why cant boot normally

[christine]

My xp, dont seems to be able to boot normally. So I did a chkdsk /r in the
Recovery Console, but this does not help.

I can F8>Advance boot menu>safe mode and clear temp files,defragmentation
etc but when I try to boot normally, it will boot to the stage where it will
show xp logo and then disappears and appears again with the led light moving
lef to right. (its seems to be restarting itself)

At Safe Mode, I run the AVG7.5 (free edition) it says
Boot sector of disk Reading error C:
Autorun.inf Virus identified Worm/Autorun.BD
C:\autorun.inf
and Instop and AVG and it says it fix an infection. So I reboot normalyy but
the symptons remains, I just cannot boot normally.

So at the moment running the AVG scan and let it finish. In the meantime,
can someone advice what can I do? Shall I just delete autorun.inf from c:\
?? TIA

 

[Uncle Marvo]

Shall I just delete autorun.inf from c:\
?? TIA

Yes. You may (probably will) have to do an attrib -a -s -h -r on it first
(in a command prompt).

 

[christine]

can you please show me rhe steps to do that, TIA

Yes. You may (probably will) have to do an attrib -a -s -h -r on it first
(in a command prompt).

 

[Uncle Marvo]

Command Prompt (in Programs|Accessories)

C:
CD \
attrib -a -s -h -r autorun.inf
del autorun.inf

(ENTER after each line)

HTH

 

[Gerry]

Christine

You should run AVG in Safe Mode rather than normal mode.

An explanation of the Worm -cannot locate one in AVG Encyclopaedia
http://www.sophos.com/security/analyses/viruses-and-spyware/w32autorunbd.html

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=143707

With regard to System Restore you will need to
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.aspx


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Gerry]

Will that solve the problem given what the Worm does?



~~~~


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[Uncle Marvo]

Yes, but then you have to get rid of the worm.

I've had a PC with it on, there's loads of info in the net about eradicating
it. Most of it works.

 

[christine]

At command prompt, it shows

c:\doc & setting\christine> cd\
c:\ >cd\ it still give me c:\>

c:\>attrib -a -s -h autorun.inf
c:\>del autorun.inf
c:\>exit

and reboot, its still the same situation. But firstly I dont know if I
follow yr steps correctly. which I it 'enter' after eah line/step

After the above, I try again and when I typed in attrib -a -s -h -r
autorun.if 'enter' it says file not found -autorun.inf

but it still cannot boot up normally.

 

[Uncle Marvo]

It sounds to me that although you have/had the Worm, you have removed the
autorun which will stop it booting normally. I suspect that the reason for
not being able to boot normally is something else like a driver.

Have you done a boot with logging and had a look at the log?

Is there anything suspicious in the registry under Run/RunOnce etc?

There are a couple of files that this worm copies itself to but most of the
antivirus stuff will disinfect these files as well.

 

[Gerry]

Christine

Have you run a full AVG scan in Safe Mode and turned System Restore On
and Off after doing so?


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~

 

[christine]

After the above, I run the AVG in Safe mode and now it does nto find these 2
items that it found initially that is

Boot sector of disk Reading error C:
Autorun.inf Virus identified Worm/Autorun.BD C:\autorun.inf

and I have uncheck everything in msconfig - still unable to start normally.
I have tried to restore to a number of points but the same situation persist,
guess will keep trying Restore point. TIA

 

[christine]

Think I will use the system recovery cd and save all the hassles of hunting
down the worms. Many thanks for all your help.

 

[Richard in AZ]

If you did not make any typo errors in this post, then you did in the command lines.
If the computer reported "file not found -autorun.inf" you put a - in front that should not be
there.
Command lines are unforgiving in respect to typo errors.

| At command prompt, it shows
|
| c:\doc & setting\christine> cd\
| c:\ >cd\ it still give me c:\>
|
| c:\>attrib -a -s -h autorun.inf
| c:\>del autorun.inf
| c:\>exit
|
| and reboot, its still the same situation. But firstly I dont know if I
| follow yr steps correctly. which I it 'enter' after eah line/step
|
| After the above, I try again and when I typed in attrib -a -s -h -r
| autorun.if 'enter' it says file not found -autorun.inf
|
| but it still cannot boot up normally.
|
| "Uncle Marvo" wrote:
|
| > Command Prompt (in Programs|Accessories)
| >
| > C:
| > CD \
| > attrib -a -s -h -r autorun.inf
| > del autorun.inf
| >
| > (ENTER after each line)
| >
| > HTH
| >
| > | > > can you please show me rhe steps to do that, TIA
| > >
| > > "Uncle Marvo" wrote:
| > >
| > >>
| > >> | > >>
| > >> > Shall I just delete autorun.inf from c:\
| > >> > ?? TIA
| > >>
| > >> Yes. You may (probably will) have to do an attrib -a -s -h -r on it first
| > >> (in a command prompt).
| > >>
| > >>
| > >>
| > >>
| >
| >
| >

 

[Gerry]

Christine

Using the System Recovery CD could lead to a lot of work. I would not do
that yet.

Access the Event Viewer System log in Safe Mode and post a copy of any
Error Reports as they relate to the most recent attempt to boot in
normal mode.

You can access Event Viewer by selecting Start, Control Panel,
Administrative Tools, and Event Viewer.

A tip for posting copies of Error Reports! Run Event Viewer and double
click on the error you want to copy. In the window, which appears is a
button resembling two pages. Click the button and close Event
Viewer.Now start your message (email) and do a paste into the body of
the message. Make sure this is the first paste after exiting from
Event Viewer.


--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~