XP rebooting itself

  • Thread starter Thread starter Sue
  • Start date Start date
S

Sue

A while back we got the W32.Welchia.Worm on our system
which infected the following. Nortons them removed them.

The tool has deleted the viral file "C:\WINDOWS\system32
\config\systemprofile\Local Settings\Temporary Internet
Files\Content.IE5\S4YWJQ26\WksPatch[1].exe".

The tool has deleted the viral file "C:\WINDOWS\system32
\drivers\svchost.exe".

Since this time, our system likes to reboot itself, and
normally this is when internet explorer is open, but not
in use.

Any suggestions?
 
do a backup of your personal files and wipe the box... sounds like you still
have an infection. i'm assuming you are up-to-date with your virus defs...
and you re-ran the removal tool?
 
A while back we got the W32.Welchia.Worm on our system
which infected the following. Nortons them removed them.

The tool has deleted the viral file "C:\WINDOWS\system32
\config\systemprofile\Local Settings\Temporary Internet
Files\Content.IE5\S4YWJQ26\WksPatch[1].exe".

The tool has deleted the viral file "C:\WINDOWS\system32
\drivers\svchost.exe".

Since this time, our system likes to reboot itself, and
normally this is when internet explorer is open, but not
in use.

Any suggestions?
Click to expand...

Both of the files that were removed were not system files and are not
needed by Windows to run correctly.

When Norton notified you of the welchia worm, you allowed the program to
clean the virus. Did you also visit the Symantec website and look up
welchia in their library? The documentation on the virus has some extra
steps that you need to do manually. Once those are done, any messages
regarding the "missing" (and unwanted) files will be gone.

You still have a problem with Windows rebooting. We need to figure out why.
Suggestions:

--Check that Norton's has kept it's virus definitions up to date. After
confirming that you have current virus definitions, perform a full system
scan. Check the program's help files for directions if you do not know how
to do this.

--Check the system for other malware using products like AdAware from
www.lavasoftusa.com and Spybot Search and Destroy from
http://www.safer-networking.org. Download the programs. Install them.
Update them and then scan the system.

--Check Event Viewer (Start> Run> eventvwr.msc) for error information.
Double click red and yellow items listed in this tool's screens for more
detailed error information. Hopefully, you will be able to pick up on a
pattern (and a few file names) that coincides with the unexpected
shutdowns. With the clues from this tool, research the error messages
online to see if there are known fixes or at least explanations for them.
 
Did you turn off System Restore? If you didn't and any
of the files that were affected got backed up, then they
are still on you machine, and thus you machine is still
infected. Also, did you check for the W32.Blaster worm
(these two worms may be one in the same I am not sure)?
The symptoms you are describing sound just like this worm.

Ben
 
Back
Top