Computer won't turn on - reboot after XP logo

Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

I cannot get my computer to turn on. It goes through all the initial boot
screens, but when it reaches the windows loading screen, the system will
reboot. It will ask me each time if I want a standard boot, last known good
config, safe mode, etc. but none of these options will work. I suspect a
virus but I have no way of getting into the computer to run a scan and remove
it.
7 answers Last reply
More about computer turn reboot logo
  1. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
    <Ajguy@discussions.microsoft.com> wrote:

    >I cannot get my computer to turn on. It goes through all the initial boot
    >screens, but when it reaches the windows loading screen, the system will
    >reboot. It will ask me each time if I want a standard boot, last known good
    >config, safe mode, etc. but none of these options will work. I suspect a
    >virus but I have no way of getting into the computer to run a scan and remove
    >it.

    Have you recently made any changes to the RAM in this computer?
  2. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Nope, in fact, not a single change was made. I just found the computer stuck
    in this reboot cycle when I went to use it two days ago clear out of the blue.

    "<----- Which Way ----->" wrote:

    > On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
    > <Ajguy@discussions.microsoft.com> wrote:
    >
    > >I cannot get my computer to turn on. It goes through all the initial boot
    > >screens, but when it reaches the windows loading screen, the system will
    > >reboot. It will ask me each time if I want a standard boot, last known good
    > >config, safe mode, etc. but none of these options will work. I suspect a
    > >virus but I have no way of getting into the computer to run a scan and remove
    > >it.
    >
    > Have you recently made any changes to the RAM in this computer?
    >
  3. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Ajguy,

    It sounds like you have the W32/IRCbot.worm!MS05-039 worm identified
    08/16/2005. Check out the "Booting Problem" thread in the Windows XP Help
    and Support newsgroup started at 8/19/2005 4:53 PM PST/

    CurtB

    "Ajguy" wrote:

    > Nope, in fact, not a single change was made. I just found the computer stuck
    > in this reboot cycle when I went to use it two days ago clear out of the blue.
    >
    > "<----- Which Way ----->" wrote:
    >
    > > On Fri, 19 Aug 2005 12:42:03 -0700, "Ajguy"
    > > <Ajguy@discussions.microsoft.com> wrote:
    > >
    > > >I cannot get my computer to turn on. It goes through all the initial boot
    > > >screens, but when it reaches the windows loading screen, the system will
    > > >reboot. It will ask me each time if I want a standard boot, last known good
    > > >config, safe mode, etc. but none of these options will work. I suspect a
    > > >virus but I have no way of getting into the computer to run a scan and remove
    > > >it.
    > >
    > > Have you recently made any changes to the RAM in this computer?
    > >
  4. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    I read the message you refered me to. I tried Disable automatic restart on
    system failure and got the following errors at a blue screen:

    PAGE_FAULT_IN_NONPAGED_AREA

    *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)

    Now I understand this to mean that whatever data that is in the thirs hex
    code is tring to be written to the first hex code and that's what's causing
    the trouble. Problem is, I have no idea what to do about it. Safe mode will
    not turn on, succumbing instead to the reboot cycle. I actually am able to
    run linux on the machine off of a LiveCD version and can access the hard
    drive (in fact, I'm typing this from the affected computer right now). I do
    not see the wintbp.exe file referenced for the virus anywhere, but that may
    not mean anything. Unless there's some other way to get windows to boot or if
    there's a way to fix it from linux, I'm running out of ideas.
  5. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    From McAfee:
    When the file is run the virus copies itself to the Windows System directory
    (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
    automatically by exploiting the MS05-039 vulnerability or by a person
    directly executing the worm.

    Registry keys are created to load the worm at startup:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Run "wintbp.exe" = wintbp.exe

    I'm not sure you will be able to acces this web site if you don't have
    McAfee.
    http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=135491

    Stinger
    Stinger has been updated to help detect and repair this threat.
    http://vil.nai.com/vil/stinger/

    I hope this helps. Good luck.

    "Ajguy" wrote:

    > I read the message you refered me to. I tried Disable automatic restart on
    > system failure and got the following errors at a blue screen:
    >
    > PAGE_FAULT_IN_NONPAGED_AREA
    >
    > *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
    >
    > Now I understand this to mean that whatever data that is in the thirs hex
    > code is tring to be written to the first hex code and that's what's causing
    > the trouble. Problem is, I have no idea what to do about it. Safe mode will
    > not turn on, succumbing instead to the reboot cycle. I actually am able to
    > run linux on the machine off of a LiveCD version and can access the hard
    > drive (in fact, I'm typing this from the affected computer right now). I do
    > not see the wintbp.exe file referenced for the virus anywhere, but that may
    > not mean anything. Unless there's some other way to get windows to boot or if
    > there's a way to fix it from linux, I'm running out of ideas.
  6. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    No luck there. The first link you gave me is dead. Stinger won't run in
    Linux. I can browse to the windows/system32/ directory but do not see the
    WINTBP.exe file there. I don't know of anyway to edit the registry from
    Linux. I tried removing each of the two ram sticks in the machine to see if
    faulty RAM was the problem. Unless they are both bad, no luck there.

    "CurtB" wrote:

    > From McAfee:
    > When the file is run the virus copies itself to the Windows System directory
    > (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
    > automatically by exploiting the MS05-039 vulnerability or by a person
    > directly executing the worm.
    >
    > Registry keys are created to load the worm at startup:
    > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    > CurrentVersion\Run "wintbp.exe" = wintbp.exe
    >
    > I'm not sure you will be able to acces this web site if you don't have
    > McAfee.
    > http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=135491
    >
    > Stinger
    > Stinger has been updated to help detect and repair this threat.
    > http://vil.nai.com/vil/stinger/
    >
    > I hope this helps. Good luck.
    >
    > "Ajguy" wrote:
    >
    > > I read the message you refered me to. I tried Disable automatic restart on
    > > system failure and got the following errors at a blue screen:
    > >
    > > PAGE_FAULT_IN_NONPAGED_AREA
    > >
    > > *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
    > >
    > > Now I understand this to mean that whatever data that is in the thirs hex
    > > code is tring to be written to the first hex code and that's what's causing
    > > the trouble. Problem is, I have no idea what to do about it. Safe mode will
    > > not turn on, succumbing instead to the reboot cycle. I actually am able to
    > > run linux on the machine off of a LiveCD version and can access the hard
    > > drive (in fact, I'm typing this from the affected computer right now). I do
    > > not see the wintbp.exe file referenced for the virus anywhere, but that may
    > > not mean anything. Unless there's some other way to get windows to boot or if
    > > there's a way to fix it from linux, I'm running out of ideas.
  7. Archived from groups: microsoft.public.windowsxp.help_and_support (More info?)

    Here are a couple of sites that offer free W32 Spybot worm removal that I
    located by doing a Google search on "W32/IRCbot.worm!MS05-039". I don't know
    anything about these sites, so use your own judgement. Hopefully some
    removal techniques can be located that you can trust. Good luck.

    http://www.biosmagazine.co.uk/article.php?id=1975

    http://www.vnunet.com/vnunet/news/2141238/ircbot-worm-beats-sasser-record

    "Ajguy" wrote:

    > No luck there. The first link you gave me is dead. Stinger won't run in
    > Linux. I can browse to the windows/system32/ directory but do not see the
    > WINTBP.exe file there. I don't know of anyway to edit the registry from
    > Linux. I tried removing each of the two ram sticks in the machine to see if
    > faulty RAM was the problem. Unless they are both bad, no luck there.
    >
    > "CurtB" wrote:
    >
    > > From McAfee:
    > > When the file is run the virus copies itself to the Windows System directory
    > > (e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
    > > automatically by exploiting the MS05-039 vulnerability or by a person
    > > directly executing the worm.
    > >
    > > Registry keys are created to load the worm at startup:
    > > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    > > CurrentVersion\Run "wintbp.exe" = wintbp.exe
    > >
    > > I'm not sure you will be able to acces this web site if you don't have
    > > McAfee.
    > > http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=135491
    > >
    > > Stinger
    > > Stinger has been updated to help detect and repair this threat.
    > > http://vil.nai.com/vil/stinger/
    > >
    > > I hope this helps. Good luck.
    > >
    > > "Ajguy" wrote:
    > >
    > > > I read the message you refered me to. I tried Disable automatic restart on
    > > > system failure and got the following errors at a blue screen:
    > > >
    > > > PAGE_FAULT_IN_NONPAGED_AREA
    > > >
    > > > *** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)
    > > >
    > > > Now I understand this to mean that whatever data that is in the thirs hex
    > > > code is tring to be written to the first hex code and that's what's causing
    > > > the trouble. Problem is, I have no idea what to do about it. Safe mode will
    > > > not turn on, succumbing instead to the reboot cycle. I actually am able to
    > > > run linux on the machine off of a LiveCD version and can access the hard
    > > > drive (in fact, I'm typing this from the affected computer right now). I do
    > > > not see the wintbp.exe file referenced for the virus anywhere, but that may
    > > > not mean anything. Unless there's some other way to get windows to boot or if
    > > > there's a way to fix it from linux, I'm running out of ideas.
Ask a new question

Read More

Computers Windows XP