Windows 2000 box reboots on dial up

March 14, 2007 12:47 AM

How can I repair a Windows 2000 box that reboots upon dialling up to the internet?

My mother-in-laws Windows 2000 box has started rebooting when it dials up to her ISP. I suspect some virus/spyware has managed to get it's claws into the system and is being activated when it connects to the internet which then causes a reboot due to some incompatiable/malicious code.

I've downloaded the latest versions of AVG/Ad-Aware/Spybot S&D and run them and they found a few problems and cleaned them up but the rebooting still occurs.

Is there an easy way to repair this system? I have the Windows 2000 installation disks. I also have a OEM copy of Windows XP that has yet to be installed. If I upgrade from 2000 to XP would that work? Will it import all her settings/passwords across?

I'd prefer not to wipe the machine clean if I can avoid it due to her not knowing what her various passwords are (dial-up, email, internet banking).

posted by PenDevil to computers & internet (8 comments total)

From what you've explained, it sounds like the Blaster.A (LoveSan, MBlast.A) virus screwed with your mom-in-law's system. It affects the Remote Procedure Call (RPC) of a computer causing the computer to reboot in 60 seconds when a problem is detected with the RPC.

You can try to turn off the RPC which will let you to connect to the internet without getting booted, and get a patch that will allow you to fix the problem. To do that with Windows XP you can go to Control Panel>Administrative Tools>Services>scroll down to Remote Procedure Call>right click on it and choose Properties>choose the Recovery tab on the top> change all the options for failures from 'Restart the Computer' to 'Take No Action' and apply. I imagine the steps are the same or similar with Windows 2000.

You can google for msblast.exe (the name of the virus file), and there should be several results on how to get rid of it and fix your problem. Its likely just a patch you have to download and run.

If you can, download the patch from a non-affected pc and put it on a usb drive or whatever to transfer it to the infected pc. That way you wont have to disable anything.

Microsoft is also supposed to have a patch to clear this up, Windows Update should take care of the problem, but i'm guessing.. no internet=no update (and 56k doesn't make updates from Windows any pleasant).

Good Luck..
Hope this helps :)
posted by Advocate, I at 1:20 AM on March 14, 2007

That might be it but the computer doesn't reboot 60 seconds after connecting to the internet, it does so immediately (right after the password is sent and I assume the PPP connection is up). I'll definitely investigate this though.
posted by PenDevil at 2:28 AM on March 14, 2007

Try HijackThis as you can use it to disable anything attached to IE (good or bad). Be careful though, as it can cause damage.

It could also be that your Winsock2 stack is fubar'ed. Try LSPFix. There is also probably a Win2k version of winsockxpfix , but I'm not sure what it is.
posted by stovenator at 3:10 AM on March 14, 2007

stovenator: Thanks for the links. I tried LSPFix before but it didn't seem to help. It's not specifically an IE thing as it happens when I use Firefox as well. The dial-up dialog comes up normally, dials in, sends username and password and then immediately reboots. Sometimes it will reboot into a BSOD other times it won't.
posted by PenDevil at 3:51 AM on March 14, 2007

She might not know what her various passwords are, but any malware still on the machine probably does. It sounds like a 'nuke from orbit' situation; in the long run the best way to help your mother-in-law is by spending the time on making sure everything is stable and secure rather than wasting time on an upgrade that might not do the job.
posted by malevolent at 5:25 AM on March 14, 2007

It could be a problem with either the modem or even the phone line. If there is a higher than usual voltage in the line it could be doing some funky things to the computer.
posted by JJ86 at 6:07 AM on March 14, 2007

Try a different modem. Sounds like a hardware problem to me.
posted by chundo at 8:16 AM on March 14, 2007

First, delete the modem driver from the hardware manager and reinstall it with the current driver available on the manufacturers website. This will do two things: upgrade the driver and windows will have to rebuild all the tcpip accociations to that device, so if you truly removed this virus it cannot hook back into it.

Secondly, if this fails, buy a new modem for 15 dollars and install it. Could be hardware.
posted by damn dirty ape at 11:10 AM on March 14, 2007