MSBlast Removed, computer still restarts ....

[John Doe #2]

My parents recently had msblast infect their computer running windows 2000. I removed both the file and the registry entry, and sealed the vulnerability with a patch. Additionally I put a firewall up and blocked a number of suspect ports.

Nonetheless whenever they attempt to open an attached file in outlook express, or print a web page with internet explorer --- the computer immediately restarts without warning or any sort of message. I have run an up-to-date local virus scanner as well as RAV, PandaSoft, and Housecall online, and downloaded Stinger and Norton's removal tool, but they have all been unable to come up with anything! The firewall does not show any suspicious activity either.

I am really puzzled by this. Someone suggested a format and reinstall of windows, and if it comes to that I will take that action, but I'd really appreciate if there were another solution out there.

Thanks,
John

[shawshank62]

you could always give adaware and spybot a try. make sure there isnt any other trojans/spyware.

just search for those at www.download.com for the download.

[John Doe #2]

yeah, unfortunately I already tried those too nada

[Buzioid]

Is there a possibility that they could tun Windows System Restore on it?

[kantlivelong]

my freind also had the virus so i did a temporary solution for him..

when it does the countdown for shutdown just go to command prompt and type

shutdown -a

it will abort the shutdown and you can resume with the computer....

[John Doe #2]

That's the thing, there is never a countdown . I also went into the Administrative Tools >> Services and told it when the RPC protocol fails not to restart the computer, but instead to restart the service. This does not have any affect either. I'm puzzled.

[Ruler2112]

If it's doing what I think it's doing (just blip- there's the POST screen), try reinstalling IE/Outlook. I would guess that some system file got screwed up and is executing what I call 'restart code'. Basically, it's a certain hex sequence that, when executed, makes your power supply via the APIC interface restart your machine. (And yes, I have the assembly code to do it. 26 bytes if I recall correctly. ) Even if the function is turned off in the BIOS, you can turn it on via software and then reboot.) I've gotten this symptom on several occasions and it's gone away after I uninstalled/reinstalled the program that was causing it. I'm guessing that there's a hex sequence in a file somewhere being executed when it's not supposed to be, causing this problem.

If windoze is actually shutting down instead of the computer restarting itself at a system level, ignore the above.

[John Doe #2]

I think you may have the solution! It is certainly restarting at the system level, not windows shutting down. thanks! I will have to try this later today.