Computer shutting down "Help"

[riggie]

Hi Everyone
My friends computer is shutting down when it reaches the log on screen, he says its the "Boot Worm Virus" but I cannot confirm this until I get the computer tomorrow.
He is running XP with Norton anti-virus but was downloading files from limewire and must have opened a file without scanning it first, I presume.
Anyway I checked the symantec site and they say you cannot run a rescue disk with Windows XP so what are you supposed to do?
I will try running the computer in safe mode tomorrow morning and see if I can scan the drives.
If is shuts down to quick what is the plan?
How do you identify a virus to make a rescue disk?
But any ideas would be gratefully appreciated
cheers
riggie

[Nuttapper]

Hi Riggie, hmmm how does he know its a boot worm virus, or was this just a guess by him ? it may be an idea to take the drive out of the PC, and fit it to another PC single drive only! just to ensure it is the Hdrive is at fault by not booting up and not a fault on the PC itself

[riggie]

Cheers Nuttapper,
Yes I agree, dont know how he found out the virus name, as you say it probably is just a guess, is it safe to just remove my hard drive and replace it with the possibly infected drive?
As I said the computer reaches the log in screen on XP so would that not mean the drive is booting up ok and just software is closing it down

[riggie]

Forgot to add he also got a flurry of adware, pop-ups, etc before the computer went down.

[Nuttapper]

Yes it should be fine just to hook the drive up to another (STANDALONE) PC, I aint ever seen a virus do any harm to hardware myself, but i may be corrected.. or you could go the other route and connect a clean booting drive up to the suspected faulty PC, it isnt unusual to get a pile of pop ups hitting your screen on some sites, a good popup blocker will sort it, but that sometimes also prevents you entering the site, the clever ones pop up behind the main screen, and then you can never seem to close them down.

edit..

no just cos it shuts down wen the boot screen is loading can be a false indicator, I had a PC just last week that had a similar fault, I tried lots of things to cure it, nothing seemed to work, eventually the only thing left was the Mobo (prolly wont be on yours) I ended up taking a gamble and fitting a new one viola- the thing booted up and ran, after about a day and a half of testing everything else on the PC :(

[riggie]

Hi Nuttapper
Update, tried computer today boots up and will sit all day on the login screen.
soon as I open any desktop for any person the computer reboots in about 10 seconds.
Tried safe mode, worked OK ran the existing Norton anti-virus, took 1hr 20mins, found one file W32spybot.worm. Quarantined but made no difference to start up.
Checked web for reboot viruses, found "Stinger.exe" at McAfee, this deals with a lot
of these reboot virus.
Got to go to work will try this Stinger tomorrow afternoon.
I think the Machine must be OK as it ran Norton for 1hr 20m.
Trying to find out what the last program he installed.
Tried system restore no luck ( will disable before running "Stinger" )
Restore to last config no good.
ideas welcome
cheers
riggie

[Nuttapper]

Hi Riggie, thanks for the update, if you can get into the PC in safe mode and run it then its defo a program thats being run under a normal startup, can you get to the MSconfig screen in safe mode

Start > Run msconfig (startup tab)

Have a look and see whats being started up, disable (take the tick out) anything you dont recognise, apply the setting and reboot, if succesful put a tick in the configuration editor window and click okay.

otherwise as you say, boot into safe mode, disable the system recovery tool, (Viruses hide in there) run the scan and delete what it picks up, Norton aint the best to be honest though IMHO..

There was once a know infection that did what you describe, I think it was called welch worm, there is a fix for it, although i think it was included in service pack one for win Xp, so the infection died off.

If all else fails, you can save what you need, delete the partition, format the drive and fresh install.

Regards

[riggie]

Made the stinger.exe floppy but when I try to run in the drive it says disc not formatted but it runs perfect in my own computer ?
Gona try a cd now.

[riggie]

Sorted, scanned everything found nothing,but still shuting down.
Still thought it was virus as I struggled to run the stinger exe but managed.
Just about to wipe drive and I did the following.
Running in safe mode went to
"Accessories/System tools/system info/ software enviroment/Windows error reporting
Found only one item in there "MPFTRAY.EXE" ( McAfee Firewall)had caused system error.
so I went back to desktop still in safe mode, started firewall, and bang system shut down, so just uninstalled McAfee and looks like everything is Ok.
thanks for help Nuttapper
cheers
riggie

[Nuttapper]

Nice one Riggie, glad you got it sorted, was Mcfee still being started up in the MSconfig screen?..

Virus checkers and firewalls do seem to cause a lot of problems in oneway or another, however I suppose they save a lot more problems aswell :D

Thanks for the feedback M8

[riggie]

the computers gone back m8y, but I am sure I seen it listed with all the start up programs but did not pick it out as a problem as I also use it.
Is there any good software to help people diagnose software or hardware problems
I a logical way?