Speedfan - Sitcoms Online Message Boards

Brent88 · 07-01-2006, 02:54 AM

I'm still trying to figure out the occasional restarts of my computer(it's not random, or for no reason, it's only on certain websites or when trying to download Windows Update). It's not overheating(Speedfan has the temperature at 37/47C, but it lists the 2 fans as 0 RPM). Does that really mean the fans aren't working? What baffles me and doesn't add up though is if I avoid the sites that cause the shutdown, and don't do Windows Update, it will stay on all day.

Chelsea · 07-01-2006, 03:20 AM

Exactly what are you doing when the system crashes? (Forgive me if you've been asked this before, but I didn't catch those threads). Is there any specific chain of events that, if you do those things, your system WILL crash?

Try disabling automatic restarts (see below), then when your system crashes, instead of restarting automatically, you'll go to a blue screen of death. Write down the error information presented, if any (IE: Write down anything that seems even remotely important)

To disable:
Go to Desktop
Right-Click on My Computer
Choose Properties
Click the Advanced Tab
Click the Settings button under Startup and Recovery
De-check the check box beside "Automatically Restart"
Click OK
Click OK
-------
I think Temp can be ruled out, and it doesn't sound like a virus...could be bad memory, could be a problematic power supply, could be a motherboard heading southward...could be a driver problem. Might also be a good idea to turn ON error reporting, and send errors after a crash.

To make sure it's turned on, follow all steps through "Click the Advanced Tab"
then
Click Error Reporting
Click Enable Error Reporting
Make sure BOTH boxes are checked.

robyrob · 07-01-2006, 09:18 AM

does it do this in firefox as well as IE ?

what are these other sites that are causing the shutdowns?

the "0 rpm" probably is just because your motherboard doesnt have compatible fan rpm sensors, not a big deal (if you are REALLY worried you could open the case and SEE if they are still spinning)

Brent88 · 07-01-2006, 12:23 PM

Sites that cause shutdown, some won't load at all and shut down immediately, some will load and then shut down after a few minutes.

www.youtube.com
www.wsbtv.com
www.expedia.com

and a few others, but are those are the main ones. It seems that it won't load most TV Station websites either. It has never shutdown while I'm on one of the many forums I go to though(including here).

When trying to download Windows Updates
When doing a disk cleanup
When running a virus scan

I haven't tried the last two in the past 10 days or so, but it did shut down when I was trying to download a Windows Update on Thursday Night. It hasn't completed any of the three.

I don't have Firefox.

I turned off Auto-Restart a while back, up til a couple of days ago it was the "mssync20.exe" file. After I cleaned out the temporary internet files it seems to be gone because the error yesterday was something like PAGE_NOT_FOUND_FAULT. I don't remember exactly, but it was similar.

robyrob · 07-01-2006, 02:50 PM

please download & run Rootkit Revealer, my suspicion is that you are infected with the Troj/LdPinc-LZ Spyware Trojan, which uses a Rootkit to hide itself from Windows and all removal tools.

to remove it you are going to need to "unhook" and kill the process from memory then remove the files and anything in the registry that links/starts it.

basically if Rootkit Revealer finds any processes hidden from Windows, i'd say thats what is going on.

take a read through this thread

Brent88 · 07-01-2006, 02:57 PM

Quote:

Originally Posted by robyrob

please download & run Rootkit Revealer, my suspicion is that you are infected with the Troj/LdPinc-LZ Spyware Trojan, which uses a Rootkit to hide itself from Windows and all removal tools.

to remove it you are going to need to "unhook" and kill the process from memory then remove the files and anything in the registry that links/starts it.

basically if Rootkit Revealer finds any processes hidden from Windows, i'd say thats what is going on.

take a read through this thread

What is the actual link to it? I registered and see the downloads, but I have no idea which one is correct.

robyrob · 07-01-2006, 03:16 PM

very bottom of the SysInternals page - you shouldn't have to register for anything

http://www.sysinternals.com/Files/RootkitRevealer.zip

Brent88 · 07-01-2006, 03:55 PM

OK, I'm running it now. It's found 3 things, all start with HKLM, says are all hidden from Windows API. All have mssync20 at the end.

Still scanning...

OK, it's found 3 more of those and 3 Data Mismatch between Windows API and raw hive data.

robyrob · 07-01-2006, 05:26 PM

as far as i can see there is NO automatic removal tool for this specific rootkit/trojan... you can remove it manually, or you could try one of the generic Rootkit removal tools

when RootkitRevealer is done, print out the list of everything it finds, then reboot into SAFEMODE (tap the F8 function key as it boots up, select Safemode), find the files listed in the \windows\system32\ folder and delete them, then use the registry editor to manually delete all of the registry items listed in Rootkit Revealer. Make sure you disable System Restore temporarily to clear anything from there, and use CCleaner to remove any temp files. Reboot into normal mode and run Rootkit Revealer again to make sure it is gone, if clean then update your antivirus program and go DIRECTLY to WINDOWS UPDATE

as for those generic rootkit removal tools, the only FREE one i found that i would trust is from f-secure: http://www.f-secure.com/blacklight/try.shtml

its a trial version, so there is no support on it, and there is no guarantee that it will actually remove it (remember to check your system in normal mode with RootkitRevealer again) - all you can do is try.

there are some paid versions out there, these two look promising:
RootkitShark (free trial version will find only, need to buy to fix anything)
unhackme (i cant tell if the evaluation version will fix either)

07-01-2006, 02:54 AM	#1
Brent88 Member Forum Star Join Date: Aug 01, 2003 Location: Alabama Posts: 16,174	Speedfan I'm still trying to figure out the occasional restarts of my computer(it's not random, or for no reason, it's only on certain websites or when trying to download Windows Update). It's not overheating(Speedfan has the temperature at 37/47C, but it lists the 2 fans as 0 RPM). Does that really mean the fans aren't working? What baffles me and doesn't add up though is if I avoid the sites that cause the shutdown, and don't do Windows Update, it will stay on all day.
	__________________ Brent

07-01-2006, 03:20 AM	#2
Chelsea Semi-retired Forum Veteran Join Date: Jan 07, 2001 Location: Washington Posts: 5,727	Exactly what are you doing when the system crashes? (Forgive me if you've been asked this before, but I didn't catch those threads). Is there any specific chain of events that, if you do those things, your system WILL crash? Try disabling automatic restarts (see below), then when your system crashes, instead of restarting automatically, you'll go to a blue screen of death. Write down the error information presented, if any (IE: Write down anything that seems even remotely important) To disable: Go to Desktop Right-Click on My Computer Choose Properties Click the Advanced Tab Click the Settings button under Startup and Recovery De-check the check box beside "Automatically Restart" Click OK Click OK ------- I think Temp can be ruled out, and it doesn't sound like a virus...could be bad memory, could be a problematic power supply, could be a motherboard heading southward...could be a driver problem. Might also be a good idea to turn ON error reporting, and send errors after a crash. To make sure it's turned on, follow all steps through "Click the Advanced Tab" then Click Error Reporting Click Enable Error Reporting Make sure BOTH boxes are checked.
	__________________ Chelsea Former Administrator, 2005-2012 Former Member, DVD Review Team, 2004-2010.

07-01-2006, 09:18 AM	#3
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,203	does it do this in firefox as well as IE ? what are these other sites that are causing the shutdowns? the "0 rpm" probably is just because your motherboard doesnt have compatible fan rpm sensors, not a big deal (if you are REALLY worried you could open the case and SEE if they are still spinning)
	__________________ * firefox * AdAware * HiJackThis * CoolWebShredder * Spybot * SpywareBlaster * Spyware Terminator * * GeeksToGo * AntiVir * Avast antivirus * Housecall Online * Sysinternals Security Utilities * * ZoneAlarm * Agnitum-firewall * Comodo Firewall * AVG Anti-Rootkit * RootkitRevealer * ParasiteCheck * * Annoyances * FreeCodecs * Mikes-Hosts-File * GRC.com * MSAntispyware * DVD's * TradeList * myspace *

07-01-2006, 12:23 PM	#4
Brent88 Member Forum Star Join Date: Aug 01, 2003 Location: Alabama Posts: 16,174	Sites that cause shutdown, some won't load at all and shut down immediately, some will load and then shut down after a few minutes. www.youtube.com www.wsbtv.com www.expedia.com and a few others, but are those are the main ones. It seems that it won't load most TV Station websites either. It has never shutdown while I'm on one of the many forums I go to though(including here). When trying to download Windows Updates When doing a disk cleanup When running a virus scan I haven't tried the last two in the past 10 days or so, but it did shut down when I was trying to download a Windows Update on Thursday Night. It hasn't completed any of the three. I don't have Firefox. I turned off Auto-Restart a while back, up til a couple of days ago it was the "mssync20.exe" file. After I cleaned out the temporary internet files it seems to be gone because the error yesterday was something like PAGE_NOT_FOUND_FAULT. I don't remember exactly, but it was similar.

07-01-2006, 02:50 PM	#5
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,203	please download & run Rootkit Revealer, my suspicion is that you are infected with the Troj/LdPinc-LZ Spyware Trojan, which uses a Rootkit to hide itself from Windows and all removal tools. to remove it you are going to need to "unhook" and kill the process from memory then remove the files and anything in the registry that links/starts it. basically if Rootkit Revealer finds any processes hidden from Windows, i'd say thats what is going on. take a read through this thread

07-01-2006, 03:16 PM	#7
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,203	very bottom of the SysInternals page - you shouldn't have to register for anything http://www.sysinternals.com/Files/RootkitRevealer.zip

07-01-2006, 03:55 PM	#8
Brent88 Member Forum Star Join Date: Aug 01, 2003 Location: Alabama Posts: 16,174	OK, I'm running it now. It's found 3 things, all start with HKLM, says are all hidden from Windows API. All have mssync20 at the end. Still scanning... OK, it's found 3 more of those and 3 Data Mismatch between Windows API and raw hive data.

07-01-2006, 05:26 PM	#9
robyrob certified wackball#3 Moderator Forum Icon Join Date: Aug 03, 2003 Location: hiding under the third booth at Arnold's Posts: 58,203	as far as i can see there is NO automatic removal tool for this specific rootkit/trojan... you can remove it manually, or you could try one of the generic Rootkit removal tools when RootkitRevealer is done, print out the list of everything it finds, then reboot into SAFEMODE (tap the F8 function key as it boots up, select Safemode), find the files listed in the \windows\system32\ folder and delete them, then use the registry editor to manually delete all of the registry items listed in Rootkit Revealer. Make sure you disable System Restore temporarily to clear anything from there, and use CCleaner to remove any temp files. Reboot into normal mode and run Rootkit Revealer again to make sure it is gone, if clean then update your antivirus program and go DIRECTLY to WINDOWS UPDATE as for those generic rootkit removal tools, the only FREE one i found that i would trust is from f-secure: http://www.f-secure.com/blacklight/try.shtml its a trial version, so there is no support on it, and there is no guarantee that it will actually remove it (remember to check your system in normal mode with RootkitRevealer again) - all you can do is try. there are some paid versions out there, these two look promising: RootkitShark (free trial version will find only, need to buy to fix anything) unhackme (i cant tell if the evaluation version will fix either)