is there some virus going around? two of my computers both go down with the same problem?

[kermalou]

two unrelated systems go down with the same problem......can't figure this out for the life of me.

 

[mechBgon]

There are new viruses discovered literally every hour of the day, bro, so the answer is always "yes" to that one. If you have old-version or non-existent antivirus software, try http://www.kaspersky.com/trials and you can try a 30-day trial of some current-generation stuff.

 

[kermalou]

yeah, but can a virus corrupt the \windows\config\system file?

 

[n0cmonkey]

With the proper permissions a virus can do just about anything.

 

[VirtualLarry]

I've never seen that error caused by a virus. All of the times that I've seen it, it was simply caused by a race condition at shutdown, that causes write-cached not to be properly flushed, so that the registry doesn't get written back to disk properly, and thus is corrupted and unreadable at next reboot. Additionally, it could also likely be caused by an unstable system, overclocked/overheating CPU, bad RAM, underpowered/unstable PSU, etc.

But virus? No. There would be no point in "infecting" the registry (directly), it's not an executable file, and if anything, a virus would use it to install registry entries to cause its own infected binaries to run, which means that it wouldn't try to destroy the registry, since it would need it to propegate.

Best solution that I've seen, to workaround the problem with write-cache flushing, is to disable the ability of Windows' to power-off your system when you shut down, and additionally, clear the pagefile during shutdown, giving the other pending writes a change to complete, and thoroughly flushing any IDE HD's write-cache contents to disk, due to the size of the pagefile that is written. (At least, that's predicated on the idea that the pagefile gets flushed after all open files are written, including the registry. If that's not true, then this could be bad info, but it has worked for me for years, after I used to occasionally get those "SYSTEMced is corrupt" errors in W2K about every six months.)

If the OS is W2K SP2 or prior, there is a DISK.SYS hotfix for write-cache flushing issues, and it was also supposedly fixed in SP3, or if you are using XP SP1, there is a hotfix as well, which was also supposedly fixed in XP SP2.

 

[mechBgon]

But virus? No. There would be no point in "infecting" the registry (directly)

If the virus author's goal is to make the system stop working, then infecting/deleting it obviously does have a point, if you look at the empirical evidence here. The computer done stopped workin' :evil:

 

[VirtualLarry]

Originally posted by: mechBgon

But virus? No. There would be no point in "infecting" the registry (directly)

If the virus author's goal is to make the system stop working, then infecting/deleting it obviously does have a point, if you look at the empirical evidence here. The computer done stopped workin' :evil:

I'm not saying that a virus couldn't, only that I've never seen it myself, and it seems rather pointless to me. It would be far less work just to delete the file altogether, rather than randomly corrupt it. I guess I've just seen far too many cases in which "Windows will eat itself", to attempt to blame this on a virus. (Indeed, I've also seen it happen after people have used a 3rd-party "Registry cleaner", usually some months down the road afterwards.)

Plus, I used to have that problem with a corrupted SYSTEM hive myself quite a few times, until MS finally released some disk write-cache-related hotfixes, after stalling for months and claiming that W2K was somehow magically not affected by the same "write cache bug" that Win98se (at the time) was. :|

 

[Tarrant64]

Originally posted by: n0cmonkey
With the proper permissions a virus can do just about anything.

monkey's completely right on that one.
Often at times I never log on as an administrator account. I have seperate user accounts that are limited, so I can still run all the applications/games that I want, just can't install anything. If I want to install something, I can temporarily log on as an administrator, install what I need to, then log on as another user.

Why? This prevents any programs from installing themselves or infecting your computer with all that crap that flies around. If your not an administrator, you can't hurt yourself. It's safer that way. It may seem inconvienient to some, but it is a very efficient way to protect yourself against viruses, spyware, malware, whatever.

Hope everything comes back up ok.