Windows XP Virus

Eric wrote:
> We've encountered a virus on one of our windows xp professional
> machines. It locks the computer up at random intervals. We've
> cleaned the computer using multiple different anti-viruses which
> fixes the problem for a time, however the virus always comes back
> within a day. We've used anti-rootkits and found nothing as well.
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.
>
> Any suggestions would be greatly appreciated.

What is the name of the virus?

Are you sure it is not a heat problem?
"Eric" <Eric DeleteThis @discussions.microsoft.com> wrote in message
news:EACD67D0-2899-448E-B39B-58D67012093E@microsoft.com...
> We've encountered a virus on one of our windows xp professional machines.
> It
> locks the computer up at random intervals. We've cleaned the computer
> using
> multiple different anti-viruses which fixes the problem for a time,
> however
> the virus always comes back within a day. We've used anti-rootkits and
> found
> nothing as well.
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.
>
> Any suggestions would be greatly appreciated.

Eric wrote:
> We've encountered a virus on one of our windows xp professional machines. It
> locks the computer up at random intervals. We've cleaned the computer using
> multiple different anti-viruses which fixes the problem for a time, however
> the virus always comes back within a day. We've used anti-rootkits and found
> nothing as well.
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.
>
> Any suggestions would be greatly appreciated.

Try removing all the system restore points after doing another malware
clean up as malware can hang out in there.

--
C

Unknown wrote:
> Are you sure it is not a heat problem?
> "Eric" <Eric.TakeThisOut@discussions.microsoft.com> wrote in message
> news:EACD67D0-2899-448E-B39B-58D67012093E@microsoft.com...
>> We've encountered a virus on one of our windows xp professional machines.
>> It
>> locks the computer up at random intervals. We've cleaned the computer
>> using
>> multiple different anti-viruses which fixes the problem for a time,
>> however
>> the virus always comes back within a day. We've used anti-rootkits and
>> found
>> nothing as well.
>>
>> It also seems to only lock the computer up if it is connected with the
>> ethernet cable.
>>
>> Any suggestions would be greatly appreciated.
>
>

I doubt that connecting to an ether net would create much heat.

--
C

Could be mere coincidence.
"C" <c.TakeThisOut@nospamers.com.invalid> wrote in message
news:hn8ijn$2pm$1@speranza.aioe.org...
> Unknown wrote:
>> Are you sure it is not a heat problem?
>> "Eric" <Eric.TakeThisOut@discussions.microsoft.com> wrote in message
>> news:EACD67D0-2899-448E-B39B-58D67012093E@microsoft.com...
>>> We've encountered a virus on one of our windows xp professional
>>> machines. It
>>> locks the computer up at random intervals. We've cleaned the computer
>>> using
>>> multiple different anti-viruses which fixes the problem for a time,
>>> however
>>> the virus always comes back within a day. We've used anti-rootkits and
>>> found
>>> nothing as well.
>>>
>>> It also seems to only lock the computer up if it is connected with the
>>> ethernet cable.
>>>
>>> Any suggestions would be greatly appreciated.
>>
>>
>
> I doubt that connecting to an ether net would create much heat.
>
> --
> C

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

Microsoft PCSafety provides home users (only) with no-charge support in
dealing with malware infections such as viruses, spyware (including unwanted
software), and adware.
https://support.microsoft.com/oas/default.aspx?&prid=7552&st=1

Also available via the Consumer Security Support home page:
https://consumersecuritysupport.microsoft.com/

Otherwise...

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2a. WinXP => Run the Windows Live Safety Center's 'Protection' scan (only!)
in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

2b. Vista or Win7=> Run this scan instead:
http://onecare.live.com/site/en-us/center/whatsnew.htm

3. Now run a thorough check for hijackware, including posting requested logs
in an appropriate forum, not here. DO NOT SKIP THIS STEP!!

Checking for/Help with Hijackware:
• http://mvps.org/winhelp2002/unwanted.htm
• http://inetexplorer.mvps.org/tshoot.html
• http://www.mvps.org/sramesh2k/Malware_Defence.htm
• http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Eric wrote:
> We've encountered a virus on one of our windows xp professional machines.
> It locks the computer up at random intervals. We've cleaned the computer
> using multiple different anti-viruses which fixes the problem for a time,
> however the virus always comes back within a day. We've used
> anti-rootkits
> and found nothing as well.
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.
>
> Any suggestions would be greatly appreciated.

Unknown wrote:
> Could be mere coincidence.
> "C" <c.TakeThisOut@nospamers.com.invalid> wrote in message
> news:hn8ijn$2pm$1@speranza.aioe.org...
>> Unknown wrote:
>>> Are you sure it is not a heat problem?
>>> "Eric" <Eric.TakeThisOut@discussions.microsoft.com> wrote in message
>>> news:EACD67D0-2899-448E-B39B-58D67012093E@microsoft.com...
>>>> We've encountered a virus on one of our windows xp professional
>>>> machines. It
>>>> locks the computer up at random intervals. We've cleaned the computer
>>>> using
>>>> multiple different anti-viruses which fixes the problem for a time,
>>>> however
>>>> the virus always comes back within a day. We've used anti-rootkits and
>>>> found
>>>> nothing as well.
>>>>
>>>> It also seems to only lock the computer up if it is connected with the
>>>> ethernet cable.
>>>>
>>>> Any suggestions would be greatly appreciated.
>>>
>> I doubt that connecting to an ether net would create much heat.
>>
>> --
>> C
>
>

Once, yes. Every time, no.

--
C

"C" <c.RemoveThis@nospamers.com.invalid> wrote in message
news:hn8lfm$7rs$2@speranza.aioe.org...

[Context restored; please don't top-post]

>>>>> It also seems to only lock the computer up if it is connected
>>>>> with the ethernet cable.
>>>> Are you sure it is not a heat problem?
>>> I doubt that connecting to an ether net would create much heat.
>> Could be mere coincidence.
> Once, yes. Every time, no.

.... unless the network card activity was the source of the heat. Not likely
for sure, but not worth dismissing outright either.

It 'SEEMS' to only lock up if connected to the Ethernet cable.
Why do you assume 'always'?
"C" <c.TakeThisOut@nospamers.com.invalid> wrote in message
news:hn8lfm$7rs$2@speranza.aioe.org...
> Unknown wrote:
>> Could be mere coincidence.
>> "C" <c.TakeThisOut@nospamers.com.invalid> wrote in message
>> news:hn8ijn$2pm$1@speranza.aioe.org...
>>> Unknown wrote:
>>>> Are you sure it is not a heat problem?
>>>> "Eric" <Eric.TakeThisOut@discussions.microsoft.com> wrote in message
>>>> news:EACD67D0-2899-448E-B39B-58D67012093E@microsoft.com...
>>>>> We've encountered a virus on one of our windows xp professional
>>>>> machines. It
>>>>> locks the computer up at random intervals. We've cleaned the computer
>>>>> using
>>>>> multiple different anti-viruses which fixes the problem for a time,
>>>>> however
>>>>> the virus always comes back within a day. We've used anti-rootkits
>>>>> and found
>>>>> nothing as well.
>>>>>
>>>>> It also seems to only lock the computer up if it is connected with the
>>>>> ethernet cable.
>>>>>
>>>>> Any suggestions would be greatly appreciated.
>>>>
>>> I doubt that connecting to an ether net would create much heat.
>>>
>>> --
>>> C
>>
>>
>
> Once, yes. Every time, no.
>
> --
> C

C wrote:
> Eric wrote:
>> We've encountered a virus on one of our windows xp professional
>> machines. It locks the computer up at random intervals. We've cleaned
>> the computer using multiple different anti-viruses which fixes the
>> problem for a time, however the virus always comes back within a day.
>> We've used anti-rootkits and found nothing as well.
>> It also seems to only lock the computer up if it is connected with the
>> ethernet cable.
>> Any suggestions would be greatly appreciated.
>
> Try removing all the system restore points after doing another malware
> clean up as malware can hang out in there.
>

Let's end this misconception, misunderstanding, or miscomprehension -

*** Malware in System Restore can *NOT* infect a clean OS and is *not*
active unless a restore point that includes it is used ***
Period !!!

MowGreen
================
*-343-* FDNY
Never Forgotten
================

banthecheck.com
"Security updates should *never* have *non-security content* prechecked

Eric wrote:
> We've encountered a virus on one of our Windows XP Professional machines. It
> locks the computer up at random intervals. We've cleaned the computer using
> multiple different anti-viruses which fixes the problem for a time, however
> the virus always comes back within a day. We've used anti-rootkits and found
> nothing as well.
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.
>
> Any suggestions would be greatly appreciated.

Suggestion:

As a test, try another method of connecting, like another NIC, or
wireless dongle. Or try removing the sound card, as a test. Basically,
I suspect the current ethernet card is conflicting with another peripheral.

--
Joe =o)

On Mar 10, 4:53 pm, EN59CVH <EN59... DeleteThis @discussions.microsoft.com> wrote:
> Perhaps it is not the virus at all.  Windows XP system does act funny
> from time to time for no apparent reasons.  The only way to clear this
> anomaly is to reformat the HD, re-install XP and all applications and
> you are done.  Please backup any user data before formatting your HD
> because you are not likely to get them back after the format process.
>
> hth
>
>
>
> Eric wrote:
>
> > We've encountered a virus on one of our windows xp professional machines.  It
> > locks the computer up at random intervals.  We've cleaned the computer using
> > multiple different anti-viruses which fixes the problem for a time, however
> > the virus always comes back within a day.  We've used anti-rootkits and found
> > nothing as well.
>
> > It also seems to only lock the computer up if it is connected with the
> > ethernet cable.
>
> > Any suggestions would be greatly appreciated.

My systems do not act funny and if I ever see one that is acting
funny, it won't be for long.

On Mar 10, 10:05 am, Eric <E....DeleteThis@discussions.microsoft.com> wrote:
> We've encountered a virus on one of our windows xp professional machines.  It
> locks the computer up at random intervals.  We've cleaned the computer using
> multiple different anti-viruses which fixes the problem for a time, however
> the virus always comes back within a day.  We've used anti-rootkits and found
> nothing as well.  
>
> It also seems to only lock the computer up if it is connected with the
> ethernet cable.  
>
> Any suggestions would be greatly appreciated.  

You did not say what scanners you re using or what seems to be found
with what you are using.

A lockup may not be caused by malicious software. Malicious software
would rather just be annoying in different ways. If you still have
the problem after running these scans, keep reading and you will be
able to figure it out.

Perform some scans for malicious software, then fix any remaining
issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

To eliminate questions and guessing, please provide additional
information about your system.

Click Start, Run and in the box enter:

msinfo32

Click OK, and when the System Summary info appears, click Edit, Select
All, Copy and then paste the information back here.

There will be some personal information (like System Name and User
Name), and whatever appears to be private information to you, just
delete it from the pasted information.

Generate a crash dump on a system that is hanging (when it is broken),
then analyze the crash dump

If your system stops responding, hangs or freezes and you can't figure
out why, you can force a BSOD which will create a crash dump file that
you can analyze and see what is running at the point of the freeze and
get some ideas that do not involve guesswork.

While it may seem odd to think about purposefully causing a Blue
Screen Of Death (BSOD), Microsoft includes such a provision in Windows
XP. The feature is built in to XP specifically to diagnose the problem
when a system stops responding and there is no trail in any of the
Event Logs, etc. about what might have happened.

Here's how to force your system to create a BSOD:

Before making registry changes, backup your registry with this popular
free and easy to use tool:

http://www.larshederer.homepage.t-online.de/erunt/

For PS/2 keyboards, launch the Registry Editor (Regedit.exe) and
navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Parameters

For USB keyboards (this USB requirement is a rumor to me so far):

HKLM\System\CurrentControlSet\Services\kbdhid\Parameters

Click Edit, select New DWORD Value and name the new value
CrashOnCtrlScroll.

Double-click the CrashOnCtrlScroll DWORD Value, type 1 in the Value
Data text box, and click OK.

Close the Registry Editor and restart Windows XP.

When you want to cause a BSOD (when your system has stopped
responding), press and hold down the [Ctrl] key on the right side of
your keyboard, and then tap the [ScrollLock] key twice. Now you should
see the BSOD and you will have a crash dump file to analyze.

If your system reboots instead of displaying the BSOD, you'll have to
disable the Automatically Restart setting in the System Properties
dialog box. To do so, follow these steps:

Press [Windows]-Break.
Select the Advanced tab.
Click the Settings button in the Startup And Recovery panel.
Clear the Automatically Restart check box in the System Failure
panel.
Click OK twice.

You can read about the feature here:

http://msdn.microsoft.com/en-us/library/cc266483.aspx

Now when your system locks up, force a BSOD and analyze the crash dump
for clues. You can usually narrow it down with certainty in literally
just a few minutes once you are set up to analyze the dump files. It
takes longer to get setup to analyze than it does to analyze!. If you
don't want to learn how to do that, some helpful person will be happy
to analyze your crash dump for you.

There is no harm in leaving the feature enabled - you can leave it
enabled all the time with no performance hit, but if you are compelled
to remove it:

Launch the Registry Editor (Regedit.exe) and navigate to:

HKLM\System\CurrentControlSet\Services\i8042prt\Parameters

Select the CrashOnCtrlScroll value, click the Edit menu, and select
the Delete command.

Close the Registry Editor and restart Windows XP.