Sign in with
Sign up | Sign in
Your question

Computer won't turn on - reboot after XP logo

Tags:
  • Computers
  • Windows XP
Last response: in Windows XP
Share
Anonymous
August 19, 2005 4:42:03 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I cannot get my computer to turn on. It goes through all the initial boot
screens, but when it reaches the windows loading screen, the system will
reboot. It will ask me each time if I want a standard boot, last known good
config, safe mode, etc. but none of these options will work. I suspect a
virus but I have no way of getting into the computer to run a scan and remove
it.

More about : computer turn reboot logo

August 19, 2005 11:59:27 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
<Ajguy@discussions.microsoft.com> wrote:

>I cannot get my computer to turn on. It goes through all the initial boot
>screens, but when it reaches the windows loading screen, the system will
>reboot. It will ask me each time if I want a standard boot, last known good
>config, safe mode, etc. but none of these options will work. I suspect a
>virus but I have no way of getting into the computer to run a scan and remove
>it.

Have you recently made any changes to the RAM in this computer?
Anonymous
August 19, 2005 11:59:28 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Nope, in fact, not a single change was made. I just found the computer stuck
in this reboot cycle when I went to use it two days ago clear out of the blue.

"<----- Which Way ----->" wrote:

> On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
> <Ajguy@discussions.microsoft.com> wrote:
>
> >I cannot get my computer to turn on. It goes through all the initial boot
> >screens, but when it reaches the windows loading screen, the system will
> >reboot. It will ask me each time if I want a standard boot, last known good
> >config, safe mode, etc. but none of these options will work. I suspect a
> >virus but I have no way of getting into the computer to run a scan and remove
> >it.
>
> Have you recently made any changes to the RAM in this computer?
>
Related resources
Anonymous
August 19, 2005 11:59:29 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Ajguy,

It sounds like you have the W32/IRCbot.worm!MS05-039 worm identified
08/16/2005. Check out the "Booting Problem" thread in the Windows XP Help
and Support newsgroup started at 8/19/2005 4:53 PM PST/

CurtB

"Ajguy" wrote:

> Nope, in fact, not a single change was made. I just found the computer stuck
> in this reboot cycle when I went to use it two days ago clear out of the blue.
>
> "<----- Which Way ----->" wrote:
>
> > On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
> > <Ajguy@discussions.microsoft.com> wrote:
> >
> > >I cannot get my computer to turn on. It goes through all the initial boot
> > >screens, but when it reaches the windows loading screen, the system will
> > >reboot. It will ask me each time if I want a standard boot, last known good
> > >config, safe mode, etc. but none of these options will work. I suspect a
> > >virus but I have no way of getting into the computer to run a scan and remove
> > >it.
> >
> > Have you recently made any changes to the RAM in this computer?
> >
Anonymous
August 20, 2005 12:59:03 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I read the message you refered me to. I tried Disable automatic restart on
system failure and got the following errors at a blue screen:

PAGE_FAULT_IN_NONPAGED_AREA

*** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)

Now I understand this to mean that whatever data that is in the thirs hex
code is tring to be written to the first hex code and that's what's causing
the trouble. Problem is, I have no idea what to do about it. Safe mode will
not turn on, succumbing instead to the reboot cycle. I actually am able to
run linux on the machine off of a LiveCD version and can access the hard
drive (in fact, I'm typing this from the affected computer right now). I do
not see the wintbp.exe file referenced for the virus anywhere, but that may
not mean anything. Unless there's some other way to get windows to boot or if
there's a way to fix it from linux, I'm running out of ideas.
Anonymous
August 20, 2005 2:29:01 AM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

From McAfee:
When the file is run the virus copies itself to the Windows System directory
(e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
automatically by exploiting the MS05-039 vulnerability or by a person
directly executing the worm.

Registry keys are created to load the worm at startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "wintbp.exe" = wintbp.exe

I'm not sure you will be able to acces this web site if you don't have
McAfee.
http://us.mcafee.com/virusInfo/default.asp?id=descripti...

Stinger
Stinger has been updated to help detect and repair this threat.
http://vil.nai.com/vil/stinger/

I hope this helps. Good luck.

"Ajguy" wrote:

> I read the message you refered me to. I tried Disable automatic restart on
> system failure and got the following errors at a blue screen:
>
> PAGE_FAULT_IN_NONPAGED_AREA
>
> *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
>
> Now I understand this to mean that whatever data that is in the thirs hex
> code is tring to be written to the first hex code and that's what's causing
> the trouble. Problem is, I have no idea what to do about it. Safe mode will
> not turn on, succumbing instead to the reboot cycle. I actually am able to
> run linux on the machine off of a LiveCD version and can access the hard
> drive (in fact, I'm typing this from the affected computer right now). I do
> not see the wintbp.exe file referenced for the virus anywhere, but that may
> not mean anything. Unless there's some other way to get windows to boot or if
> there's a way to fix it from linux, I'm running out of ideas.
Anonymous
August 20, 2005 1:13:01 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

No luck there. The first link you gave me is dead. Stinger won't run in
Linux. I can browse to the windows/system32/ directory but do not see the
WINTBP.exe file there. I don't know of anyway to edit the registry from
Linux. I tried removing each of the two ram sticks in the machine to see if
faulty RAM was the problem. Unless they are both bad, no luck there.

"CurtB" wrote:

> From McAfee:
> When the file is run the virus copies itself to the Windows System directory
> (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
> automatically by exploiting the MS05-039 vulnerability or by a person
> directly executing the worm.
>
> Registry keys are created to load the worm at startup:
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
> CurrentVersion\Run "wintbp.exe" = wintbp.exe
>
> I'm not sure you will be able to acces this web site if you don't have
> McAfee.
> http://us.mcafee.com/virusInfo/default.asp?id=descripti...
>
> Stinger
> Stinger has been updated to help detect and repair this threat.
> http://vil.nai.com/vil/stinger/
>
> I hope this helps. Good luck.
>
> "Ajguy" wrote:
>
> > I read the message you refered me to. I tried Disable automatic restart on
> > system failure and got the following errors at a blue screen:
> >
> > PAGE_FAULT_IN_NONPAGED_AREA
> >
> > *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
> >
> > Now I understand this to mean that whatever data that is in the thirs hex
> > code is tring to be written to the first hex code and that's what's causing
> > the trouble. Problem is, I have no idea what to do about it. Safe mode will
> > not turn on, succumbing instead to the reboot cycle. I actually am able to
> > run linux on the machine off of a LiveCD version and can access the hard
> > drive (in fact, I'm typing this from the affected computer right now). I do
> > not see the wintbp.exe file referenced for the virus anywhere, but that may
> > not mean anything. Unless there's some other way to get windows to boot or if
> > there's a way to fix it from linux, I'm running out of ideas.
Anonymous
August 20, 2005 4:05:06 PM

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

Here are a couple of sites that offer free W32 Spybot worm removal that I
located by doing a Google search on "W32/IRCbot.worm!MS05-039". I don't know
anything about these sites, so use your own judgement. Hopefully some
removal techniques can be located that you can trust. Good luck.

http://www.biosmagazine.co.uk/article.php?id=1975

http://www.vnunet.com/vnunet/news/2141238/ircbot-worm-b...

"Ajguy" wrote:

> No luck there. The first link you gave me is dead. Stinger won't run in
> Linux. I can browse to the windows/system32/ directory but do not see the
> WINTBP.exe file there. I don't know of anyway to edit the registry from
> Linux. I tried removing each of the two ram sticks in the machine to see if
> faulty RAM was the problem. Unless they are both bad, no luck there.
>
> "CurtB" wrote:
>
> > From McAfee:
> > When the file is run the virus copies itself to the Windows System directory
> > (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
> > automatically by exploiting the MS05-039 vulnerability or by a person
> > directly executing the worm.
> >
> > Registry keys are created to load the worm at startup:
> > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
> > CurrentVersion\Run "wintbp.exe" = wintbp.exe
> >
> > I'm not sure you will be able to acces this web site if you don't have
> > McAfee.
> > http://us.mcafee.com/virusInfo/default.asp?id=descripti...
> >
> > Stinger
> > Stinger has been updated to help detect and repair this threat.
> > http://vil.nai.com/vil/stinger/
> >
> > I hope this helps. Good luck.
> >
> > "Ajguy" wrote:
> >
> > > I read the message you refered me to. I tried Disable automatic restart on
> > > system failure and got the following errors at a blue screen:
> > >
> > > PAGE_FAULT_IN_NONPAGED_AREA
> > >
> > > *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
> > >
> > > Now I understand this to mean that whatever data that is in the thirs hex
> > > code is tring to be written to the first hex code and that's what's causing
> > > the trouble. Problem is, I have no idea what to do about it. Safe mode will
> > > not turn on, succumbing instead to the reboot cycle. I actually am able to
> > > run linux on the machine off of a LiveCD version and can access the hard
> > > drive (in fact, I'm typing this from the affected computer right now). I do
> > > not see the wintbp.exe file referenced for the virus anywhere, but that may
> > > not mean anything. Unless there's some other way to get windows to boot or if
> > > there's a way to fix it from linux, I'm running out of ideas.
!