forced to manual shut down + bios question

[Johannes]

Several times now I had to use the power button to shut down my pc.
This happens odd times. Last night I had been using Firefox, I.E. to visit various web sites (No porn sites) and a FTP program. When I went to shut down, I first closed all open programs except Zone Alarm and Norton and tried to close via windows. It did not work, even clicking on the browser icon did do nothing.
As I am not sure what to produce from the event viewer,I made a pic of July 27 events. I have not a clue how to read these events.
The other question, (just out of curiousity) When and why does one need to update the bios?

 

[johngalt]

RUn a virus check immediately. That looks normal at first glance, Johannes, but in fact the error components say *bowser* not bRowser

 

[Johannes]

Thanks John, I did run the complete scan with Norton, It noted one virus detected, but did not state any information on it. I initiated the process of running a scan with Trend Micro. Would you have any idea how a virus could have infected my PC while having an virus definitions updated virus scanner (Norton 360) plus
ZoneAlarm Pro.

I could not initiate the trend micro scan, but did the Kaspersky. that one did not show a virus present either, but a new event log file showed the "bowse" entry again.

 

[johngalt]

Yup - it could have been dropped by a malicious website / banner advertisement without your knowledge, and if it is not in your AntiVirus' definitions file, then it will never find it. Also, is your Norton 360 set to automatically scan (Real time protection, I believe it is called)? If not then it could easily have dropped 1,000s of viruses on your computer.

Also, do you have UAC enabled?

 

[Johannes]

Yup - it could have been dropped by a malicious website / banner advertisement without your knowledge, and if it is not in your AntiVirus' definitions file, then it will never find it. Also, is your Norton 360 set to automatically scan (Real time protection, I believe it is called)? If not then it could easily have dropped 1,000s of viruses on your computer.

Also, do you have UAC enabled?

Both Norton and Zone alarm are set to real time protection. The last event log was done after the virus scan from Norton and the on line scan from Symantec, Kaspersky and trend micro house call. (no viruses found by those scans) It still shows the"bowser" notation I tried to find more info on the
NetBT_Tcpip_{08B4084B-14C0-4E33-8B4B-B123F92BBF89}. , but all I could find that it has something to do with Winsock.
I am not clear whether my UAC is enabled, should the check mark in the box or not? I added the screen shot of location of that file, if it needs to be removed, could you please write me how

 

[johngalt]

Enabled - checked, AFAICR.

Again, if Norton did not have the file in its definitions when you first were infected, then it makes sense that it may not find it without full system scans.

Also, Zone Alarm works by blocking most attempts to intrude into your system that you did not ask for - but if you visited a website that had a malicious advertising, then you've basically consented to view the ad from whatever site - and thus it can easily get access to your system to drop a virus.

Other sources include discs, USB flash devices, anything that connects to your computer externally, not just the Internet.

 

[Johannes]

I just added the screenshot from the location of the "bowser" could you tell me how to remove it. Even after more than nine years having a pc, I have not been able to remember what I have learned.

 

[Fumz]

Since Norton is able to detect that a virus is present probably means that its definitions are sufficient, at the very least to quarantine it; that it can't get at and attack the virus is another thing. I would turn of system restore and run the scan again. Often, a virus will hide itself there because it's the one place virus scanners can't go.

BTW... damn good eye johngalt.

 

[johngalt]

Thanks, m8t - and yeah, since Norton sees it *now* it is most likely some sort of virus that may have been found and removed, but this particular instance is more than likely in System Restore files - good call on that one Fumz. I never even considered that aspect of it.

RE: the file not being in the defs - that is how the original file may have gotten onto the system, before there was a def entry for it - and if any software was installed while that virus was there and a System Restore backup was made then it would make sense that the virus was backed up as well :P

 

[Johannes]

I have tried everything, updated the virus definitions again , ran a full system scan agin,which came out clear. However, in the event viewer it still shows the "bowser" error. Would you have any suggestions how to get rid of it? see latest event scan.

 

[Fumz]

Just so we're clear, did you disable System Restore before you ran your last scan?

 

[Johannes]

No, I did not do that. I shall do that now and run a new scan. Thanks.

 

[Johannes]

Now I am really stumped, I did disable system restore, new scan and no virus was found.
I just happen to look at the event log back to the day I got it, (May 12 2008) and it was the same night that this "bowser" error came up. So obviously what I thought it to be the virus causing the shut down problem was not it.
Perhaps it was the virus that was detected and removed from my system by my virus scanner.
Since the problem occured while I shifted between Firefox and I.E. 7, I tested the shut down several times and it seems to be OK now. That leaves me with the question: is it necessary to update the bios?
Thanks

 

[johngalt]

you can look at the details page for each o those events - see what that says and hopefully it should give more of a clue - feel free to paste the details here if you want so we can take a look too.

I have to admit I am extremely curious about this myself....

 

[Johannes]

I take it that you mean the event log? I had the event log copied, but in the manage attachments it stated "an invalid file" it is 1.06 MB, would that be the reason? edit: I added a screen pic of the first time this error came up.
Would you know why all these errors started right from the day I bought this PC?

 

[johngalt]

Well, it was all for naught - I should have searched for it.

Larry Osterman's WebLog : Fun with names

 

[Johannes]

Hi John,
At least we know now it is not a nasty. I had myself put the name in to google, but nothing came up that seem to be related to the event log.
Thank you very much for taking the time to answer my questions.
Should I be concerned about all those errors in the event log, it does not seem to impair the operation of my computer, and is it necessessary to update a bios? I basically use my PC for e mail, a bit of entering new info on my web site and visiting various forums. No gaming at all. Thanks again.

 

[johngalt]

I would still be concerned, as it is basically an error that seems to be dealing with the computer browser service on your computer and how it seems that something (externally) is trying to / successfully disabling it.

Add to that the factor that you have at least one reference to a malware file that cannot be touched, and it bodes ill. I would run a couple of online AV scans and see if any of those find anything. Also look in the Norton logs / run a fresh scan to see if it can find the actually file and its location- then you can send the file to Virus Total and see what other AV products rate it as.

 

[Johannes]

I rescanned the pc with Norton 360, Ad_Aware, Karspersky, and House Call from trend Micro. Only Trend Micro detected "gray ware" that I accidently downloaded with ADWARE_180solution (thought it was the Ad-Aware program). I did uninstall it, but it must have left a trace of it on the computer. The other programs found some tracking cookies, but nothing else. I have no problem anymore with the shut down via windows.
Thanks a lot John.