neil harland

I am trying to remove the Blaster and Nachi virus from a
laptop running Win XP home. As a result of doing too many
things at the same time I neglected to enable the firewall
before I installed the MS03-026 patch and removed the
virus using the Stinger program from McAfee.
I have installed McAfee AV vers 7.0, updated and scanned.
The results show no Viruses present however I still get an
error message saying that there was a serious error
whenever I restart the computer. Occaisionally the
computer shuts down when Outlook express starts though the
IE web browsing now appears to be stable. The firewall is
now enabled but this is a little bit after the horse has
bolted I fear.

Anyone out there got any ideas?

Regards,

Neil Harland

bill sanderson

Can you give any more detail about the error you get at startup? I'm not
too worried about the firewall being missing for a while, as long as you
scan clean now, but it's hard to diagnose these errors without some more
concrete information.

neil harland

Hi,

Thanks for responding. The error message does not seem to
appear when you start from cold, (Ie the system has been
shut down and then booted up). However when you restart
the system the desk top appears followed by the pane that
says

"The system has recovered from a serious error" and asks
you if you want to send this to Microsoft. When you click
to see what the error report contains, the following is
displayed:

Error Signature
BCCode: d1 BCP1: 00000000 BCP2: 00000011 BCP3:00000000
BCP4: 00000000 OS Ver:5_1_2600 SP:0_0 Product 768_1

I hope this is helpful. This never used to appear until
the virus struck.

Regards,

Neil Harland


startup? I'm not

as long as you

without some more

neil harland

Dear Bill,
Some more information from the error report:

Following files included in the error report:
C\WINDOWS\Minidump\Mini090903-09.dmp
C:\Do***e~1\ANNWAT~1\LOCALS~1\Temp\WER3.tmp.dir00
\sysdata.xml

Hope this helps,

Regards,

Neil


startup? I'm not

as long as you

without some more

lady layla

Hi Neil

Using Explorer or My Computer
Manuever to c:\do***ents and settings\<Annwat...whatever the name
is>\Localsettings\Temp

Delete all files and folders in this directory

This is a hidden directory -- *Local Settings* you will need to show hidden
files

If there are any files that will not delete -- delete all (I normally sort by
date and delete all that are not todays') Then reboot and go back in and delete
all that were not deleted last time

: Dear Bill,
: Some more information from the error report:
:
: Following files included in the error report:
: C\WINDOWS\Minidump\Mini090903-09.dmp
: C:\Do***e~1\ANNWAT~1\LOCALS~1\Temp\WER3.tmp.dir00
: \sysdata.xml
:
: Hope this helps,
:
: Regards,
: : Neil : :
: >-----Original Message-----
: >Can you give any more detail about the error you get at : startup? I'm not
: >too worried about the firewall being missing for a while,
: as long as you
: >scan clean now, but it's hard to diagnose these errors : without some more
: >concrete information.
: >
: >"Neil Harland" <nharland@clitherbecks.freeserve.co.uk> : wrote in message
: >news:585901c376f1$3d0d65f0$a601280a@phx.gbl...
: >> I am trying to remove the Blaster and Nachi virus from a
: >> laptop running Win XP home. As a result of doing too : many
: >> things at the same time I neglected to enable the : firewall
: >> before I installed the MS03-026 patch and removed the
: >> virus using the Stinger program from McAfee.
: >> I have installed McAfee AV vers 7.0, updated and : scanned.
: >> The results show no Viruses present however I still get : an
: >> error message saying that there was a serious error
: >> whenever I restart the computer. Occaisionally the
: >> computer shuts down when Outlook express starts though : the
: >> IE web browsing now appears to be stable. The firewall : is
: >> now enabled but this is a little bit after the horse has
: >> bolted I fear.
: >>
: >> Anyone out there got any ideas?
: >>
: >> Regards,
: >>
: >> Neil Harland
: >
: >
: >.
: >

bill sanderson

I would recommend right-clicking My Computer, choosing Manage, and expanding
Event Viewer.

Look in the various event logs--particularly application and system, for
events corresponding in time and date to the error report you are quoting,
and lets see if there's any description of why the system is crashing.

neil harland

Hi Bill,

Here are the messages from the various event logs when
the system restarts itself, (This time when trying to
connect to the internet to connect to a microsoft help
and support site)

Security Event LOg
IPSec Services: IPSec Services failed to get the
complete list of network interfaces on the machine. This
can be a potential security hazard to the machine since
some of the network interfaces may not get the protection
as desired by the applied IPSec filters. Please run IPSec
monitor snap-in to further diagnose the problem.

Application event log
The COM+ Event System failed to fire the ConnectionMade
method on subscription {D91E8E75-7E08-40F9-8C05-
5C934964C129}-{00000000-0000-0000-0000-000000000000}-
{00000000-0000-0000-0000-000000000000}. The subscriber
returned HRESULT 80004001.

System Event LOg
Error code 1000007f, parameter1 00000008, parameter2
80042000, parameter3 00000000, parameter4 00000000.

I hope this helps. I shall look for any other events but
they all seem to be similar to this.

Regards,

Neil


Manage, and expanding

and system, for

report you are quoting,

system is crashing.

bill sanderson

I can't tell what might be going on.

There is a procedure to replace possibly corrupted system files:

At a command prompt, and with your original XP disk in the CD drive:

sfc /scannow <enter>

This is quick and painless, and perhaps it'll find something that needs
putting back.