Random Freezing

Hi, Sorry to hear of the problems with your machine. If the problems only started, when you updated your computer with Norton, then it would normally be recommended that you uninstall (Make sure your machine is disconnected from the Internet and you have previouslyvisited Symantec's website to download the latest version of their uninstaller, (for Norton 360) do a disc clean up a reboot and a reinstall. However before you try this have you used the System Restore facility to restore your computer to a time prior to the troubles starting? If not this might be a first move for you to consider. Regards paws

I restored the system to a week ago as you suggested and that didn't solve the problem so I uninstalled and reinstalled the Norton 360. This didn't solve the problem either so I ran another comprehensive system scan through Norton as I did after initial installation. The difference this time is that it detected a virus called "downloader". I'm curious why it didn't pick it up the first time? Since getting rid of that little monster, it seems to be working better. It still freezes occasionally, but comes out of it after a minute or two so I don't have to restart. Any more ideas? Thanks again for your suggestions and looking!

My success was short lived! Shortly after my last post, the computer froze and I had to do the hard shut down (holding the power button in). Upon restart, I received a message in DOS form saying there was a "PCI device on Motherboard). I hit F1 to continue and the system started up and said that it found new hardware and pulled up the installation wizard, which I cancelled out of. When I restarted however, it would not let me to connect to the internet. After about 6 tries of shutdowns and restarts, I finally was able to not get the hardware message and get online. By the time I got to this forum though the system froze again, hence I'm now working from my desktop instead of the laptop. I have DSL and have noticed that there is a definative link between when I receive the "new harware found" message, and when I don't. When I receive the message, I am unable to connect to the internet no matter if I try to use wireless or if I hook up the big cable to the laptop. It's like it doesn't recognize it. I decided to run another comprehensive scan with Norton again to see if it would find anything, but it came up blanks except that it showed over 3000 files in my temp folder. Keeping in mind that I just ran Norton yesterday, and found it strange to have so many files show up since I have only been to two websites and spent very little time online. Thanks again for looking, Bob and Cay

Hi Bobncay, This curious as you say! The fact that Norton picked up a downloader after you restored your system to an earlier date, but did not detect it earlier, tends to suggest that your system Restore point was maybe infected. However at this stage please DO NOT turn off system restore to flush the Restore points as even an infected one can sometimes be better than no restore points at all! I think the next steps should be: 1 Next time the new hardware wizard appears, go along with it follow its recommendations and see how you go: 2 Visit the malware removal forum; post an HJT log and let the malware removal experts there, see what's going on inside your machine and if the infection is still present. If the issues with your machine remain after it has been declared clean by the malware removal expert, please post back here in this thread and we will do our best to help. I will not give directions on how to download, run, an post an HJT log in the Malware removal forum, as I see you last visited that forum in March. Regards paws

Hi Bob and Cay.
Hi Paws.

I wonder if your machine is showing any Warnings in Device Manager (red or yellow signs next to Device items?
I also wonder if you have an item in Device Manager labled "Other" or "Other Devices".

Device Drivers do occasionally get corrupted, so machines may detect that there is a device without a recognizable installed driver…. Thus "found new hardware".

If you are able to determine what the Device is in Device Manager, it might help you to properly install it and be done with the alert.

Click on "Remove" for any items with yellow or red warnings, then Reboot your machine.
Windows will detect the removed device as New Hardware, and will attempt to install a fresh copy of the necessary Driver.
______

As to the "downloader" detection.
As good as Norton is, it might be detecting something that is:
1. a normal safe download or update installation protocol for an application you intend to have
2. a piece of malware that would better be removed using a strong AntiSpyware like AVG AntiSpyware or Trojan Hunter
(I also like the free (and safe) tool from Sophos, that can be downloaded and run from CD. The scan/remove run takes between 10 to 30 minutes for either of the three above in my experience)
AVG AntiSpyware http://free.grisoft.com/doc/download-free-…pyware/us/frt/0
Trojan Hunter http://www.misec.net/trojanhunter/ (30 day limited trial)
Sophos offers a free "emergency copy of their downloader/trojan removal utility"
Here: http://www.sophos.com/support/disinfection/worms.html
(download for Windows XP is about 1/2 way down the linked page)

* Windows 2000/XP/2003
1. Download an emergency copy of SAV32CLI. On an uninfected Windows computer, run this file to extract the contents into a SAV32CLI folder on a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session).
2. Restart the computer in Safe Mode. Go to Start|Shut Down. Select 'Restart' from the dropdown list and click 'OK'. Windows will restart. Press F8 when you see the following text at the bottom of the screen "For troubleshooting and advanced startup options for Windows 2000, press F8". In the Windows 2000 Advanced Options Menu, select the third option 'Safe Mode with Command Prompt'.
3. At the infected computer, place the CD in the CD drive (D: in this example).
At the command prompt type

D:

to access the CD drive. Type:

CD SAV32CLI

Then type:

SAV32CLI -REMOVE -P=C:\LOGFILE.TXT

to remove the worm.
4. Before leaving Safe Mode, edit any registry entries mentioned in the worm analysis recovery instructions.
5. If problems persist, contact support.

Any of the above three are Free and Safe to use.
__________

As for your problem getting connected online:

Start - Run - (type)cmd
this will bring up a DOS Box display with a blinking cursor

At the blinking cursor type the following commands in sequence, waiting for the procedures to complete before entering the next command:

ipconfig /release - enter <– notice the required space before the "/"
ipconfig /renew - enter <– notice the required space before the "/"
ipconfig /flushDNS - enter <– notice the required space before the "/"

(Each of the above ipconfig steps may take from a few seconds to a minute or so to complete.
Wait for the blinking cursor to return before moving on to typing the next command.)
___________

If the above does not remedy the problem, try this Next:
go here:
http://files.webattack.com/localdl834/WinsockxpFix.exe
Download Winsockxpfix.exe to your Desktop

Run Winsockxpfix.exe

For additional information about Winsockfix.exe you may read, here:
The graphical presentation walks the user through the entire process.
http://www.iup.edu/house/resnet/winfix.shtm

After you use the above procedures, it may still be a good idea as Paws recommended, to post a HJT Log over in Malware Removal to clean up any other baddies that may have slipped in.

Best Regards

Thank you Paws and Doug. I will post my HJT log for the experts to decipher! As far as following the directions on the "found new hardware" message, I will be unable to do them since it wants to go out to the web to look for the software to go with it. What I've learned so far is that if I get the message, I can't get to the web and the laptop does not lock up. If I don't get the message, I can get online, but only for a very short time before the system locks up. Kind of a danged if you do, danged if you don't scenario. I will try the suggestion you two laid out, and post back my findings. Thanks again! Bob and Cay

Good afternoon Paws and Doug. Writing to you from my desktop. Starting to think the laptop might serve better as a paper weight! So far, no success, but I have come to one conclusion; whenever I am able to go online is when the freeze-ups occur. If I stay disconnected from the internet, the laptop does not freeze up. As to your suggestions here is what I found: In device manager, there is no warnings however there is a listing for "other devices" as you suspected. If you expand that listing, there are two yellow question marks that appear. As to the anti-spyware software, I ran the AVG scan since I was a bit familiar with the program from my last bout of problems in March of this year. It detected 6 different cookies of low risk, 1 program of high risk called "Not-A-Virus popcap loader" and 1 of low risk with the same name; "Not-A-Virus popcap loader". I then ran the Winsock fix you recommended. As for getting online when I can't, I tried the commands you listed in DOS, but it still didn't let me on. I downloaded my HJT log and will post that in the Malware section shortly. thanks again, Bob and Cay