Comp shut down the other day....

[Junior_co]

[Gecko]

Hi Junior, that does sound strange I have no idea why this would happen.

Windows event viewer can be found here:
Start > Control panel > Administrative tools > Event viewer

You might want to post a HijackThis log from the #2 system just in case

[Junior_co]

Tnks Gecko...

I'll post a HJT log from both computers in the HJT section later on tonight...

I don't know why I didn't think of doing that. Especially since the #1 comp had that registry thing found by Ad-Aware...

Good on ya

Junior

[Junior_co]

Well, It happened again... This time it was thursday morning and Me better half happened to be sitting there when it started back up and was able to catch this.....



Maybe thil will shed some light on the problem...

Ill post a HJT log after I run all the other tests first

Good on ya

Junior

[Junior_co]

Here is a copy of the HJT log....

Please let me know if there is anything else you might need to know....

Thanks again

Junior

Logfile of HijackThis v1.99.1
Scan saved at 4:24:04 PM, on 1/28/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe
C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\HiJackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Pristine RTR Client - http://chat.pristine.com/rtr/PristineRTR.CAB
O16 - DPF: Sametime JNI Loader ST30SP1 - http://chat.pristine.com/RTR/Packages/S ... Loader.cab
O16 - DPF: Sametime Meeting Toolkit ST30SP1 - http://chat.pristine.com/RTR/Packages/S ... eeting.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?linkid= ... lcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9651298347
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O16 - DPF: {B8037A22-5FE1-4CC3-B862-E644A521EE54} - http://www2.pristine.com/esp/install/1. ... nstall.cab
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

[Gecko]

Your log looks clean

Go to Start > Control panel > Administrative tools > Event viewer > look in the system section.
You are looking for any red or yellow icons, double click on the icon.
Click inside the ‘Description’ section then highlight the text and copy and paste it into notepad.
At the bottom of the event window check ‘words’ and then copy and paste that text also
Then past it all of it into this thread.

If you don’t show any errors in the event viewer then:
Go to Start > Control Panel > System > Advanced tab > Startup and Recovery section
Settings button > System Failure section > check the box 'Write an event to the system log'

[Junior_co]

Since there seem to be a lot of warnings and errors, I've listed only the ones from thursday the 26th.. We're pretty sure that this was the last time this comp shut it's self down....

These are listed by time. From pm to am....

#1
Printer Driver Lexmark Z53 Color Jetprinter for Windows NT x86 Version-3 was added or updated. Files:- UNIDRV.DLL, UNIDRVUI.DLL, LXAUSDRV.GPD, UNIDRV.HLP, UNIRES.DLL, STDNAMES.GPD, LXAUSPSZ.GPD, LXAUSDRV.INI, LXAUSRDR.DLL, LXAUICUR.DLL, LXAUFCIC.DLL, LXAUCLR.DLL, LXAUSUI.DLL, LXAUSRES.DLL, LXAUALG6.OUT, LXAUALG4.OUT, LXAUCLN6.OUT, LXAUCLN4.OUT, LXAULIC.TXT.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#2
Error code 00000019, parameter1 00000020, parameter2 817148a8, parameter3 81714ac8, parameter4 0a440020.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 74737953 45206d65 726f7272 72452020
0010: 20726f72 65646f63 30303020 31303030
0020: 50202039 6d617261 72657465 30302073
0030: 30303030 202c3032 31373138 38613834
0040: 3138202c 61343137 202c3863 34346130
0050: 30323030

#3
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0xcfc), which lies in the 0xcf8 - 0xcff protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000000 00520004 00000000 c0050004
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

#4
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0xcf8), which lies in the 0xcf8 - 0xcff protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000000 00520004 00000000 c0050005
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

#5
The IP address lease 192.168.1.101 for the Network Card with network address 0012175043ED has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

#6
AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0xcfc), which lies in the 0xcf8 - 0xcff protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000000 00520004 00000000 c0050004
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

#7
AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0xcf8), which lies in the 0xcf8 - 0xcff protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000000 00520004 00000000 c0050005
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

#8
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#9
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079


#10
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#11
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#12
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#13
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#14
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#15
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#16
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#17
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#18
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079

#19
Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 0012175043ED. The following error occurred:
The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0000: 00000079


Thanks again for the help, and let me know if there is anything else you need


Junior

[Gecko]

How are the two systems networked, is it through a router or is it ICS (internet connection sharing)?
If it ICS is this the server system or the client?

The Error code 00000019 = BAD_POOL_HEADER (this is the system crash caused by the below)

The AMLI: ACPI BIOS error 0xcfc = PCI Configuration Space Access (that is not allowed by windows and can corrupt pool headers.)

The IP address lease 192.168.1.101 error = I think that ip address is already in use.

Your computer was not able to renew its address = loss of at least one way of communication

If I were to make a guess I would say your network card is the cause of these errors.

I think that the network card looses it’s ip some how and tries to renew it but fails
when it obtains an ip the card looses the communication and tries to reconnect
but that ip is already assigned and cannot be used again
then it looks like the bios re sees the card and tries to reassign it
but windows will not allow that and that eventually crashes the OS

[Junior_co]

[Gecko]

[Junior_co]

I think this will be a Reformat and reinstall of XP....

Not worht taking a chance of the problem lingering in the back round.....

It will also be an upgrade to that comp that I've been procrastinating on.....

Good on ya and thanks for all the help (as usual...)

Junior