View Full Version : Speedfan
Brent88 07-01-2006, 02:54 AM I'm still trying to figure out the occasional restarts of my computer(it's not random, or for no reason, it's only on certain websites or when trying to download Windows Update). It's not overheating(Speedfan has the temperature at 37/47C, but it lists the 2 fans as 0 RPM). Does that really mean the fans aren't working? What baffles me and doesn't add up though is if I avoid the sites that cause the shutdown, and don't do Windows Update, it will stay on all day.
:confused:
Chelsea 07-01-2006, 03:20 AM Exactly what are you doing when the system crashes? (Forgive me if you've been asked this before, but I didn't catch those threads). Is there any specific chain of events that, if you do those things, your system WILL crash?
Try disabling automatic restarts (see below), then when your system crashes, instead of restarting automatically, you'll go to a blue screen of death. Write down the error information presented, if any (IE: Write down anything that seems even remotely important)
To disable:
Go to Desktop
Right-Click on My Computer
Choose Properties
Click the Advanced Tab
Click the Settings button under Startup and Recovery
De-check the check box beside "Automatically Restart"
Click OK
Click OK
-------
I think Temp can be ruled out, and it doesn't sound like a virus...could be bad memory, could be a problematic power supply, could be a motherboard heading southward...could be a driver problem. Might also be a good idea to turn ON error reporting, and send errors after a crash.
To make sure it's turned on, follow all steps through "Click the Advanced Tab"
then
Click Error Reporting
Click Enable Error Reporting
Make sure BOTH boxes are checked.
robyrob 07-01-2006, 09:18 AM does it do this in firefox as well as IE ?
what are these other sites that are causing the shutdowns?
the "0 rpm" probably is just because your motherboard doesnt have compatible fan rpm sensors, not a big deal (if you are REALLY worried you could open the case and SEE if they are still spinning)
Brent88 07-01-2006, 12:23 PM Sites that cause shutdown, some won't load at all and shut down immediately, some will load and then shut down after a few minutes.
www.youtube.com (http://www.youtube.com)
www.wsbtv.com (http://www.wsbtv.com)
www.expedia.com (http://www.expedia.com)
and a few others, but are those are the main ones. It seems that it won't load most TV Station websites either. It has never shutdown while I'm on one of the many forums I go to though(including here).
When trying to download Windows Updates
When doing a disk cleanup
When running a virus scan
I haven't tried the last two in the past 10 days or so, but it did shut down when I was trying to download a Windows Update on Thursday Night. It hasn't completed any of the three.
I don't have Firefox.
I turned off Auto-Restart a while back, up til a couple of days ago it was the "mssync20.exe" file. After I cleaned out the temporary internet files it seems to be gone because the error yesterday was something like PAGE_NOT_FOUND_FAULT. I don't remember exactly, but it was similar.
robyrob 07-01-2006, 02:50 PM please download & run Rootkit Revealer (http://www.sysinternals.com/Utilities/RootkitRevealer.html), my suspicion is that you are infected with the Troj/LdPinc-LZ Spyware Trojan (http://www.sophos.com/security/analyses/trojldpinclz.html?_log_from=rss), which uses a Rootkit to hide itself from Windows and all removal tools.
to remove it you are going to need to "unhook" and kill the process from memory then remove the files and anything in the registry that links/starts it.
basically if Rootkit Revealer finds any processes hidden from Windows, i'd say thats what is going on.
take a read through this thread (http://www.sysinternals.com/Forum/forum_posts.asp?TID=6418&PN=1)
Brent88 07-01-2006, 02:57 PM please download & run Rootkit Revealer (http://www.sysinternals.com/Utilities/RootkitRevealer.html), my suspicion is that you are infected with the Troj/LdPinc-LZ Spyware Trojan (http://www.sophos.com/security/analyses/trojldpinclz.html?_log_from=rss), which uses a Rootkit to hide itself from Windows and all removal tools.
to remove it you are going to need to "unhook" and kill the process from memory then remove the files and anything in the registry that links/starts it.
basically if Rootkit Revealer finds any processes hidden from Windows, i'd say thats what is going on.
take a read through this thread (http://www.sysinternals.com/Forum/forum_posts.asp?TID=6418&PN=1)
What is the actual link to it? I registered and see the downloads, but I have no idea which one is correct.
robyrob 07-01-2006, 03:16 PM very bottom of the SysInternals page - you shouldn't have to register for anything
http://www.sysinternals.com/Files/RootkitRevealer.zip
Brent88 07-01-2006, 03:55 PM OK, I'm running it now. It's found 3 things, all start with HKLM, says are all hidden from Windows API. All have mssync20 at the end.
Still scanning...
OK, it's found 3 more of those and 3 Data Mismatch between Windows API and raw hive data.
robyrob 07-01-2006, 05:26 PM as far as i can see there is NO automatic removal tool for this specific rootkit/trojan... you can remove it manually, or you could try one of the generic Rootkit removal tools
when RootkitRevealer is done, print out the list of everything it finds, then reboot into SAFEMODE (tap the F8 function key as it boots up, select Safemode), find the files listed in the \windows\system32\ folder and delete them, then use the registry editor to manually delete all of the registry items listed in Rootkit Revealer. Make sure you disable System Restore temporarily to clear anything from there, and use CCleaner (http://www.ccleaner.com/download/downloadpage.aspx?1) to remove any temp files. Reboot into normal mode and run Rootkit Revealer again to make sure it is gone, if clean then update your antivirus program and go DIRECTLY to WINDOWS UPDATE
as for those generic rootkit removal tools, the only FREE one i found that i would trust is from f-secure: http://www.f-secure.com/blacklight/try.shtml
its a trial version, so there is no support on it, and there is no guarantee that it will actually remove it (remember to check your system in normal mode with RootkitRevealer again) - all you can do is try.
there are some paid versions out there, these two look promising:
RootkitShark (http://www.advances.com/software/rootkitshark.htm) (free trial version will find only, need to buy to fix anything)
unhackme (http://greatis.com/unhackme/download.htm) (i cant tell if the evaluation version (http://www.greatis.com/unhackme.zip) will fix either)
|