xp start up problems

a friend is running windows xp and she has a problem with startup. After putting in password the only thing that loads is the desktop picture. There are no icons whatsoever.She was getting a box come up saying the system was shutting down with a clock giving just 50 secs to shut off this was just before the above problem occured

 

My friend has just told me she is getting a message that windows root system32 file is missing How does she get that back

 

Sounds like Virus: Win32 Blaster is a good suspect.

Symptoms: Computer advises that it will shutdown in 60 seconds. Problems using cut and paste operations in all Office applications. Problems viewing websites. (Website names not being resolved / DNS error)
Affected Systems: Windows NT, 2000 and XP.

Have you Virus scanned lately with a good recent dat file?

I'll be back in a minute......

See:
http://www.windowsbbs.com/showthread.php?s=&threadid=26944&highlight=blaster

http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

You may also want to take a trip to the security forum and check out some of the links that are pinned to the top of the forum. There are links to online virus scanning sites and links to free virus programs.

 

apparently what she done was tried to reinstall xp. She has norton anti virus which stopped working, then she tried to reinstal that.Now all she is getting on boot up is wallpaper and no desktop icons or start menu, plus the root system message when she went into safe mode. Where do we go from here

 

Sorry temara,

I got extremely busy and visits to the board have been rather sporadic. I see this problem has seemed to snow ball. I'm sorry to see that your friend has panicked and rather than confirming this is Viral has tried to do something that should not have been done, when virus infected.

Have you managed to make any progress on recovery? Can you get into windows as administrator and in safemode? Have you downloaded the maxblast removal app and saved it to floppy?This can be done from another computer.

Have you at least looked for the files mentioned in the removal link to get some idea if I was on the mark or had missed the boat? Although that may be impossible without following at least the preliminary steps for ridding yourself of this "Nasty ".

If this is viral it needs to be cleaned up before anything else can be done.

====Shrugging my shoulders?====
At this point I'm not sure if this is an Forum XP software problem or a Forum Security/Virus problem. Tell me how your doing and what you done.

Oh....
I need total exact error "quotes" and details if available. Often specific files involved can be extracted from XP disk or I386 folder.

 

Ann - I think leave it here. I agree it's about 99.9% probable that the blaster worm ate the system but enough folks with XP have the problem would be more likely to spot this thread in the XP section.

tremara - I can only echo (and maybe amplify) on what Ann has already told you. If the PC were mine, I'd get a copy of an antivirus program with updates and have it ready on CD. Then wipe out the system (boot with install CD, format, reinstall the OS, put on the updated AV program) and go from there.

 

I would do a clean reinstall also. The Blaster is a worm, and comes through an unprotected internet connection. If your friend is only running AV protection, and no firewall, it will happen again.

Your friend can GO OFFLINE, stop the running process that makes it try to shut down the comp every minute with the task mgr , and she might be able to recover some data. She is not advised to take program files or system files, though.

Johanna