Problems? See this thread at archive.org.
Quick Update:
Nuke, think you are onto something here... Don't want to jinx it.. but..
First time in a long time, went to sleep, and woke up to an unfrozen, un-crashed and un-powered down laptop today.. Not a single error in event log since turning off cpu idle state.
Can it really be some amazingly simple, and unbelievably stupid, detail (missed by both Asus and Intel), that the random crashes and lock-ups are caused by the stupid C1E idle?
If I hadn't seen your post, and then saw how pervasive it is, I wouldn't even have this small victory. Thanks, and hope it sticks.
Dave
-
Thx for the heads-up, I added it on the Driver page
-
Just giving an update here. Two weeks ago I was still getting daily freezes and bluescreens despite a lot of attempts to fix them, but since I installed the KB2529073 update ninrocket suggested they have seemed to stop.
I'm not sure if this helped to fix the issue but I also uninstalled the usb controllers and let them reinstall. I'm also using the Intel Inf and the non-park adjustment, but I was still getting freezes when I installed/enabled them.
Now I've been 2 weeks without a single hard freeze. Still not sure if its another placebo effect, so I did wait till the second week, I want to see if this patch has fixed the problem for anyone else, so we can finally celebrate.
-
Morning Nuke,
Nuke, as between us, and many many others, we have explored just about all things that would 'naturally' be occurring to cause these issues, let me perhaps turn this another way.
Quick update to my post from Oct, (been very deep into diagnosing this box ever since) and this is the new direction. I have been having absolutely Absurd malware issues. This all began in the summer, and is still going on now. I have done, man, can't even recall now, but at least 15-20+ Full, Fresh, Clean installs of Windows on this machine. I have engaged assistance from some of the brightest minds I have access to, from Kaspersky and BitDefender multi-tier tech support, to Bleeping Computer Senior Instructor and highly respected member of the malware tech community. All have come to the same conclusion, there isn't a report of anything to be found... however, the behavior of the machine is unbelievably suspect.
From immediately after install, cascades of 'special user' accounts created, event reporter service being shut down for 5 minutes here and there, firewall closing and reopening, messages from firewall being quashed, services being 'hijacked' and admin account not even able to take ownership, let alone start/stop or disable the service.. to MMC access being denied, ports opened to all, no auth required, registry keys/branches being denied to admin account, to ultimately seeing all of my accounts either password locked, or completely deleted, no entrance back into OS...
Oh, and all of this taking place while all of the 'reports' say everything here is fine and dandy... Seriously, this is beyond messed up. What I'm trying to get at, is I think there may be a Major Vulnerability either in Win7, which I deem highly unlikely, or in G73J boxes somewhere, much more likely. Could be a driver, a hardware component, firmware, but something is there.
Now, it could again, just be me and my box that have some sophisticated piece of really nasty code hidden, but seriously, I am a ZERO value target, I have no financial assets of any value, no CCs to hijack and run around the world on, credit is mediocre, so noones getting an amex black on me... and don't work in any sensitive area.
So, there is no reason to target me so voraciously, and at this point, it would have to be actual targeting, no? I have changed MB, HD, Updated BIOS, 203, 209, 212, installed from 3 separate OS disks, factory, regular and with SPK1, and each and every time, the results are the same. I have blown out the hdd, boot sector, zero'd out 5 levels deep. Again, some of the top people have 'concluded' there is nothing here, but cannot explain for a moment the malicious behaviors exhibited.
Can anyone of you remember a time when you restarted your computer to find all of your accounts with incorrect passwords? Even an account you created just before that very reset... Can any of you remember logging in to find all of your accounts gone? Are you locked out of services? Is your Security branch of your event viewer locked, access denied? Are normal tasks disabled, while other auditing tasks created? Do you have access to Group Policy Service, can you disable if you wanted to? Dcom? Task Scheduler? RPC endpoint, Plug and Play? These 5 are always denied to me, even from the moment of fresh install, and basically they are the keys to the kingdom of the OS, no? What can I not do with master control of these? Can't think of a thing, I can do anything, load accounts, give and take away permission, load drivers, control access, secure communications, limit, modify comm, and set up an audit system to recognize any assault against me. Keys to the kingdom indeed, just sucks!
Here is a scary one: Have you ever gone into your BIOS and seen a wireless shell loaded into the boot order??? I mean, I don't have a clue how I would even go about doing that, yet there it was... As well, apprarantly it's about as difficult to hack Award BIOS's as it is to open your 5 year old's piggy bank. Turn it a few times until the plug underneath loosens, voila! I'm even afraid to reflash now, as the last time I tried to do it, with a fully legit file, used before, it crashed, brick time baby. I think that once into the bios, they mess with the flash mechanism, ensuring failure. Same goes for installing a password. Without knowing what's been done to my BIOS, I'm afraid of bricking this by meddling. (IN my OWN BIOS, so frustrating..)
Chastity, in case you are willing to read this book, you mentioned above a 'red button'?? to reset BIOS? I have not wanted to rip all the way into this box, but at this point, not a whole lot left to do... I understand the BIOS battery is soddered onto this board, but what, do they have a reset button to disconnect power instead of removing the battery? Do I have to go in through the top, ripping out keyboard, or is there access from the bottom? Thanks!
In the end, this malware doesn't exhibit the slightest care in the world if you reformat, replace, etc... again, not typical, most want to hide and come out to play when you're not there. This thing is like a a bull, aggressive, but you go your way, he goes his... Until you wave a flag in it's face, then it's on! And he's coming at you to run you out of the ring so he can go back to what he was doing, or just gore you and force someone else (reformat) to try him on for size... Nice metaphor, eh
Oh, and by the way, this has been taking place after I have unplugged ethernet, and REMOVED, physically, the atheros/wimax card, only little antenna wires left behind. (One thing I am not sure of, is if there is still a wifi ability imbedded to the board, maybe that is still allowing backdoor access.
I have auditing policies galore, none of which I can adjust, disable or delete, access denied. connection rules overriding all others, cannot change. the list goes on.
The reason I mention this, is seriously, how can this be happening, from a fresh reinstall, with Zero outside access to computer from hard or wireless connections, unless there is something physically on the board, either unadvertised, or offer some vulnerability, that these extremely smart and creative white-grey-and nasty black hats are able to use and abuse.
Are they piggybacking an unknown Bluetooth. Are they riding along the simple wireless mouse signal? Is there some combo of firmware/connections and components that are allowing a mock wireless connection? Is it some crazy set-up that happens to work particularly well with the G73s?
Yes, I sound a bit paranoid, but read what I have been through, for Months, the steps I have taken, and you tell me if it's not time to view the paranoid arena with due diligence, or should I just through this box away? Tell ya now, can't afford a replacement, so solving is the only alternative.
Prime example: Fresh Install factory settings: Trend Micro 2009 on board from start. (No, none, nada, Zero internet connections) It immediately begins flagging, and I mean from the moment I click the prog from first second on past logon screen, 20-30 unauthorized system setting changes (accounts modified, registry, etc). I tell it to reverse them, another dozen are found immediately after, but within seconds, the program is frozen, system is forced to restart (also captured in event log, system sent a stop order to the app, and a restart order to the OS). Restart, everything appears to be running hunky dory, but of course, no more unauthorized changes taking place... The program has been neutered, neutralized, rendered inert and useless.
This has happened to Bitdefender, AVG, Avast, Spybot, Adaware, Kaspersky, SuperAntiSpyware, etc etc. If the program can't be rendered useless, it's just killed entirely. It will never be allowed to be installed. Same for AV tools, good ones like Combofix are just derailed, and system responds aggressively, locking out more controls. Most are rendered innocuous. Oh, and I have found, while persuing the registry, instructions on how to reset all attributes on all system files to the same exact thing after use. I mean, even if I, myself, access them, I can pull up attrib's and it won't even show me as last user, nor willl the date accessed change. Always, always the same, which is why, I think, no reports ever find a thing...
So, in essence, what I am wondering, has anyone else seen anything funky like this taking place? Obviously not to this degree, or you would be at AV forums and security help teams like I have. But perhaps you haven't looked at your event logs recently, or checked your services permissions, tasks scheduled. I mean, I went the first 8 months of ownership without noticing a thing. It wasn't until it screwed up, and used too many of my resources that I was aware of it.
I always found it interesting I could never get above 4g of ram usage, no matter how far I pressed the system. Well, hard to do when there's a 2g Ramdrive created. (Using bst7 myself, 6g on board)
Anyway, having done just about anything and everything, with some of the top people in the field, currently being lifted beyond single technician, tier 2&3 at Kasperksy, being assigned to a team of their top folks. We're entered the rabbit hole now, and anything and everything is going to be examined.
The reason I post this back here, other than perhaps getting some insight from other folks who know this box better than I even after all the crud I've gone through, as well as to say, check your event logs, check your registry, check your users folder... do you have a duplicate default user folder? one hidden, one not? (red flag)
I think that many of the USB freezes, system freezes, may in fact be malware related, based on a system vulnerability. What hacker cares if they lock up our computer, if we're playing a game or working on a project... they don't. And they apparently don't give a hoot if we reformat, replace major components, etc... as they are able to just hop right back through whatever door is opened wide to them. I think we may, possibly, have a major USB hole, and that is why we have this problem so ridiculously more often than is possibly explainable, across almost all users, and apparently uncorrectable. Have you gone into device manager to see how many duplicate drivers you have in PnP (hidden devices). Especially for USB? Check for duplicates and running comm devices, bet you find some that really shouldn't be there if you are having unresolvable system problems.
Thoughts from a non paranoid person, believe it or not, but someone who has been forced to look outside the box, as all the usual suspects have been ruled out.
Hope you all have a great weekend.
Dave
G73JW Freezes when not in use
Discussion in 'ASUS Gaming Notebook Forum' started by nuke235, Apr 20, 2011.
