Win 2000 boots only to a blue screen 1

[DEBWEST]

Hi- i hope someone can help me here...

I have a PC with Win 2K pro on it. It has NAV on it and has had weekly updates and virus scans on it.

When you turn on the PC, it gets to the starting windows screen, then it takes 3 minutes to get to the novell sign on screen, then I get blue screen forever. If I look at the task list , 99% of the CPU is going to svchost.ex
I figure it must be a virus.

I have also booted in safe mode with and without networking with similar results.

 

[ecobb]

Not a virus:

http://www.liutilities.com/products/wintaskspro/processlibrary/svchost/

It could be any number of things. Have you installed any new software lately? Any Service Packs or updates for any existing software?



Hope This Helps!

Ecobb
Beer Consumption Analyst

"My work is a game, a very serious game." - M.C. Escher

 

[DEBWEST]

Hi,

Nothing new has been installed on this workstation. It is in my server room and we use it to change our web pages, otherwise it has been used for internet access.

Any ideas?

 

[AndyWatt]

My first thought on seeing an extremely slow login is "dialers".

Have you tried running Spybot/Ad-Aware on the machine?

Andy
"Logic is invincible because in order to combat logic it is necessary to use logic." -- Pierre Boutroux

 

[DEBWEST]

How can I run anything on this machine, with svchost @ 99%, you never get anything but a plain blue screen?

 

[leopard96]

Can you start up in Safe-Mode to try and run the spyware/adware/virus software? After Post, press F8 when you see the Windows 2000 Logo...Choose Safe Mode without networking. You should have access to the Add/Remove programs. Check for anything that you don't think should be there.

 

[DEBWEST]

I did try that but all I got was a black screen with 'safe' in each corner and idle system process at 99% CPU. Any ideas?

 

[eyec]

yes, boot from a start-up/rescue disc (or go directly to my last paragraph). then examine your system files for drastically different "last accessed" dates.

if you find one with a more recent date then it could be a virus has hijacked it.

also look for new or unfamiliar folders.

delete any items mentioned above and then try to boot to safe mode - DO NOT BOOT TO LAST KNOWN STARTUP.

it you still don't see anything do a re-install/repair using the W2k cd.

 

[jrbarnett]

To add to what has already been mentioned: to try and get some time to work, try and run task manager (start -> run taskman.exe or right click the grey taskbar and choose task manager), on the Processes tab choose your process that's taking large amounts of CPU time, right click on it, choose Set Priority and choose Low.
(Note: you will need to be logged in as an administrator or equivalent user to change the task priority).

This will give the system chances for other tasks to take over and give you a chance to give it a full antivirus/spyware scan.
It may not be though: I had a similar incident when I connected a parallel port CD-RW drive to a Win2K PC and the driver killed the installation, taking lots of CPU time.
I ended up having to wipe and reload the PC.


John

 

[jimp56]

dont forget the option of removing the hard drive and placing it as a slave (assuming not RAID drive set up) in a different computer. make sure that computer is protected with all latest a/v - spybot's tea-timer, etc. before hooking up the slave drive.

then you can run full scans with limited exposure to infection (re-read the part about making sure the scanning computer is fully protected, including firewall, etc).

lastly, you of course have to place that drive into a computer that can read the filesystem (assuming ntfs) such as another Win2K, WinXP machine.

when the infected system isnt booted up, the traces of the malware are sometimes easier to find, and the trojans, etc. that block and reinfect you are not running. this couteracts the whole CPU usage problem.

also dont completely trust native programs, use a web based scanner as a final check before declaring it clean. I like trend micro's housecall scanner.

 

[eyec]

jimp56,

excellent!

 

[prworld]

Hi

Sounds silly, but try swapping your memory (I've had a similar issue and this was the problem)...