windows registry

[brian]

I am running XP Professional and Norton. Ever since the
whole blaster worm business, I have noticed some strange
things. I have followed all the directions I could find
on the Microsoft and Symantec web sites hoping to solve
my difficulties. I am current on the security updates, I
have run scans, and have followed all the directions
posted.

When my computer is idle and I am not using it for
anything, it will sometimes still be 'cranking away' in a
pattern that is 'long, long, short'. Each crank takes
about a second, and the pattern repeats. Today it has
been doing this almost non-stop. The harddisk light on
my tower lights up and flickers with each 'crank'. It is
like it is performing the same work over and over. Could
it be generating IP addresses like the blaster worm.
What could this be?

I notice another symptom/problem, if I run a Norton scan
of my computer. The virus scan completes without
identifying any viruses. The Windows Registry scan that
follows cranks away for several hours and never
completes. I have to cancel the scan. Then it seems to
take forever to reverse whatever it was trying to do. Is
there a way to fix this? Is there a way to rebuild the
registry to eliminate my problems?

brian

 

[Steven L Umbach]

One a computer has been compromised there is no guarantee that the various fixes will
restore it to normal operations. One thing you might try is to disable the indexing
service and look in Task manager to see if there are any unusual processes listed or
hogging the cpu [it is normal to see system idle process high at times]. It is
difficult however to discern what may or may not be a normal process without a
reference "clean" like install to compare too. Running msconfig to disable [all or
selectively] startup programs may also help isolate problem process/application. I
would also run something like AdAware or Spybot Search and Destroy on it also. They
can detect various parasites that can cause problems that are not classified as a
virus and probably would not be detected by a virus scan.

http://www.windows-help.net/WindowsXP/tune-18.html
http://www.lavasoftusa.com/software/adaware/
http://spybot.eon.net.au/

If nothing seems to fix the problem I recommend that you back up your data including
your user profile under documents and settings and record info such as tcp/ip
configuration, email/newsgroup settings, IE favorites, and any other configuration
info that may help you in a new install. First try a repair installation as described
in links below. If that does not help, then a full reinstall may be in order. If you
do not have a second hard drive or cd burner to save data, you could possibly get
away fine with formatting just the system drive/partition if your hard drive is
divided into logical drives and then installing operating system, applications,
service pack, and critical updates. You would have to backup any data including your
profile on the system partition before formatting or it will be lost. If that is not
the case and you have one drive, you could still try reinstalling into existing
\windows folder without formatting which could preserve most or all of your data
[unless EFS encrypted] but require you reinstall all applications on top of
themselves, reapply service pack, and all critical updates from Windows Update making
sure you have ICF firewall enabled before connecting to the internet. --- Steve

http://www.michaelstevenstech.com/XPrepairinstall.htm
http://www.fujitsu-siemens.co.uk/rl/servicesupport/techsupport/software/windows/xp/Repair.htm