randomly rebooting virus

[Chelsea R.]

hey guys.  I am having a problem with a virus of some sort.  My comp is randomly rebooting, sometimes i'm online and sometimes it's just on the desktop with the screen saver on.  Aslo it randomly freezes to a blank white screen with vertical lines.  When it does this I have to reboot it and then it works fine for a little while.  I've tried updating all the windows 2000 updates and everything and running Norton.  When I did that Norton said I had a worm in msegri32.exe.  I don't know if that's a file or what but I tried deleting it and it supposedly did, however I found it again when i was searching for it.  I don't know how else to get it to stop.  Do any of you techies have any ideas?  I have the installation disk but if I reintall it will I lose all the other stuff on Windows?  Thanx

Chelsea

[Raptor]

Please Read This First - Viruses & Spyware

Does Norton not allow you to remove the file? If it does not, I suggest you boot into safemode and scan from there.

Look at the programs recommended in the sticky. They may be useful to you.

[shield]

You might has the virus called MSBlaster and its a little hard to remove goto microsoft.com and do a search for 'msblast' and they wiull give you a step by step walkthough of how to remove it. if that does not work, you might have a boot sector virus with you can use a WIN98 bootup disk, and run without cd-rom support and type: fdisk /mbr  - which will remove your master boot record of any kind of startup issues. if you are still having the problem, (if you are running winxp, win2k) goto start > run and type 'regedit' and goto Local Machine > Software > microsoft > Windows> Run. and see if you see anyhting unusual that runs during startup.

[merlin_2]

http://support.microsoft.com/default.aspx?scid=kb;en-us;190136  reboot pc and keep tapping the f8 and chose last good config.....do you have firewall on you system...and run this >http://vil.nai.com/vil/stinger/

[Chelsea R.]

Ok I found out that it's a Randex H worm.  I follwed the instructions and downloaded IDEs and some other thing and booted it in safe mode and diid the comand prompt to scan and remove it.  The thing is-- it removed the file but it was still on my comp. maybe through the registry? So now I still have this thing on my comp and there are lots of files and even folders that it has created that it won't let me delete.  It either says access denied, or that it's in use.  So I'm gonna try what you suggested merlin.  I don't have a firewall but I did go through andmake passwords for everything.  Oh, and can anyone tell me what a patch is and how you know it's up to date?  Thanx guys

[Raptor]

Passwords are not the same as a firewall. They are not nearly as effective. Passwords are to keep people from your system that use your keyboard. Firewalls are there for people and programs that try to connect your computer.

Here is an article I suggest you read:

How Firewalls Work

Once you have done so, I suggest you obtain a firewall to prevent the worm from connecting the net.

[allydon]

you can get avg antivirus free on the net and this will remove or quarintine the trojan , it has also caught 2 for me when i have been online it is a very good freeware pakage there is also free updates as well.