PDA

View Full Version : Odd boot problem on Win95B machine


joea64
10-27-2001, 04:38 PM
(This message has also been posted on the Software Troubleshooting forum, but I'm also posting it here in case that hardware might be involved. Apologies for the duplication.)

I've just run into a strange Windows boot problem on my Windows 95 OSR2 machine (I'm typing this message from my Win98 SE machine).

As comprehensively as I can describe it, the problem started after I put in a CD-RW that I had just created using a Memorex CRW-1622 on the Win98 machine - that is, I put in the newly created CD-RW on the Win95 machine to test how well that system could access it.

Although the Win95 machine has a modern 50x CD-ROM drive, Windows 95 couldn't read the CD-RW properly and Explorer hung up on reading the disk's directory. I hit ctrl-alt-del to close Windows Explorer, then installed a different CD-ROM, and the system spontaneously rebooted and ran Norton Disk Doctor. No problems were found, but when the system booted to Win95, I got a strange dialog box asking me if I wanted to disable file and print sharing on my TCP/IP connection (I have DCC enabled on both machines, and had just been using DCC to move files from the Win95 box to the Win98 box before I tested the CD-RW disc).

I agreed to disable file/print sharing, and then the system brought up the Dial-Up Connection dialer dialog box. I clicked "cancel", but the dialer came up over and over again. As I couldn't get the desktop (Explorer) to respond, I hit ctrl-alt-del to reboot. The system rebooted normally, but this time when it got to the Windows desktop, the drivers that usually load into the system tray (video, sound, Norton CrashGuard, Norton SpeedStart, etc.) didn't load; instead, the Dial-Up Connection dialer popped up again and kept popping up every time I tried to close the box by clicking "cancel".

I rebooted to Safe Mode, then found my Norton SystemWorks 2001 CD and popped it into the CD-ROM drive (which is a bootable drive) and right now I'm running Norton Antivirus to see if there's a virus or worm in the system.

Again, here's the sequence of events:

1) DCC was running, files were transferred from Win95 box (host) to Win98 box (guest). When file transfer was finished, DCC was closed from host side without any problems occurring.

2) CD-RW was burned on Win98 box, tested successfully on Win98 box (works fine in the DVD drive I use as the primary CD), and then tested unsuccessfully on Win95 box, causing Windows Explorer to hang. CD-RW was removed and replaced with another CD-ROM, causing Win95 box to spontaneously reboot.

3) Win95 rebooted after run of NDD, then security message about file/print sharing came up, then DUN dialer came up and would not shut down no matter what I did. Had to C/A/D again. On second boot, drivers wouldn't load into Taskbar and DUN dialer kept popping up again.

4) Rebooted to Safe Mode, then put in Norton Systemworks CD, rebooted and am now running Norton Antivirus.

Questions:

a) Has anyone ever run into a similar problem?
b) What might cause it?
c) What might I be able to do to fix it?

-Joe-

joea64
10-27-2001, 06:16 PM
(6:10 pm) I've found the problem. I _did_ have a worm in my system, the W32.HLL.BYMER worm:
http://www.symantec.com/avcenter/venc/data/w32.hllw.bymer.html

I discovered it when I went into Safe Mode again, opened RegEdit, and found an entry marked "bymer.scanner" in the registry. As I'd already had an encounter with the worm, this set my suspicions on overdrive, so I went to the above URL and followed the procedures to clean the worm out. I've just rebooted, and everything is copacetic again. *whew* *mops brow*

As I've said, this worm doesn't seem to cause any serious damage, according to Symantec - except, of course, to the mood of the unfortunate computer user!! If you suspect you've been hit with this worm (a good clue is if the DUN dialer suddenly starts popping up over and over again and resists all efforts to close it, and your system otherwise starts behaving as slow as molasses), make sure you clean out not just the fake wininit.exe file in the \windows\system folder (NOT the legit file in the \windows folder - the fake file is 220KB or 22KB, the real wininit.exe is 40KB), but also the dnetc.exe file and also, if they exist, dnetc.vbs and dnetc.ini - dnetc.exe is a legit file which is used for distributing various software packages which has been hacked, in some instances, to carry the worm.

-Joe-