Laptop Keeps freezing even after re-install... confused.
- Thread starter inlineadam
- Start date
RobertP
TPer Emeritus
- Messages
- 11,726
- Name
- Robert
- Edit My Images
- Yes
Someguy201 - There is no doubting you are trying to help someone with a problem but the way you and the OP have used this thread as an instant messenger service while posting solutions/ log files etc on another forum does not work for TP.
This thread has half the story and is not helping members here. By all means post a link to the antivirus forum you support if you think it will help someone. Having posted the link please leave it there. I'm sure your help will be appreciated but do it either here or elsewhere not spread half and half over both.
This thread has half the story and is not helping members here. By all means post a link to the antivirus forum you support if you think it will help someone. Having posted the link please leave it there. I'm sure your help will be appreciated but do it either here or elsewhere not spread half and half over both.
Actually, the vast majority of malware is designed to make money. The majority of malware is usually pop-up based/fake AV/fake HDD diagnostics - the idea behind this is the user believes the program is legit - or believes "buying" the program will remove the malware anyway. They then register the program, which consequently does nothing and leaves them infected.
Rootkits are a slightly different story - they are highly common now, and highly sophisticated. Most rootkits, TDL4, ZeroAccess, Whistler etc, are also designed to make money - but in a different way. These rootkits are notoriously difficult to remove, and as such have no problem in making symptoms known, in fact the symptoms is how they make money.
Rootkits generally cause google redirects, display pop-up advertisements, or play audio adverts and other sounds. The malware author sells the malware to websites- the also can websites get paid to infect machines - people pay the malware author, and the websites, to have the malware redirect/display advertisements for their own website or products.
You're partially correct that it is a driver problem. Rootkits work by patching legit microsoft drivers which load during the kernal phase. Consequently, the malware loads very early on in the boot sequence, and well before onboard AV.
A slow computer is a common symptom in a rootkit infection. Malware is not tested against all types of hardware, and all possible drivers. Frequently it doesn't run "perfectly", and will have a huge effect on the performance of the computer.
Both of these symptoms are sterotypical of a specific rootkit which infects the MBR. Non malicious driver problems do not cause random music to play from a computer.
In the thread at TSF which is currently ongoing, our tools show traces of a rootkit. Very specific MBR malware removal tools are not running. Specific tools which are used to deal with this type of infection are being targeted by the malware, a tactic frequently employed by advanced rootkits.
I deal with advanced malware every day, this is malware.
Rootkits are a slightly different story - they are highly common now, and highly sophisticated. Most rootkits, TDL4, ZeroAccess, Whistler etc, are also designed to make money - but in a different way. These rootkits are notoriously difficult to remove, and as such have no problem in making symptoms known, in fact the symptoms is how they make money.
Rootkits generally cause google redirects, display pop-up advertisements, or play audio adverts and other sounds. The malware author sells the malware to websites- the also can websites get paid to infect machines - people pay the malware author, and the websites, to have the malware redirect/display advertisements for their own website or products.
You're partially correct that it is a driver problem. Rootkits work by patching legit microsoft drivers which load during the kernal phase. Consequently, the malware loads very early on in the boot sequence, and well before onboard AV.
A slow computer is a common symptom in a rootkit infection. Malware is not tested against all types of hardware, and all possible drivers. Frequently it doesn't run "perfectly", and will have a huge effect on the performance of the computer.
Both of these symptoms are sterotypical of a specific rootkit which infects the MBR. Non malicious driver problems do not cause random music to play from a computer.
In the thread at TSF which is currently ongoing, our tools show traces of a rootkit. Very specific MBR malware removal tools are not running. Specific tools which are used to deal with this type of infection are being targeted by the malware, a tactic frequently employed by advanced rootkits.
I deal with advanced malware every day, this is malware.
OP
- Messages
- 626
- Name
- Adam
- Edit My Images
- Yes
I do apologise for the impression of instant messaging. ( it was only two posts though )
I can provide all the steps taken to fix the problem.
To the posters who didn't agree with " someguy " , it was actually the rootkit causing the problem, as after removing it the problem has been fixed.
Last edited:
They are also symptoms of a hardware/driver problem. It's possible/likely that the intermittent freezing occurred when the browser was attempting to render a flash object. Occam's razor!
I'm not saying it *isn't* a rootkit virus, I am just saying that based on the evidence posted by the OP, it could be a number of things....and in my opinion it is more likely to be a hardware/driver fault, although I am willing to be proved wrong, I'll be interested to see if the 'infection cleansing' solves the OP's issues.
- Messages
- 9,438
- Name
- Andy
- Edit My Images
- Yes
Looks like a virus/rootkit to me: http://www.techsupportforum.com/for...ing-random-music-internet-slowing-605324.html and it looks like fixxing the MBR cured the problem.
Whether it was a rootkit (something that allows someone else to command your PC to do things remotely) or a hard to get rid of virus will be buried in the logs (which I can't see as I'm not registered on that forum).
What's clear is that either the recovery disks are infected or the "destructive restore" doesn't destructively restore everything it needs to in order to remove a virus like this.
Whether it was a rootkit (something that allows someone else to command your PC to do things remotely) or a hard to get rid of virus will be buried in the logs (which I can't see as I'm not registered on that forum).
What's clear is that either the recovery disks are infected or the "destructive restore" doesn't destructively restore everything it needs to in order to remove a virus like this.
Had a look on there....what virus was it then? Still interested to see if it's resolved. Would love to know the name of this virus that someone put so much effort into writing only to play some random music at people!
Rootkits don't by definition give someone command of your PC btw, they are just a sub-species of virus that buries itself particularly deep in your system and is hard to shift.
Rootkits don't by definition give someone command of your PC btw, they are just a sub-species of virus that buries itself particularly deep in your system and is hard to shift.
It was already determined to be malware some time ago. Driver issues do not cause random music to be played. Freezing isn't specific to malware, but the symptoms reported together are.
Specific MBR tools not running, is also something that is highly suspicious if encountered.
A log early on in the thread shows traces of a rootkit.
Rootkit's aren't by definition malware. It's a piece of software that hides itself, whilst granting itself privileged access to the computer. Legitimate rootkits exist, but it's a technique most commonly associated with malware.
The issue now appears to be resolved, the user hasn't experienced the same symptoms since and tools that previously would not run are now working correctly.
The MBR was infected, I didn't get the MBR analysed as there was no particular need to as it was clearly infected, however the rootkit in question was likely a recent version of Whistler or TDL.
The tracks don't get chosen by the malware author usually. The malware gets sold, and audio advertisements are put into the malware - that's the point of the tracks. As this malware seems fairly new, this may have been a "test" version, or an attempt to get the malware widespread before selling copies. Malware can update itself, in this case it's unlikely the only component originally was the MBR infection, but subsequent reinstalls have only left that part of the infection intact.
I didn't intend this thread to continue after the user accepted my help on TSF, it would be completely unprofessional of me to offer full malware support on this forum. All the information to diagnose the issue correctly as malware, is displayed in this thread. If you didn't get it from that, none of the info in the TSF thread would have helped you further.
Many websites still play irritating music at people via Flash, and a system that is suffering from bad sectors in the swap file could cause those symptoms described. Have seen many glitching systems freeze up while stuck playing back audio that have been nothing to do with viruses.
Still, in this case, apparently it was, I'm glad the OP got his PC sorted out
OP
- Messages
- 626
- Name
- Adam
- Edit My Images
- Yes
I'm pleased to say, after removing the rootkit all is well.
I did have a problem shortly after though. What we believe was a failed windows update managed to corrupt a file or two which wouldn't let me access the internet, and some programs wouldn't open. There was also a start-up problem.
Re-installed it ( after removing rootkit ) and it's fine now though..
Let's hope i don't get any more corrupt files or anything!
I did have a problem shortly after though. What we believe was a failed windows update managed to corrupt a file or two which wouldn't let me access the internet, and some programs wouldn't open. There was also a start-up problem.
Re-installed it ( after removing rootkit ) and it's fine now though..
Let's hope i don't get any more corrupt files or anything!