Is it a virus?

[Sharpy]

My system is randomly crashing from lockups to BSOD and random resets.
System :
K6-2 550, Gigabyte GA5 AX mobo, 256Mb ram, 13Gb HD, Win2K
I've been ruuning this system for about three weeks without problems
So far i've checked the memory and ran sfc but it still keeps crashing.
Could it be a virus or am i being nuked?
I've just installed Zone Alarm since this happend and i'm waiting to see if it crashes again.

Btw - Zone alarm picked up a prog trying to access the net called C:\Program Files\TimeSink\AdGateway\TSAdbot.exe now i know i didn't install it knowingly so could this be another spyware prog?

[Sharpy]

I just found out that TSAdbot.exe is part of MPlayer i gues i'm just getting paranoid again.

[socalgal]

Sharpy... I don't have this file, but look closely at that what's in that path's name: "AdGateway" "TSAdbot"..

What is this program TimeSink?

[This message has been edited by socalgal (edited 04-18-2000).]

[Brydon]

What vid card ya got as I heard that this mobo can't supply enough juice to some top end agp cards so this could be the problem. I have the same board with a savage4 and no problems.

[smokin1]

Here is a little info on that program for youTSAdbot (http://www.datafellows.com/v-descs/tsadbot.htm)

[Dave_H]

TimeSink is a company offering "free" software "With support and revenues from advertisers" (Yup, it's a spy).
TimeSink (http://www.mplayer.com/dev-zone/timesink.html)
Mplayer, should not be confused with Windows Media Player. Mplayer is a free game service that uses the adbot thing to open up connections to send out information so that advertizing servers can better target ads to you specificly.
Just like the whole Aureate, Advert.dll thing.
Dave

[krusty the klown]

You can also download a small file (~30kB) that detects and removes spyware from here:
http://grc.com/optout.htm

The program is written in assembly code, so doesn't need installing and runs very fast.

[Dave_H]

Thanks Krusty, http://www.sysopt.com/forum/smile.gif
Thats were I remember reading about this.
This is from Steve's site.

So, given that there are a few other similar situations brewing (notably with Timesink's tsadbot.exe program which also "phones home" on the sly, and which many people discover planted on their system) and unhappiness about something called "Comet Cursor", I decided to commit to providing a solution:
Dave

[neo_otyugh]

as Brydon said above, if you are using an agp vid card that may be a problem....i used to have that board and suuffered through a lot of that when using a viper v550 that was overclocked (worked fine at stcok though) and it got worse when i upped to a v770ultra...it would crash at random, or reset and it drove me nuts...if you have a PCI vid card then this is no help..

[Axel]

Could also be heat related - is the system running over 50C? - might be you need to add a fan or two -

Also - if you have the vid card packed in between two other PCI card, or covered in ribbon cables, it can heat up quite nicely & fail.

There are actually expansion slot fans out there to cool between expansion slots - you might look into one of those to ensure good ventalation -

A virus isn't out of the question - but I have other more likely suspects -

This adbot thing has got to go - I'm betting you have a bunch of other stuff running as well eating up your resources - had the system up 3 months - been downloading & installing things stead -

Boot your system - then pull up a task list and list everything that's running a few minutes after start-up. If you have more than, say, 6 items running after a cold boot, then you have too much running.

Additionally - you might consider adding RAM, or, if you have all your banks filled, buying new RAM with a higher speed rating in both mHz and ns. One typical system lock issue is having 2 or more different types of RAM in the system. Different RAM typically doesn't play nice together. Having the best RAM you can afford that the system can handle - all from the same manufacturer will typically be your best bet.

[Sharpy]

Thanks for the reply's
I checked out Timesink after zonealarm blocked it thats how i found it was part of mplayer and i've been useing optout every few days since reading about it on sysopt but it doesn't stop or remove this TSAdbot which is pretty strange seeing how steve gibson mentions this program.
My vid card is a V3 3000 and i've been using it for ages without a hitch, i've also got an expansion slot fan in next to it and 2 fans on the front of my case pulling air into my case.
I've had probs with cooling on machines before but all heatsinks are just warm to the touch on this one.
Since installing Zone alarm it seems ok but it's realy to early to tell so i'll get back when i've tested out a few other things.

[Ultima]

Hey Krusty,

I just downloaded optout from the link you gave.
Man, that is one quick little program you have there.
In about 5 to 10 seconds it completely scanned my full 18.2 disk, used for about 12Gb.

I mean 12Gb in 10 seconds, that is what I call pretty fast for such a small program.

Are you sure it is accurate??
Cause it sounds unbelievable.

Pim.

BTW, why does everybody keeps saying LOL??
What does it mean?? ( I know, I should know, but I don't so.....)

[Sharpy]

LOL = Laugh out loud

ACRONYMS (http://sharpy.cjb.net/stuff/acronyms.txt)

Edit - bad link http://www.sysopt.com/forum/smile.gif


[This message has been edited by Sharpy (edited 04-19-2000).]

[hd581]

Ok how are you supposed to use ETLA.

Extended Three Letter Acronym. I will ponder this for some time.

[Sharpy]

Sorry to keep wingeing on about this but the old BSOD got me again with a completely different error message this time something about win32.sys.

I really don't like giving up if i can help it, so formating is an absolute last resort.

This time it manage to do a memory dump and placed a file called pagefile.sys (393Mb)in my root, does anyone know if this is any use in diagnosing the fault?

Edit - i was winging instead of wingeing http://www.sysopt.com/forum/smile.gif



[This message has been edited by Sharpy (edited 04-20-2000).]

[Sharpy]

Well it look's like the old format and reinstall is gonna be the only answer as i've ran virus checks and scandisk and sfc
and installed Zone Alarm without any success so i guess thats it. http://www.sysopt.com/forum/frown.gif

This was one of my BSOD error codes incase anyone knows what it means:
*** STOP 0X000000D1 (0X00000000,0X00000002,0X00000000,0XBBCFA569) DRIVER_IRQL_NOT_LESS_OR_EQUAL
*** ADDRESS BBCFA569 BASE AT BBCE4000, DATESTAMP 38437F02-TCPIP.SYS