PCBUILD Archives

Personal Computer Hardware discussion List

PCBUILD@LISTSERV.ICORS.ORG

Options: Use Forum View

Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
From:
Jeff Lane <[log in to unmask]>
Reply To:
PCBUILD - Personal Computer Hardware discussion List <[log in to unmask]>
Date:
Sun, 5 Sep 2004 11:28:29 -0700
Content-Type:
text/plain
Parts/Attachments:
text/plain (224 lines)
Adam,

There are a number of things that can cause your reboots other than hardware
issues. Spyware, virus, Trojans, or worms are far more responsible for these
kind of problems today. I am inserting some help compiled by our good friend
Carl Houseman. He has spent a great deal of time and effort to solve these
types of issues. Most all of the programs described are free and are not
system intrusive. Be certain to update them prior to usage. I feel that this
is a viable alternative to spending more money on hardware until you are
certain your system is clean. Remember it can be infected in a nanosecond.

Hope this helps.

Jeff


Deluxe Internet Explorer Spyware & Crapware Uninstall Methodology[TM]
                                        D.I.E.S.C.U.M.[TM]

If you've been advised to implement D.I.E.S.C.U.M.[TM], then the symptoms
you've reported are unusual enough that they merit a full review of your
system for software installs or other alterations that may have been done
without your knowledge.  You may even be advised to work through this when
the problem has nothing to do with Internet Explorer.

Complete these steps in the order listed and with careful attention to the
instructions.  Download links for software titles are given at the bottom.
Except as noted, each step should be followed by a reboot and a check to see
if the problem still happens.  If not fixed, move to the next step.  After
the problem is resolved, see "Preventative Measures" at the end.

DISCLAIMER / WARNING:
Perform these steps at your own risk.  No warranty is expressed or implied
that the advice which follows will solve your problems or prevent harm to
your computer.  In the worst case, the complete contents of your computer's
hard drive could be lost, so make backups of anything important before
proceeding.



Steps 1-4: Automatic Detection and Removal

1. Make sure your antivirus software is up-to-date and scan all drives.  If
something is detected and removed, scan again after rebooting.

NOTE:
If you have no antivirus software, install, update, and scan with either AVG
or Avast.   If your existing antivirus program is out of date and won't
update, or you don't want to pay for updates, remove it and go with AVG or
Avast.  Do not install more than one antivirus program at a time.

2. Install, update, enable all immunization features, and scan for problems
with Spybot Search & Destroy.  Fix all problems that are reported.  Scan
again after rebooting.

3. Install, update, and enable all immunizations in Spywareblaster.

4. Install, update, and scan with Trojan Remover.



Steps 5-7: Especially for a misbehaving Internet Explorer

5. In IE, click Tools, Internet Options, click "Delete Files" and remove all
offline content.  No need to reboot after this step.

6. In IE, click Tools, Internet Options, Advanced, and under Browsing,
un-check "Enable third party browser extensions".

NOTE: Some third party browser extensions are beneficial.  If this step this
fixes the problem, start Spybot Search & Destroy, enable Advanced mode, then
look at Tools, BHO's.  Click the check-mark next to a BHO item for details.
If you don't recognize it, click the Remove button.   When all of the
unwanted BHO's are removed, re-enable third party browse extensions, reboot,
and verify the problem is still solved.

7. In IE, click Tools, Internet Options, Programs, and click "Reset Web
Settings".



Steps 8-10: Getting serious now

8. In Spybot Search & Destroy, enable Advanced mode and go to Tools, System
Startup.  Un-check EVERYTHING.

NOTE:
If scumware is active on your system it may attempt to create new items each
time you disable an item.  In that case, boot into safe mode before starting
this step.  If you enabled Spybot's "TeaTimer" feature, you will be asked to
approve the un-checking of items.

You will want to re-enable some of the items after the problem is solved.
Look at the command line of each item and see if the folder or program name
is related to a product you recognize.  If so, it's probably safe to
re-enable.  But don't assume that something is required because it's in the
\windows or \windows\system32 folder or because it's name sounds like it's
important to Windows.  To further investigate an item, search for it here:

    http://www.windowsstartup.com/wso/index.php

If you're still not sure about re-enabling an item, post the full command
line (with folder names) to this mailing list.

9. In Spybot Search & Destroy, enable Advanced Mode, click Tools, and place
a check-mark in the box for "Hosts File".  Now click the Hosts File button
that appears on the left.  Remove any hosts which do not have a destination
of 127.0.0.1.  If you are looking at the Hosts File for the first time, and
the file has not been modified by scumware, there will be just one entry for
"localhost".  See further comments under Preventative Measures below.

10. Install and run the Rootkit Detector.  If something is detected, copy
and paste the results in a message to this mailing list for further comment.

NOTE: How to install and run Rootkit Detector:
a. Extract all files into an empty folder.
b. Open a command prompt.
c. Type CD followed by the full path of the folder you created for step (a),
and press Enter.
d. Type "rkdetector" and press Enter at the prompt.



Step 11: When all else fails.

11. Run HijackThis, click Scan, click Save Log, and post the contents of the
log file to this mailing list.



All done?  Now that your system is clean, implement these
Preventative measures

A. Complete steps 1, 2 and 3 above even if you have no problems.

B. In Spybot Search & Destroy, enable Advanced Mode, click Tools, put a
check-mark in Hosts File, and click the Host File button on the left.  Now
click "Add Spybot S&D Hosts List".  This prevents your system from accessing
potentially dangerous websites.  The names of those sites will now be listed
in your hosts file with a destination address of 127.0.0.1.

C. In Spywareblaster, click System Snapshot and Create New System Snapshot.
In the future if you have an IE problem, try restoring this snapshot before
working through D.I.E.S.C.U.M.[TM] again.

D. Set your antivirus software to automatically update itself DAILY and to
perform a full scan of your hard drive at least weekly, or daily if you
leave the machine on 24x7 and can schedule it to run overnight.

E. On a WEEKLY basis (at minimum) make sure your antivirus software, Spybot
Search & Destroy, and Spywareblaster, are all up to date.  Even though your
antivirus software is updating itself daily, verify that the updates are
happening.   After a Spybot update, re-enable all immunizations and complete
a scan.

F. Enable Microsoft to automatically download patches to your machine
(Control Panel / System / Automatic Updates).  You don't have to choose to
have patches installed automatically but at least let them be downloaded so
you're notified of their existence.  If a new patch has problems you'll hear
about it within a week or two at most, after that consider the patch safe
and let it be installed.

======
Links to Software Tools

Note that some of this software is free for non-commercial (home/non-profit)
usage only.  Consider making a donation to those that provide a means of
accepting contributions.  Your support will help insure that these high
quality tools remain available and free.


Free Antivirus (AVG preferred for Outlook / Outlook Express users):
  AVG: http://free.grisoft.com/freeweb.php
  Avast: http://www.avast.com/eng/avast_4_home.html

Free Anti-Spyware/Adware:
  Spybot Search & Destroy: http://www.safer-networking.org/en/index.html
  Spywareblaster: http://www.javacoolsoftware.com/spywareblaster.html
  Hijackthis: http://www2.spywareinfo.com/~merijn/files/hijackthis.zip

Free trial Anti-Trojan software (fully functional for 30 days):
  Trojan Remover: http://www.simplysup.com

Free Rootkit Detector:
  http://bagpuss.swan.ac.uk/comms/RKDetectorv0%5B1%5D.62.zip





----- Original Message -----

>I have a home built rig that is still having spontaneous reboot issues.  I
>have replaced the Enlight Power supply with a an Antec True 480 psu, I have
>replaced upgraded (or changed) memory from Mushkin Green PC 3200 memory to
>OCZ Enhanced Latency PC 3200 memory.  I have checked operating temps.  The
>CPU run well within spec from AMD (highest temp 49celsius, 120 F under
>load) and case temp hovers around the 90F (32C).  I have upgraded to the
>latest bios for my board and have also upgraded to the latest NVIDIA
>NFORCE2 drivers.  I cannot recall exactly when the spontaneous reboot issue
>started (no particular upgrade or hardware install sticks out).  Here is
>what I have hardware wise, I hope you can help.
>
> AMD ATHLON XP 3200+
> ABIT AN7 Mobo
> 1 Lite On DVD RW+- 8x  Drive (IDE)
> 1 SAMSUNG CD RW Drive (IDE)
> 1 Western Digital 160gb Caviar Hard Drive w/ 89mb cache (7200 RPM)
> 2 OCZ Enhanced Latency 512k DDR PC 3200 ram modules running in dual
> channel
> 1 ATI Radeon 9800 pro Video Card
> 1 Antec Tru 480w power supply
> 1 Teac 3.5 Floppy Drive
>
> 2 80 mm Case Fans (1 intake, 1 exhaust)
> 1 Thermaltake Heatsink/Fan
>
>
> Thank you for any further direction you can give

           The NOSPIN Group is now accepting donations to help
          defer the costs of providing PCBUILD and our website.
           Visit http://freepctech.com to donate using PAYPAL

ATOM RSS1 RSS2