Windows XP boot problem, virus?

Posted on 2007-11-19
Medium Priority
Last Modified: 2013-11-22

I have a Windows 2003 Network.  2 Servers, one is SBS Win 2003 and other is a file server / terminal server Win 2003.  I have about 15 workstations, a mix of Win XP and Win 2000.

One of my Win XP machines is giving me problems this morning, I'm scratching my head a bit and don't know how I should attack the problem.  This is where I'm at........

User comes in this morning and boots up her computer.  From what I understand everything at first boot up went fine.......except when boot up was finished she had an error telling her that "Norton Antivirus has errors and needed to but shut down......do you want to send this info Microsoft".  From this point I'm involved.  I see this error sometimes.......usually not a big deal, so first thing I tried was a reboot.  Upon reboot the computer hangs at "Applying Computer Settings".  Interesting......So, I did a little research and found that people get around this by unplugging the network cable.  So I did that, and reboot again.......this time I get past "Applying Computer Settings" and now I get the chance to enter my login information.  So I enter login info (administrator) and now I'm hanging at "Loading Your Personal Settings".   So I tried booting in Safe Mode........and it worked......I was able to get to the desktop.......So I tried to run Norton Virus Scan.  I open Norton, and I go to the scan section, I hit the scan button, and nothing happens........Norton just hangs.

So this is where I'm at.......I suspect this to be a virus, but I can't get a scan to run to find out.  I should tell you that I had this computer taken apart last week for a cleaning, and I pulled the heatsink off and reattached with some Artic Silver.  The computer ran good for 3 days (better than it was before I took it apart).  And I ran a load on the processor when I was in safe mode and it seemed to be running fine.  So I don't think this is the problem, but I've been wrong before.   :-)

Anyone have any ideas?

Question by:strick9
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
LVL 38

Expert Comment

ID: 20313204
Hi Bryce,
I had something similar start on a computer Friday morning, but mine ended up being a corrupted HDD.

Can you remove that HDD, slave it off another computer (with updated DAT files) and scan it from there?

Depending on the layout of your computers, that may be the simplest way to eliminate/confirm malware.


Author Comment

ID: 20313649

Thanx for the reply.......that does make sense......I just wish there was something easier I could try first.   I'll have to wait until tomorrow morning to try this.  I have another computer that was ordered from Dell at the same time and is the exact same model / setup.   So, I will try it there.

Author Comment

ID: 20313931

I decided to go ahead and take this thing apart now.......maybe you can help me further.  These computers have SATA ATA drives......and I'm used to the old ribbon cable setup.  There is only one spot to plug in a SATA cable on the motherboard.  Do they make a cable with 3 connectors on it?  Like you use to see with the old ribbon cable setup?  How would I connect 2 hard drives to this one motherboard.

I think I need to get a new A+ cert.   :-)

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

LVL 38

Expert Comment

ID: 20314358
Sorry about the delay - I had to make a service call.
If you tell me the exact model of the 'good' computer, I can probably find a diagram of the second SATA connection on the motherboard. You should be able to plug the bad SATA HDD right into a turned off good computer, then boot up.

Also - I now have three of these (http://www.buyextras.com/sausb20toide.html) to carry with me on all Service Calls.

They let you connect SATA and IDE (3.5 or 2.5 inch) HDD's via USB cable to a functioning computer.

Author Comment

ID: 20314393
Vic, the two computers are Dell Optiplex model GX520.

I did swap hard drives and the "bad" hard drive had the same problem in the "good" computer.  Also the "good" hard drive worked in the "bad" computer.

Author Comment

ID: 20314594
After doing a little research, I'm pretty sure there is only one SATA port on this motherboard......in fact I have 4 of these machines and all of them are the same model.  And they are the only ones that support SATA drives.......so I guess my only other option is to buy that nifty tool you posted earlier.

Is buyextras.com a reputable site?  Can I buy from there?
LVL 38

Expert Comment

ID: 20314693
I bought two of those from buyextras and one from www.geeks.com
Both sites delivered quickly, about the same price, but slightly different devices.

The buyextras device is (imo) better and I read about them here on EE.

If you wanted to get something local - you could also try a "USB SATA Enclosure" from your neighborhood Giant Computer Store.

LVL 11

Accepted Solution

DoTheDEW335 earned 750 total points
ID: 20319515
Just a few questions:
1) Did you try uninstalling Norton AV in safe mode? (If it's damaged or corrupt it isn't doing you any good at this point and uninstalling/reinstalling may help
2) How long did you wait at the Loading "Your Personal Settings" screen?
3) Did you check the event viewer in System and Applications and look for any specifics that could help
4) Have you scanned the HDD for bad sectors?

I use #3 alot to look for problems.

Author Comment

ID: 20320058

Good questions.......lemme see.....
1)No.  I've had bad experiences trying to install things in safe mode.  If I can't get this hard drive in another computer in order to scan it for a Virus, I will try that.
2)more than 20 minutes
3)No.  Duh!  I will post that next.
4)No.  I think I'm doing that now, not sure if it's working though, doesn't show me any progress.

Author Comment

ID: 20320084
4 errors have shown up.  They are as follows:

Windows cannot access the file C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20071118.016\CCERASER.DLL for one of the following reasons:  there is a problem with the network connection, the disk that the file is stored on, or the storage  drivers installed on this computer; or the disk is missing.  Windows closed the program Symantec Eraser Engine because of this error.
Program: Symantec Eraser Engine
The error value is listed in the Additional Data section.
User Action
1. Open the file again.  This situation might be a temporary problem that corrects itself when the program runs again.
2.  If the file still cannot be accessed and
      - It is on the network,  your network administrator should verify that there is not a problem with the network and that the server can be contacted.
      - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for  further assistance.
Additional Data
Error value: C000009C
Disk type: 3
For more information, see Help and Support Center at


Faulting application Rtvscan.exe, version, faulting module CCERASER.DLL, version, fault address 0x000a9f21.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


wuauclt (980) An attempt to open the file "C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log" for read only access failed with system error 32 (0x00000020): "The process cannot access the file because it is being used by another process. ".  The open file operation will fail with error -1032 (0xfffffbf8).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


wuaueng.dll (980) SUS20ClientDataStore: Error -1032 (0xfffffbf8) occurred while opening logfile C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Author Comment

ID: 20320511
Good news!

The ScanDisk must of found something and fixed it.  I didn't get to see it happen, but one minute it was running scandisk and the next minute it was booting up normally.  Only one problem though.......after I enter my login information it took like 3 or 4 minutes for the desktop to load completely.  This is much longer than normal.

Is it possible that some of these files are residing on faulty sectors?  How could I make that determination?

Author Comment

ID: 20320763
Nevermind.......second boot up went much smoother.  I think we are back in business.

Vic, thank you so much for your help, but I must give DEW the points as it was his suggestion to run ScanDisk.

Thank you both.
LVL 38

Expert Comment

ID: 20321020
Sounds as though you had the same problem I did.
Which is why I mentioned "corrupted HDD." in my very first post.

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How can this article save you time AND money?  In just a few minutes you may discover something you didn't know existed that is easy enough for you to fix yourself!
No matter the version of Windows you are using, you may have some problems with Windows Search running too slow or possibly not running at all. Before jumping into how you can solve this issue, just know there are many other viable alternative deskt…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question