Computer won't turn on - reboot after XP logo

[Guest]

I cannot get my computer to turn on. It goes through all the initial boot
screens, but when it reaches the windows loading screen, the system will
reboot. It will ask me each time if I want a standard boot, last known good
config, safe mode, etc. but none of these options will work. I suspect a
virus but I have no way of getting into the computer to run a scan and remove
it.

 

[Guest]

I cannot get my computer to turn on. It goes through all the initial boot
screens, but when it reaches the windows loading screen, the system will
reboot. It will ask me each time if I want a standard boot, last known good
config, safe mode, etc. but none of these options will work. I suspect a
virus but I have no way of getting into the computer to run a scan and remove
it.

Have you recently made any changes to the RAM in this computer?

 

[Guest]

Nope, in fact, not a single change was made. I just found the computer stuck
in this reboot cycle when I went to use it two days ago clear out of the blue.

 

[Guest]

Ajguy,

It sounds like you have the W32/IRCbot.worm!MS05-039 worm identified
08/16/2005. Check out the "Booting Problem" thread in the Windows XP Help
and Support newsgroup started at 8/19/2005 4:53 PM PST/

CurtB

 

[Guest]

I read the message you refered me to. I tried Disable automatic restart on
system failure and got the following errors at a blue screen:

PAGE_FAULT_IN_NONPAGED_AREA

*** STOP: 0X00000050 (0XCD5C3001, 0X00000001, 0X806572E2, 0X00000000)

Now I understand this to mean that whatever data that is in the thirs hex
code is tring to be written to the first hex code and that's what's causing
the trouble. Problem is, I have no idea what to do about it. Safe mode will
not turn on, succumbing instead to the reboot cycle. I actually am able to
run linux on the machine off of a LiveCD version and can access the hard
drive (in fact, I'm typing this from the affected computer right now). I do
not see the wintbp.exe file referenced for the virus anywhere, but that may
not mean anything. Unless there's some other way to get windows to boot or if
there's a way to fix it from linux, I'm running out of ideas.

 

[Guest]

From McAfee:
When the file is run the virus copies itself to the Windows System directory
(e.g. C:\Windows\System32\ on Windows XP) as WINTBP.EXE. The file can be run
automatically by exploiting the MS05-039 vulnerability or by a person
directly executing the worm.

Registry keys are created to load the worm at startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run "wintbp.exe" = wintbp.exe

I'm not sure you will be able to acces this web site if you don't have
McAfee.
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=135491

Stinger
Stinger has been updated to help detect and repair this threat.
http://vil.nai.com/vil/stinger/

I hope this helps. Good luck.

 

[Guest]

No luck there. The first link you gave me is dead. Stinger won't run in
Linux. I can browse to the windows/system32/ directory but do not see the
WINTBP.exe file there. I don't know of anyway to edit the registry from
Linux. I tried removing each of the two ram sticks in the machine to see if
faulty RAM was the problem. Unless they are both bad, no luck there.

 

[Guest]

Here are a couple of sites that offer free W32 Spybot worm removal that I
located by doing a Google search on "W32/IRCbot.worm!MS05-039". I don't know
anything about these sites, so use your own judgement. Hopefully some
removal techniques can be located that you can trust. Good luck.

http://www.biosmagazine.co.uk/article.php?id=1975

http://www.vnunet.com/vnunet/news/2141238/ircbot-worm-beats-sasser-record

 

[Guest]

Hi Ajguy...I am having the same problem you are. Did you manage to fix this
somehow? My problem just started today. Very frustrating...I think I may be
going to Linux soon....more stable!