode. Some very soffisticated bad stuff recognizes antivirus/malware programs and prevents them from running. The reason I had you try renaming Malwarebtyes.exe to Malwarebytes.com is because these bad programs are generally looking for an .exe type file. Before you do anything, I beleive it would be a good time to backup all your data to an external device.
JohnnyA
Sorry about some bad spelling, first day with my new fingers. lol

 

[rhub]

Yeah I agree with you, for several reasons my system is extra messy to re-install, long story. I did backup my harddrive though and the system is still under warranty for another 11 months.

About the malware, ive done some further testing, its really _all_ applications thats not integrated in windows 7. Everything from photoshop to music-programs to firefox. im writing this through windows explorer. not even wordpad is working, only notepad.

dont worry about the spelling, I guess my english is pretty messy too, many languages occupying my brain =(

 

[johnnya]

Hi rhub. I am very sorry that I was unable to help solve your problem. If some of our more technically qualified members/moderators/admins could jump in I am sure the Op would appreciate it. I will follow with interest what follows.
Best regards
JohnnyA

 

[rhub]

TY for your effort johnny. If it could be of any use, my systemtime seems to be off the hook to. resets to 11pm every reboot.

 

[Golden]

Hi Rhub,

Sounds like you have some serious issues. We need to try and scan your system prior to Windows loading. In order to do this, you need to be able to boot from a rescue CD that has a malware scanner.

Before you do this, however, can you try something for me? Click Start Orb, in the search box type cmd and then right-click on it and choose Run as administrator. In the cmd window, type sfc /scannow and hit enter. SFC tries to check and repair the integrity of core system files. I'm not sure if it will work, but it doesn't do any harm. If it does work, it will take some time, so let it finish. Also, follow the steps below.

Please follow these steps:

1. Go to this link and follow the instructions for burning the Kaspersky bootable anti-virus disk.
2. Once you have done that, edit your BIOS so your PC boots from your CD/DVD drive.
3. Boot from this CD, and follow the instructions to perform a scan.

http://www.techmixer.com/kaspersky-rescue-disk-load-kaspersky-antivirus-2009-using-dos/

Post back here with any findings.

Regards,
Golden

 

[rhub]

Hello Golden. TY very much. I'm on it, will let you know asap

 

[rhub]

golden: the sfc /scannow said it found some damaged files and some of them couldnt be repared. here is the paste of the results: 10: Move File: Source = [l:320{160}]"\SystemRoot\WinSxS\Temp\PendingRenames\ - Pastebin.com

downloading and burning the kaspersky to a cd atm. will let you know the results. ty very much for you help!

 

[Golden]

Hi Rhub,

Before you boot from the Kaspersky CD, can you run sfc /scannow a few more times (say another 3/4)? Sometimes sfc will repair files previously reported as un-repairable if you run it multiple times.

Also, before running Kaspersky CD, can you please try and run the Kaspersky root kit utility, get it here:

How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?

Select the cure option if the scan finds any rootkits - the scan will be very quick. Post back here if the root kit utility finds anything - if it doesn't, proceed to boot and scan from the CD.

Regards,
Golden

 

[rhub]

Hello again golden. Running the sfc scannow for the third time atm. the TDSkiller didnt run in normalmode, nor in safemode. Same result as any other non windows7 integrated application, it just pops up in taskman for a sec and then dissapears.