Windows XP won't load

[austin316]

this seems to be a worm, but I don't know how to delete it. I try to startup in safe mode, but it still restarts and gives me this error. what can I do?

 

[dclive]

Originally posted by: austin316
this seems to be a worm, but I don't know how to delete it. I try to startup in safe mode, but it still restarts and gives me this error. what can I do?

I'm assuming this happens when you're 'in' the OS, and a message appears that LSASS is restarting your computer. This was patched a few months ago via Windows Update, so I suggest you
1. turn on your NIC's XP firewall
2. be ready to type shutdown -a if a problem occurs before you can do the firewall
3. go to Windows Update and update *everything*.

You may wish to consider having a hardware firewall between your computer and the internet.

If you meant that this happens when XP is initially loading, please describe the exact error, time this happens, and any other information you can provide. With just one line of text is very difficult to get a meaningful understanding of the problem.

 

[mechBgon]

If you got attacked by an Internet worm, then you should start by realizing your defenses are down somewhere. How about read this page to get some ideas about your security.

1) Firewall. Don't let your computer talk to strangers. If you have broadband Internet, get a home router like a Netgear RP614, Linksys BEFSR41 or such like. If you have WinXP, get SP2 and use its firewall. If you don't have WinXP, get free ZoneAlarm. Make sure the firewall is in effect BEFORE you plug in your network cable. Cable plugs in, lights go on... *clang*, fight's on.

2) Patch. Get those vulnerabilities fixed.

3) Antivirus software. Hopefully self-evident. Make sure it updates daily and configure it for maximum detection. If you have the option to have it deal with threats by itself, that's a good idea.

4) Strong account passwords. Stops share-hopping worms from finding easy ways in.

5) Use Limited or Restricted-User accounts for daily usage, if you have an OS that allows that. Reserve the Administrator privileges for an account that is used only for Admin duties and nothing else.

6) Avoid P2P, which is one of the common means by which viruses spread.


Having said all that, to actually fix your system... how far does it get in the bootup process? Does it reach the desktop screen and then begin a shutdown? If so, unplug your network cable, go Start > Run > shutdown /a and then disable System Restore. Use a live computer to download McAfee Stinger, burn it to CD or put it on a thumb drive or even a floppy (it's small enough), then run Stinger on the affected system to start with (there's a link to Stinger on the page I linked up above).

Assuming it's WinXP: If Stinger gets the computer cleaned up enough to boot and stay booted, then on a healthy computer, download the whole WinXP Service Pack 2 installer if you have that much bandwidth, and patch the affected computer. If you don't have that kind of bandwidth, then get the free ZoneAlarm firewall software and the Update Rollup 1 patch (links on page above) and get started with those.

After you have the worms off, the firewall on and the main holes patched, go ahead and update your regular antivirus software if you have some (reinstall it if necessary), and do a full scan with all options turned on. If things prove too difficult, back up your data and reinstall Windows from scratch.