Laptop freezes and shuts down without warning

Allan-OK · December 2005

I would be grateful for any help that is available in sorting out a problem with my daughter's laptop. It is a Toshiba 2.4 ghz pentium mobile running XP with SP2.

It was working normally until yesterday but it is now proving difficult to start. Sometimes it will turn off halfway through the boot process and when it does start it is taking about 10 minutes to boot and everything will suddenly freeze and programmes will not load.

I have tried booting in safe mode and there is no difference. I have also tried a system restore and it powered down all by itself half way through the restore process.

Any suggestions as to how to overcome the problem would very welcome.

alexdcd · December 2005

Hey,
I have had the same problem many times before and it is usally hardware

Try to boot woth no floppies or cds in drives, no thumb drives, and see if it will boot fast enough. If problem persists then it is definately to do with your ram. Remove it, try reseating in alternate port, or remove and reseat. After this remove the main battery and remove power connector. Hold on the power button for 60 seconds, go into bios and reset to default functions.
I am willing to provide additional suggestions and help you track down your problem.

Allan-OK · December 2005

Thanks very much for the post. I will try your suggestions and advise furter asap.

alexdcd · December 2005

I you can list some model numbers and changes made to the system i could shake my brain into action, good luck.

Allan-OK · December 2005

Thanks. I followed your earlier suggestions apart from removing the memory as when I opened the back I couln't work out how it came out - very different to a desktop.

The machine still kept turning off without warning but seemed more stable and kept going when I started in safe mode. When starting normally the processor seems to be very busy all the time. Checking task manager indicated over 40 processes and something called System Idle Process had 99 under CPU. It wouldn't however let me close this down. Is there a way to only let programmes I actually need to load?

The laptop is a Toshiba Satellite A30, 2.4 Ghz Pentium mobile with 256mb of memory. Recent changes have been an upgrade to MSN 7.5 (I think I will try deleting that) and I unchecked some boxes in the start up section of Mconfig to try to speed up the star up. Are there any essentials in there which should definitely be ticked?

Thanks for the help.

alexdcd · December 2005

The memory is very easy to remove and reinsert there dhould be two metal clips that look quite sharp either side. They sort of rub along the pcb board and should be moved one at a time. The first clip should stay to the side and the second clip will release the ram at a 30 degree angle from the board. Always hold on the sides and never have power connected. I have a Toshiba sattelite Pro A10 which is fairly similar and i have upgrades it recently, so the only thing different will be the component layout. - dont be afraid of damaging the ram when you place it back in, you will need to force it in at an angle with a little (and i mean little force) and then push it down to a flat position. Another way to get the right settings for the Os is to try pressing F8 when booting (during bios) and choose ' Last known good configuration '.
As regards to software, the processes you mention are vital to windows but if you want to know what msconfig processes to remove try this link: http://www.tweakxp.com/performance_tweaks.aspx
If you are trying to get a quick start up, you may need additional ram, i use 512mb and got a stick of 256 for £8 on ebay, and it helped a lot. If you want to make sure it is not software, or want to get rid of annoying programs accumulated (i have to clean up my 14 Y.Old syster's sytem every 2 months) then try the windows 'System Restore' in acessories on the start menu and return it to a date a few weeks ago.

Qeldroma · December 2005

Here are some thoughts I had too-

Can you uncover the CPU and clean the Heatsink/fan? Is there anything that might restrict airflow? Toshibas can overheat if not maintenanced properly. It might be that. Mine had an issue when it simply was lying on a magazine that blocked the inlets on the bottom.

You may also have an issue with your battery or power brick/wires. Check out your wire runs for pinches or breaks. Are the indicator lamps on the laptop displaying/not displaying or abnormally dim? Does the power lamp flicker? If so, is there a possibility of swapping them out and trying another?

Hope something turns up

Allan-OK · December 2005

Thanks to you both, Alexdcd and Qeldroma. I will follow all the suggestions one at a time and see how things go.

The earlier steps have got the machine to stay on but it is still very slow. Hopefully the other suggestions will help, cleaning the fan may help as the bottom is getting very hot.

Thanks again.

profdlp · December 2005

If you'd like to really get an idea of all the stuff running on your computer, it would be a good idea to download HijackThis from our Security Download page. All of the suggestions for checking hardware are well worth pursuing; getting a clean bill of health for the software side will round out the picture.

Allan-OK · December 2005

Thanks - I have done as you suggest and the log is shown below. Any guidance as to any problems you can see there will be appreciated.

Scan saved at 22:50:31, on 18/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Gina.GEORGINA\Desktop\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://wwwcache.lancs.ac.uk
O2 - BHO: SafeGuard Protect PCShield - {564FFB73-9EEF-4969-92FA-5FC4A92E2C2A} - C:\WINDOWS\System32\sfg_4b88.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
O9 - Extra 'Tools' menuitem: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.co.uk/save/makeover.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125315365671
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

profdlp · December 2005

Allan OK, I can spot several spyware programs running in the background on your daughters machine. I've moved this thread over to our SVT Forum so the experts can help you get it cleaned out.

The other hardware-related suggestions are well worth checking out, but I think ridding the computer of the spyware is going to make the biggest difference.

Please be patient with our SVT Team, they are all volunteers here and as you can probably imagine are seriously overworked. I'll keep an eye on this thread to makes sure you get straightened out.

profdlp · December 2005

Run HijackThis again and put a check next to the following, then post a new log.

C:\WINDOWS\System32\sfg_4b88.dll

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll

O9 - Extra button: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)

O9 - Extra 'Tools' menuitem: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - (no file)

O16 - DPF: {17D72920-7A15-11D4-921E-0080C8DA7A5E} (AimSp32 Class) - http://makeover.ivillage.co.uk/save/makeover.cab

Allan-OK · December 2005

Thanks for the reponse. The laptop is working much better since I followed the hardware suggestions and is no longer crashing. I didn't think it was a spyware problem as I ran Microsoft Antispyware and Spybot and they found no problems but I am grateful for your help and any suggestions to get rid of the problems are very welcome.

I have deleted the items you mentioned and here is the new log:-

Logfile of HijackThis v1.99.1
Scan saved at 07:27:58, on 19/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe
C:\Documents and Settings\Gina.GEORGINA\Desktop\hijackthis_199\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://wwwcache.lancs.ac.uk
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125315365671
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

Thanks for your continuing help and the other experts who give up their time to help us novice users.

Leonardo · December 2005

Thanks for your continuing help and the other experts who give up their time to help us novice users.

You might be surprised at the people who get spyware - not just novice users. (Concerning hardware problems - it's not unusual to see people with amazing software skills who don't know the first thing about hardware.) Don't beat yourself up over the spyware. It happens. Many of us here at Short-Media use a malware prevention cocktail. If you'd like to remain free from the bad stuff, I recommend running four programs: 1) anti-spyware of your choice (AVG is an excellent freeware program), 2) Spybot, 3) Ad-Aware, and 4) SpywareBlaster. The latter is not a scanner, but a very good immunizer. Whatever software you run, ensure that is kept up to date.

Allan-OK · December 2005

Thanks and will do.

Qeldroma · December 2005

Allan OK, if you would allow, I had a thought as I followed this thread. I'm not sure what age your daughter is, but if she's anything like my teens, she's going to venture into places that just look OK on the surface but are simply infested lures and trap-sites. My first line of defense has been to educate my kids on what this stuff is, how it propogates and what to avoid. My second line has been to make sure they got into the habit of regularly running things like Ad-Aware and Spybot (among other things)- but I will say that these free-ware services have limited prevention value and are more to tell you that the horse has already left the barn.

It was a rough go for a while, but I'm now spending less time fixing their woes and a little more time making headaches at places like SM.

BTW, nice catch prof-

.

Trogan · December 2005

The HJT log is clean

Run these online virus scans. I'm sure they will pick some things up:
Save a log/report for both and post them back here

BitDefender Free Online Virus Scan
http://www.bitdefender.com/scan/licence.php
Make sure you tick AutoClean under Scan Options.

Panda ActiveScan
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Make sure you tick Disinfect automatically under Scan Options.

Allan-OK · December 2005

Qeldroma - You are probably right. My daughter has been away at university and despite telling her to run the antivrus and antispyware programmes, I am sure she won't have. I will be having another word. Teenagers!!!!!

Trojan_1000 - Thanks for nyour advice will reply when I have run those programmes.

profdlp · December 2005

You might ask your daughter if her university recommends any particular anti-virus and/or anti-spyware programs. Some schools block access to certain IP ranges, meaning that although her programs could be running they are not able to update themselves. Make sure that whatever she uses, it's set to automatically update itself regularly. My daughter is in college as well and I know that this sort of thing would be very low on her list of priorities...

Allan-OK · December 2005

Thanks I will have a word about this and try to get things organised better for next term.

Allan-OK · December 2005

I have run bitdefender and the result is below. Unfortunately when I run the Panda active scan everything freezes after just under 25000 files have been scanned. I then have to push the off button and turn off without going through the shut down procedure.

Does anyone have any suggestions

Bitdefender result:-

BitDefender Online Scanner

Scan report generated at: Tue, Dec 20, 2005 - 07:59:57

Scan path: C:\; D:\;

Statistics

Time
11:23:32

Files
259395

Folders
3159

Boot Sectors
2

Archives
6826

Packed Files
25667

Results

Identified Viruses
1

Infected Files
1

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
1

Engines Info

Virus Definitions
246920

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Scanned File
Status

C:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll
Infected with: Trojan.Downloader.3069.A

C:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll
Disinfection failed

C:\WINDOWS\Downloaded Program Files\miniclipGameLoader.dll
Deleted

Trogan · December 2005

You could try this scan:

Housecall at TrendMicro
http://housecall.trendmicro.com/housecall/start_corp.asp
Make sure you tick Auto Clean.

profdlp · December 2005

It looks like it was unable to clean the file, so it deleted it for you. This is typical, since the file itself was the Trojan.

Your next step ought to be to turn off System Restore, reboot, then re-enable it. This will assure you that the miscreant isn't lurking in a Restore Point waiting to come along and reinfect you. Then run another full scan (make sure you have the latest virus definitions installed) and make sure you're still alright.

EDIT: Trogan was too quick for me.

Leonardo · December 2005

reezes after just under 25000 files have been scanned

That sounds like a hard drive overheating. Alas, but laptops just aren't made for heavy duty work. They just are too cramped internally for good cooling. If your laptop has a door/access panel, remove the door, an put a small item under the hard drive to keep in its bay. (Do this while the computer is OFF!) Run the computer without the door and the drive's heat will be able to dissipate. I've had to do this many times with my pathetic laptop (Gateway 600YG2) when performing hard drive intensive applications.

Allan-OK · December 2005

I have run bitdefender and the result is below. I have however run the Panda scan numeruous times and the computer freezes and I have to powerdown when it has scanned just under 25000 files at the same point each time.

Any suggestions gratefully received.

Bitdefender:-

BitDefender Online Scanner

Scan report generated at: Tue, Dec 20, 2005 - 07:59:57

Scan path: C:\;D:\;

Statistics

Time
11:23:32

Files
259395

Folders
3159

Boot Sectors
2

Archives
6826

Packed Files
25667

Results

Identified Viruses
1

Infected Files
1

Suspect Files
0

Warnings
0

Disinfected
0

Deleted Files
1

Engines Info

Virus Definitions
246920

Engine build
AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29)

Scan plugins
13

Archive plugins
39

Unpack plugins
4

E-mail plugins
6

System plugins
1

Scan Settings

First Action
Disinfect

Second Action
Delete

Heuristics
Yes

Enable Warnings
Yes

Scanned Extensions
*;

Exclude Extensions

Scan Emails
Yes

Scan Archives
Yes

Scan Packed
Yes

Scan Files
Yes

Scan Boot
Yes

Allan OK

Allan-OK · December 2005

Sorry about that last post. I thought the one I posted last night hadn't worked but I have now seen the 2nd page to this thread!!!

I will now look at the answers to the earlier one (thanks again guys) and then see how things are.

Allan-OK · December 2005

Re the overheating problem - does any one have any experience of the laptop coolers which plug into the USB socket. Do they work?

In the meantime I will follow the suggestions above.

Thanks guys.

profdlp · December 2005

Allan OK wrote:

Re the overheating problem - does any one have any experience of the laptop coolers which plug into the USB socket. Do they work?...

You should wait for a second opinion, but my advice would be to just get the thing raised off the surface it's sitting on, at least by a little bit. Even the little extendable legs at the rear of the case should help significantly. As has already been discussed, keeping it cleaned out is very important as well.

I would be skeptical of any laptop cooling device running off a USB port, at least in most situations. I doubt you'd see any benefit worth the trade-off of having reduced battery life to power it, or, if on mains power, having one more gimcrack piece of hardware to fool with.

Allan-OK · December 2005

Thanks - wahat you say makes sense.

Allan-OK · December 2005

This will hopefully be the last post in this thread. It is just to say thanks again for all the helpful comments. The virus checkers found various problems and the machine is now much better. It is still running hot but no longer ctrahing. Hopefully it will stay that way!

Leonardo · December 2005

That is the bane of laptops - they run hot. Something you might want to consider when you think you have the technical competency: 1) disassemble the laptop enough to remove the CPU's heatsink, 2) remove the thermal interface pad (TIM, a sticky patch), and 3) replace with a quality thermal compound like Arctic Silver 5. TIMs work, but like so much else that goes into off-the-shelf computers, it is factory cost saving measure and is not high quality.

Laptop freezes and shuts down without warning

Comments