Strange Shutdown - Suspect Malware

Hi Guy's,

The question is "IS there a Malware that will shut off a computer.. that clean off / like pulling the plug?"

Was helping a friend with their computer last night here is the problem we started with..

Sloooow operation, When using IE some websites are not accessable.. and when attempting to DL some programms (like Spybot, or even doing a AV update) the system switches off..
When I was told about this the switch of was described as "crashes" .. so I only turned up with software tools.. system is unable to complete a NAV scan..
This history is from memory.. left my notes with the machine

1/ Installed Spybot SnD:
Couldn't update.. Disabled a family of sus exe's that were running, and some known ok exe's.. still couldn't update.. Managed to start a scan picked up a few sus entries then Click Off.. the bloody system just clean switched off..
2/ Restarted in safe mode:
did a quick HJT scan.. manualy removed some Blaze media crap. Now started the Spybot scan. got passed the inital few hundred items scanned.. had a small list of 6 or so I stopped the scan and removed components of what I had just removed.. restarted the scan.. and kept doing this until I had 200 or so items removed.. BUT Spybot scan could only reach 70% or so and the system would die.
3/ REstsrted in normal mode: Installed Adaware..
Was able to update it (oh and could now update Spybot and NAV) Scann by Adaware went full course.. removed another 30 items (mainly Cookies and more parts of what Spybot had removed)..
Tried Spybot.. fouund a couple more items .. but dies at about 70% (that is computer shut off)
4/ Defraged HDD restart clean TIF, Win Temp, Win Prefetch, empty recycle Bin.. Defrag, restart defrag
5/ spybot failed again at 70% (not this is on or about 10500 item of 15500, it could be 10200 or as late as 10600 but always about the 10500 mark)
6/ the cleaner.: good old moosoft..
Tried a scan in normal and in safe Mode.. System shuts of at around the 70% mark.. first time removed more crap, adware "trojans"all related to the earlier stuff..
7/ Checked the temp of the HDD and cpu temps.. (It is winter and the room temp was 15deg Celcius) none of the gear was even warm..

I didn't have a Meter with so I couldn't check the status of the PSU, The tone of the HDD changes just before the shut off, so I intend running a HDD test , as well as a full PSU test on the weekend..No visable funnies on the Mobo.. so a full hardware test may still be in order.. even a swap out of the RAM.. Oh and I failed to mention .. I will do a External scan of the HDD..ie test it in another system.. scan it from another OS..

As the problem is consistent with a point of operation in a program rather a thermal point.. I do consider a Malware problem as very likley, but not rulled out Hardware..

Any comments welcome..

Cheers

SASSER???

I had something similar recently....ended up being sasser.

Only way I could get some response was using the norton sasser removal tool.

I was then able to scan and clean all the other malware on the computer.

The sasser infection definately impeded my diagnostics.

HTHs
MLF

Sasser is nice about it, "shutdown -a" would take care of it. It also warns you, it wouldn't give you a hard shutoff IIRC.

Quote:

---

Sloooow operation, When using IE some websites are not accessable.. and when attempting to DL some programms (like Spybot, or even doing a AV update) the system switches off..

---

Quote:

---

2/ Restarted in safe mode:
did a quick HJT scan.. manualy removed some Blaze media crap. Now started the Spybot scan. got passed the inital few hundred items scanned.. had a small list of 6 or so I stopped the scan and removed components of what I had just removed.. restarted the scan.. and kept doing this until I had 200 or so items removed.. BUT Spybot scan could only reach 70% or so and the system would die.

---

Sounds like memory to me?

Try making a BartPE malware disc, put AV and adaware on it. If you still get problems, then you have identified the problem as hardware.

Could also be the Power Supply going bad. Although it doesn't explain the coincidence of shutting down when accesing certain websites, but its still worth a look.

Have you run chkdsk.exe ? waybe worth a try.

Greets,

I am yet to run any HDD test progs
did defrag.. managed to complete
turned off the "Automatic restart"option.. and no BSOD .. but the machine switches OFF anyhow..
PSU is still considdered,, as is RAM (and HDD)
It also died during a run of fxgaobot tool from symantec.. but no hints of it witha quick check of the reg in safe mode.. looking for items tha load with Explorer.. or load as explorer.. tried to spot some thing with Silent runners.. no joy there,

Will be back in front of the machine on saturday.. so will update then..

Cheers

Do you have a firewall? it could be possible that a hacker is using a backdoor to [gloworange]remotely[/gloworange] shutdown your comp. :)

Quote:

---

Do you have a firewall? it could be possible that a hacker is using a backdoor to
remotely

---

would have to be good.. I used the "Cable out of socket" Firewall for a few of the scanns
'
By this time tomorrow I should know some more..


Cheers

Quote:

---

Cable out of socket

---

Fastest kill all tcp connections i no of :D

I've encountered similar problems with systems infected with the W32/BLASTER virus. I couldn't update the antivirus over the web, because the system would reboot before the download or connection could be completed. Most systems gave a warning about an RPC failure, but I also encountered some systems that did not give any warnings before shutdown. You can look for entries in the eventlogs, stating that the shutdown was intiated by NTAuthority. (I think) Which would indicate a BLASTER infection.

Good luck Bubba.

overheat? does your motherboard has cpu overheat protection? wen u use too much and you have a cooling problem (such as a fan malfunction) your system use to show those symptoms..

just to add confusion..

Just finished a series of HDD tests.. HDD regen being run once.. the Maxtor Diag tool on 2 tests..

Run a The McAfee AV tools useing the Bart PE enviroment.. (that is the command line tool and the stinger) found more of the Adware..oh and a run of Adaware

Did a check of the SMART info.. and no outstanding info.. The HDD is a MAxtor..

Monitored the PSU during one of the events 12V was on 11.95-8V and the 5V was 5.15V until the shut-off

Currently running the Memory test.. MEMTEST.. 9 passes and clear so far..

Todday I have had a change in symptoms.. the machine will pass the Spybot scan 2 out of 5 attempts .. COLD or HOT.. my goodness the HDD was sitting on 25deg celcius on one fail and 45deg on another .. and worked with the hdd at 55 and 20.. temp? .. nah

memory? perhaps, hdd electronics ..perhaps,.. psu..dunno.. BIOS.. maybe..(not cleared the CMOS yet).. BTW room temp at the moment 10degs celcius..

I'm off to bed.. the heater aint working..

BTW: spyware found thus far
180 Solutions
Bargain Buddy
BlazeFinds/Media
VX2
WhenU
ClickSpring
Claria



Cheers

Well, I've done a bit of troubleshooting in my time and problems like these sometimes do require somewhat drastic measures to eliminate what it's not. For this particular situation, this is what I'd do. I'd yank the mobo (with that cpu and whatever memory) out and hook it up to another power supply right on the bench. Your choice whether to include the original video card or throw in some other one.. Put in no other cards (like NIC, modem or sound) Get a fresh HDD and install an OS and run it thru it's paces with a few benchmarking programs like Sisoft Sandra, PCMark04, prime95.. or run folding@home or some intensive games.. If all seems well, start putting things back to what they were bit by bit.. if it fails soon of course you'll have a better idea about what the problem might be..

Sounds to me like you'll need to take this box home with you.. can you come up with a temporary box for this user to use in the meantime ?

If I were to just wager a guess, I'd say.. PSU, or mobo itself is at fault and not anything software or HDD related.

best of luck..

Und3ertak3r you might check your config (msconfig) for a start up item 'dumpprep 0 -k'. I have had to remove this item because it had gotten stuck in the configuration after a system failure.

This sounds like what happened to me last fall and I ended up needing a new hard drive. My fan wasnt working properly and caused a melt down of the drive. Got a new HD and fan works like new again. All the weird shutdowns programs only part working sounds just like mine.

Status:

TEsted system with New HDD: Imaged the Installation across from the friends HDD.

Fault continued:


Tested with NEW RAM: Fault continued

Tested with known Good HDD: Fault Continued:

Please note If I hear Sasser or Blaster I will scream: This is not a admin shut down
Heat related..?? could be.. BUT problem will occure when Cold and when system warm:
also note: Room temp today is 15deg Celcius:
to get the fault to appear 9 times out of ten All i need to do is get Spybot to do a scann: but it will happen during The Cleaner scanns 3 out of 4, and NAV scans 1 in 3: and adaware 1 in 5:
Now will this happen when I used BARTPE enviroment: NEVER not once: but I don't have a PE version of Spybot.. but the 10 runs of Adaware never failed.. but then I could only do a c: drive scann of its files it can't scan the original registry..

I am about to do a clean install on the test HDD and install NAV 2004 and Spybot.. and see the results:
the only thing left is the CPU and the MObo.. modem and CDROM are disconnected..

Oh.. Clean CMOS?.... still faults..
remove NAV.............. still faults..

Just starting the clean install (pity this isn't one that I sell.. I would have a Image CD for it.)

Cheers

As it shuts down during scans, this could indecate a heat problem with the processor. Scans are pretty intensive on processor. I would look into make sure the heatsink is mounted correctly and seated on the proper paiste (i have seen one fixed with clear silicon) :) realy. See if it is overly covered with dust, a quick plast of air may help.

If MsM or Neg want to .. this thread now belongs in the Hardware section..

Quote:

---

overheat? does your motherboard has cpu overheat protection?

---

Well You were correct cacosapo.and jinxy...helplesslyhopin was close... but this is the middle of winter.. and my darn room temp is below 15 degs celcius
..
I kept checking the Heat sink temp.. Because of the design of the Back mother board mount I didnt have access to the rear of the CPU.. I re read your post and it made sence.. the motherboard sensors were telling me normal to cool all the time.. my measurements agreed with that..

Problem was .. I decalred the fault to be motherboard/cpu after the clean install.. made it through the install but died when I did a spybot scan.... the not every time after the external clean made me more suspicious..

So I was pulling the machine apart to try sub parts to narrow the problem down..
one end of the Plastic frame cpu-hsf holder on the motherboard seemed"lose".. after removing the Heatsink and fan.. the cpu showed the clasic signs of poor heatsink contact.. dust on the CPU for over half its length.. and a stain on the good contact end...

2 of the retainer pins were broken.. as a temp job a couple of insulators and screws have been pressed into service to hold this plastic panel on the board..

Fired up the machine.. survived one spybot only scan.. now doing a spybot, sdaware, The Cleaner, NAV, oh and a defrag .. cpu is not getting below 90% use.. and the temp is upto 39 deg cel.. which was around the 22 to 27 before.. see it is cold so I didnt realy worry about the low temp..

So those who wer commenting TEMP TEMP.. you were right.. my excuse for saying you were wrong.. I am rugged up like an eskimo.. I would have followed through had it been summer and our normal 42 in the shade (that temp is celcius to all the Farenhiet dwellers).. ..


never had a problem with these brackets before.. so it would be interesting how these things will last..

Cheers.. and thanks to all that participated

and just for the exercise.. an image of the area in question..

Hi Undies,

My cousin (the physics professor) bought me a "Raytek MiniTemp" for Christmas..............laser guided spot temperature meter...............no idea what they cost but the damn thing has already saved about $800(AUS) in components, by showing up problems. I would strongly recommend that you invest in one mate!

He is over here for a holiday and has brought me a digital wireless thermometer...........it's 24.7 on my desktop and 17.7 out in the garden amongst my wife's lillies :D

Anyone going to write a tut on wardriving digital thermometers? :p

Cheers